A lawyer who reads regulations against running software.

I am a lawyer based in Kozhikode, Kerala, working in privacy law and commercial contracts. I hold a law degree and diplomas in international privacy laws, and have spent about four years as a legal analyst, with a major focus on privacy law.

I write about the part of the work I know best: how privacy regulation meets software, and how contracts carry its obligations. I start from what a system does, then map it to what each law requires.

What I work on

My daily work sits across the GDPR and UK GDPR, the CCPA and CPRA, India's Digital Personal Data Protection Act 2023 and the UK's PECR. I am also studying AI data governance, including the operation of the EU AI Act and the ISO/IEC 42001 management standard.

In practice that means drafting and maintaining data processing agreements, privacy policies, DPIAs and records of processing, assessing the risk of cross-border data transfers, and building vendor compliance frameworks for SaaS products, plugins and online stores.

How I work

I work directly with engineers, product managers and leadership, so most of my output has to survive contact with code. A consent requirement is only useful if it becomes a banner that blocks the right scripts, a record that can be produced on request, and a setting a user can reverse as easily as they gave it.

I treat risk as a calibrated judgement, not a checklist. Where the law is settled, I say what it requires. Where it is not, I say so, set out the defensible positions, and recommend one with the reasons.

What you will find here

Articles on consent, data processing agreements and cross-border data rules, written from the practitioner's side. Each states its date and is revised when the law or my view changes. They are general information, not legal advice.