A founder sent me his company’s privacy policy last month. He seemed proud of it. “We copied and adapted this from a well-known SaaS company’s website,” he said. “That should cover us, right?” It didn’t.…
A founder told me something during a recent consultation that I hear often. “We use maybe fifteen different vendors, cloud storage, payroll software, email marketing tools, analytics platforms. I genuinely don’t know if any of…
An HR head told me something during a consultation. I’ve heard it in different words many times since. “We’ve been so focused on customer data compliance, we honestly never thought about our own employee records.”…
A founder building an AI-powered customer support tool called me recently. He seemed fairly confident about his setup. “We’re just using our own customer chat logs to fine-tune the model. It’s our data, our customers,…
A founder asked me something last week that a lot of growing businesses eventually ask. “We’re doing well, we handle a fair amount of customer data now. Do we legally need to hire a Data…
A client I was advising on DPDP readiness last month asked me something that a lot of growing companies eventually ask: “We’re not a bank, we’re not Google — surely this ‘Significant Data Fiduciary’ thing…
A founder messaged me a few weeks ago after reading yet another compliance update. “Nitin, everyone keeps saying ‘consent manager’ like I’m supposed to know what that means. Do I need to build one? Hire one? Buy one?”…
A client called me recently, a little worried. A customer had emailed his company asking, “What data of mine do you actually have, and I want it deleted.” He didn’t know how to respond. He…
A founder I spoke with recently runs a coding platform for teenagers. Good product, genuinely useful, thousands of students signed up. However, when I mentioned verifiable parental consent under the DPDP Act, he looked a little blank.…
A client called me last month, sounding a bit panicked. “We use an American cloud provider, our support team sits in the Philippines — are we even allowed to send customer data there under this…
