LIJDLR

DPDP Act

ORCHESTRATING ACCOUNTABILITY: LIABILITY OF THE SYSTEM DEPLOYER IN AGENTIC AI UNDER INDIAN LAW

Volume IV Issue III /

ORCHESTRATING ACCOUNTABILITY: LIABILITY OF THE SYSTEM DEPLOYER IN AGENTIC AI UNDER INDIAN LAW Samarth Udasin, 5th year student of B.Sc.LL.B (Hons.) [Cyber Security] at National Law Institute University, Bhopal (India). Divyansh Rai, 5th year student of B.Sc.LL.B (Hons.) [Cyber Security] at National Law Institute University, Bhopal (India). Priyanshu Tripathi, 5th year student of B.A. LL.B (Hons.) at National Law Institute University, Bhopal (India). Download Manuscript doi.org/10.70183/lijdlr.2026.v04.306 Agentic AI systems do not merely respond to queries they act, decompose goals, call APIs, enter transactions, and produce irreversible real-world consequences autonomously. That shift from tool to actor breaks every assumption on which India’s intermediary liability law rests. This paper argues that existing Indian law already assigns liability to the right party: the System Deployer, the entity that selects the AI model, integrates tools, engineers data flows, and directs the agent’s consequential actions. The principle is straightforward liability follows control. Section 79 of the Information Technology Act, 2000 shows that the Deployer’s active orchestration role disqualifies it from safe harbour: while it qualifies as an intermediary under the statutory definition, it fails every substantive condition that Section 79(2) requires before that status translates into immunity. The Digital Personal Data Protection Act, 2023 confirms this, designating the Deployer a Data Fiduciary who will carry non-delegable duties once Section 8 commences. SEBI’s algorithmic-trading framework demonstrates that Indian regulators already impose full liability on deploying entities regardless of algorithmic opacity. Tort principles of negligence and absolute liability complete the picture. Comparative analysis of the EU Digital Services Act and L’Oréal v eBay confirms global convergence. The paper concludes with a governance framework grounded in the RBI FREE-AI Report. No new legislation is needed.

ORCHESTRATING ACCOUNTABILITY: LIABILITY OF THE SYSTEM DEPLOYER IN AGENTIC AI UNDER INDIAN LAW Read More »

DIGITAL DATA PRIVACY IN THE AGE OF ARTIFICIAL INTELLIGENCE

Volume IV Special Issue I /

DIGITAL DATA PRIVACY IN THE AGE OF ARTIFICIAL INTELLIGENCE Deepti Prakash Singh, Research scholar in the Faculty of Law, University of Allahabad (India) Download Manuscript doi.org/10.70183/lijdlr.2026.v4sil.28 In this AI-driven world, with the consistent growth of digital information, data privacy has become a critical concern for individuals because personal data has become a new currency in this digitally interconnected world. This article explores common threats, vulnerabilities, and challenges relating to data protection and examines how the rapid development of artificial intelligence has transformed data-processing capabilities. Key principles such as data minimisation, express consent, transparency, accountability, and lawful processing are discussed. Further, this article focuses on digital governance in India with reference to the Digital Personal Data Protection Act, 2023. Its objective is to examine how the law seeks to protect digital personal data with legal clarity and to ensure fair, lawful, and transparent processing. It also discusses the Act’s overall impact on individuals and industries, and how it helps encourage stronger privacy norms to boost digital trust. The paper finds that India’s data-protection framework is a significant legislative step, but its effectiveness depends on clear enforcement, institutional independence, user awareness, and responsible AI governance. It concludes by emphasizing the importance of maintaining harmony between innovation, privacy, transparency, and legitimate state functions to establish strong rights. Strict penalties and a responsible digital regulator are essential to strengthening the digital future. However, regardless of several preventive laws and measures, users of digital services must possess adequate digital awareness and literacy to understand cyber risks and support informed decision-making. Hence, data privacy and responsibility in AI development are among the most important pillars of sustainable digital growth.

DIGITAL DATA PRIVACY IN THE AGE OF ARTIFICIAL INTELLIGENCE Read More »

IMPACT OF THE DIGITAL PERSONAL DATA PROTECTION ACT ON LAW-ENFORCEMENT INVESTIGATIONS

Volume III Issue IV /

IMPACT OF THE DIGITAL PERSONAL DATA PROTECTION ACT ON LAW-ENFORCEMENT INVESTIGATIONS Jyoti, LL. M. Student at School of Law, Bennett University, Greater Noida, U.P., (India) Download Manuscript doi.org/10.70183/lijdlr.2025.v03.173 India’s data privacy paradigm has been revitalised through the Digital Personal Data Protection Act, 2023 (DPDP Act), which demands vigorous protection of personal data and, at the same time, extends some important exemptions to the law enforcement agencies. One of the major reasons for this Act getting into place was the expected increase in cybercrimes in 2025, their types including ransomware attacks, encrypted terror communications, etcIndia’s data privacy paradigm has been revitalised through the Digital Personal Data Protection Act, 2023 (DPDP Act), which demands vigorous protection of personal data and, at the same time, extends some important exemptions to the law enforcement agencies. One of the major reasons for this Act getting into place was the expected increase in cybercrimes in 2025, their types including ransomware attacks, encrypted terror communications, etc. This Act, through its Section 17(1)(c), gives the power to data processing for offence prevention, detection, investigation, or prosecution without seeking the consent of the individual, or of confirming the accuracy of the information to such agencies as the CBI and state police. Such practices provide law enforcement officials quick access to the digital evidence of private fiduciaries, making it easier for them to overcome the encryption problems in cases of financial fraud and terror financing, as has been indicated in the recent investigations by the Delhi Police. The Draft Rules of 2025 support this by demanding timely breach notifications and specifying fiduciary responsibilities. On the other hand, there are still challenges present: the centralised Data Protection Board (DPB) has been criticised for being potentially influenced by the executive, hence losing accountability and public trust in government, leading to probes. The potential for misuse posed by enforcement gaps has been highlighted, particularly concerning the rise of AI-driven crimes, which are taking centre stage in the media. In the end, the DPDP Act favours the cause of investigations in this digital era, but it also calls for the DPB to remain independent and to support itself with technology to reach the optimal balance between privacy and security.  

IMPACT OF THE DIGITAL PERSONAL DATA PROTECTION ACT ON LAW-ENFORCEMENT INVESTIGATIONS Read More »

CONSENT MECHANISMS UNDER THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: A COMPARATIVE LEGAL ANALYSIS WITH GDPR AND CCPA/CPRA

Volume III Issue II /

CONSENT MECHANISMS UNDER THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: A COMPARATIVE LEGAL ANALYSIS WITH GDPR AND CCPA/CPRA Vedant Raj Chaurasiya,BBA LLB (Final Year – X Sem.), Amity Law School, Amity University Madhya Pradesh Download Manuscript doi.org/10.70183/lijdlr.2025.v03.61 Consent remains a foundational pillar in contemporary data protection frameworks, yet its normative basis, scope, and enforceability vary significantly across jurisdictions. India’s enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) signals a shift towards a consent-centric model, but this framework departs in meaningful ways from the paradigms established under the European Union’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA), as enhanced by the California Privacy Rights Act (CPRA). This paper conducts a structured comparative and doctrinal analysis to examine how each of these regimes conceptualizes consent, the role of enforcement mechanisms, and the degree of autonomy afforded to individuals. The GDPR situates consent within a rights-based approach, requiring it to be freely given, informed, specific, and revocable—supported by institutional safeguards like independent data protection authorities and mandatory risk assessments. Conversely, the CCPA/CPRA reflects a consumer-choice model where transparency and opt-out functionality dominate, with consent obligations emerging only in limited scenarios. The DPDP Act, though framed around consent, weakens its efficacy by introducing expansive “deemed consent” provisions and lacking critical oversight tools such as mandatory Data Protection Impact Assessments (DPIAs) or a fully independent regulatory authority. The analysis further explores the consequences of this design on India’s cross-border data transfer capability, especially its divergence from GDPR adequacy standards. Arguing for the evolution of a consent-plus architecture, this paper recommends enhancements such as fiduciary accountability, dynamic and context-sensitive consent models, and user interfaces tailored to India’s socio-linguistic diversity. These interventions are imperative for strengthening user autonomy, enhancing legal coherence, and enabling India’s data regime to stand alongside global best practices in digital rights governance.

CONSENT MECHANISMS UNDER THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: A COMPARATIVE LEGAL ANALYSIS WITH GDPR AND CCPA/CPRA Read More »