Saya & Associates
Compliance built before the deadline arrives.
India's data protection regime and the EU's AI rules are phasing in on fixed statutory dates. The practice builds compliance before the dates arrive — and responds when something has already gone wrong.
From first gap assessment to breach night.
DPDP readiness programmes
Gap assessment against the DPDP Act, 2023 and DPDP Rules, 2025; consent and notice architecture; retention and erasure schedules; security-safeguard documentation — sequenced to the statutory phase-in ending 13 May 2027.
GDPR for India-based businesses
Extraterritorial applicability analysis, Article 27 EU-representative arrangements, lawful-basis mapping, and EU–India transfer mechanics — standard contractual clauses with transfer impact assessments.
AI governance
AI use-policies, vendor and model-provider contract terms, EU AI Act applicability and obligation mapping, and India's labelling and traceability requirements for synthetically generated content under the IT Amendment Rules, 2026.
Consent Manager advisory
For businesses integrating with India's Consent Manager ecosystem — and for entities evaluating registration as Consent Managers when the Rule 4 framework commences on 13 November 2026.
Data contracts
Data-processing agreements, intra-group transfer agreements, vendor and sub-processor terms, and privacy positions in commercial negotiations.
Breach response
Incident playbooks before the incident; on-call counsel during one — assessment, notification strategy, regulator correspondence, and the dispute exposure that follows.
Ongoing privacy counsel
Retainer-based counsel as products, vendors and the rules change — so compliance keeps pace with the business instead of trailing it.
The dates that govern the work.
DPDP Rules notified — 13 November 2025
The DPDP Act, 2023 came into force on a phased schedule with the notification of the DPDP Rules, 2025. The Data Protection Board has been constituted; substantive obligations phase in over 18 months.
AI-content rules in force — 20 February 2026
The IT Amendment Rules, 2026 created India's regime for synthetically generated information: prominent labelling of AI-generated content, embedded metadata and traceability, accelerated takedowns, and prohibited deepfake categories.
EU AI Act transparency & GPAI enforcement — 2 August 2026
Article 50 transparency duties (chatbot disclosure, deepfake labelling) apply, and the European Commission's enforcement powers over general-purpose AI providers become exercisable. High-risk system obligations are set to defer to 2 December 2027 under the Digital Omnibus agreement, subject to formal adoption expected mid-2026.
Consent Manager framework commences — 13 November 2026
Rule 4 of the DPDP Rules comes into force: registration opens for entities seeking to operate as Consent Managers (Indian companies with minimum ₹2 crore net worth, among other conditions). This is the opening of the regime — not a compliance deadline for ordinary businesses.
DPDP hard enforcement — 13 May 2027
Notice and consent standards, security safeguards, breach notification, retention limits, children's data rules, Significant Data Fiduciary obligations and Data Principal rights take effect — with Board penalties of up to ₹250 crore per violation for failures of reasonable security safeguards.
Statutory positions as of June 2026. Dates reflect Gazette notifications and, for the EU, a provisional agreement pending formal adoption.
Built against the statutory dates, not against a template.
Map the data
What personal data exists, where it flows, who touches it, and which laws attach — documented as the baseline everything else builds on.
Close the gaps
Notices, consent flows, contracts, policies and safeguards — prioritised by exposure and sequenced to the statutory dates.
Keep it current
Periodic review as products, vendors and rules change; breach playbooks tested before they are needed.