I recently completed around six hours of Data Privacy sessions with first-semester MBA students. What interested me even more came afterwards — Data Privacy became part of their Mid-Term Examination. I have been involved in privacy education for some time now — through corporate sessions, management students, courses and workshops. But a recent teaching assignment made me think about how privacy education itself may be evolving. I had just completed around six hours of Data P

A recent fintech privacy assessment reminded me that the best outcome of an assessment may not be a longer report. Sometimes, it is seeing issues being addressed before the report is even complete. I am currently working with a fintech organization developing an application designed to analyse users' income and spending patterns. From a privacy perspective, this is naturally an interesting application to assess. Financial information can reveal a great deal about an individua

An employee needs to summarise a long document. Someone in HR wants help drafting a communication. A sales executive wants an AI assistant to analyse customer information. A developer pastes some code into an AI tool to troubleshoot a problem. A manager uploads a spreadsheet and asks for insights. None of these people may think they are introducing artificial intelligence into the organisation. They are simply trying to get their work done faster. But from an AI governance pe

When we talk about privacy education, the conversation often begins with careers. What roles exist in privacy? What does a Data Protection Officer do? Do organisations need privacy professionals? What skills should students develop? Is privacy going to become an important career opportunity as India's DPDP framework takes shape? These are important questions, and they were part of my recent interactions with management students while teaching data privacy. But something more

Designing a consent screen can look deceptively simple. Explain why personal data is required. Present the relevant information. Add a checkbox, toggle or button. Capture the individual's choice. But when an organisation actually begins implementing consent, the difficult questions start appearing. What exactly is the individual consenting to? Are different purposes sufficiently clear? Is consent actually required for every activity? Can optional processing be separated from

Suggested excerpt: DPDP implementation should not begin with a checklist or privacy policy. It should begin by understanding the personal data an organisation processes, where it moves and how it is managed.