Category
IT Act, Aadhaar eSign, audit trails, and what holds up in court.
Most DPDP guidance is written for compliance officers. This is the engineering version: schema migrations, consent state machines, retention jobs, and audit patterns for a defensible Indian SaaS codebase.
Legal is not reviewing every npm install — you are. Here is the practical check to run before adding a dependency, and the licence type that catches most SaaS teams off guard.
Most DPDP coverage is written for legal teams. This piece maps the Act's obligations to concrete engineering work: consent tables, data rights endpoints, deletion flows, and breach notification infrastructure.
DPDP Rules 2025 are in force. Most guides target compliance officers. This one targets the engineer assigned the ticket: four code changes that cover every engineering obligation in the Act.
The DPDP Rules 2025 specify six engineering obligations for Indian SaaS products. Here is what consent, erasure, security safeguards, and the rights API look like in code, with a priority order for compliance.
Your eSign audit trail proves who signed and when. India's BSA 2023 requires a Section 63 certificate before that record is admissible as evidence — and your eSign platform can't issue it for you.
Aadhaar eSign authenticates the individual, not the company. For B2B vendor contracts, this distinction matters more than most teams realise. Here is the gap and how to close it.
Section 3A of India's IT Act doesn't specify a technology — it specifies four reliability conditions. Here's what each one requires from your eSign implementation in practice.
Most eSignature vendors advertise ‘tamper-evident’ documents. Here is what that property proves, where it runs out, and what else you need to make a signed document hold up in a dispute.
A decision framework for Indian businesses: where Aadhaar eSign is legally recognised and sufficient, the specific portals where Class-3 DSC is genuinely required, and how to design a fallback when UIDAI is down.
Most compliance teams file their eSign vendor assessment and move on. SOC 2 auditors who understand signing stacks don't. Five control areas they specifically test, with the evidence needed for each.
Practical guides, product updates, and compliance notes — straight to your inbox. No fluff.
Newsletter is opening soon. We'll switch this on once we've got our first issue ready.