Industry domain
Software, platforms, content and connectivity — building products inside a fast-moving regulatory perimeter.
Technology businesses in India now operate under a genuine data protection statute. The Digital Personal Data Protection Act, 2023 introduced consent, notice, purpose limitation, security and breach notification obligations backed by meaningful penalties, and the compliance work is architectural rather than documentary — consent flows, retention logic and deletion capability have to exist in the product.
Platforms carry a second layer: the Intermediary Guidelines set the conditions for safe harbour, including grievance officers, takedown timelines and, for significant social media intermediaries, additional obligations. CERT-In's six-hour incident reporting and log retention directions apply far more broadly than most companies assume. And consumer-facing digital businesses now face e-commerce rules, dark pattern guidelines and endorsement disclosure requirements.
Most of the volume is contracting: enterprise SaaS and licensing, cloud and hosting, outsourcing and delivery agreements, master services agreements and statements of work, reseller and channel arrangements, and content licensing. The negotiation almost always concentrates in the same four places — data, IP ownership, service levels and liability.
Around it sits corporate work — venture and growth funding, acquisitions of product and services businesses, and ESOP structuring — and a growing regulatory advisory load as products expand into payments, lending, health data or gaming, each of which brings its own regulator.
DPDP readiness and data mapping, notice and consent architecture, data principal rights processes, retention and deletion policy, processor and sub-processor agreements, cross-border transfer analysis, and the governance record a data fiduciary must be able to produce.
SaaS and subscription terms, software licensing, cloud and hosting, master services agreements and SOWs, systems integration and implementation, support and escrow, and the service level, IP and liability provisions on both the vendor and customer side.
Intermediary due diligence and safe harbour, grievance redressal and takedown workflow, content and community policy drafting, government and law enforcement notices, and online gaming and advertising compliance.
CERT-In reporting and log retention compliance, security terms in vendor contracts, breach response playbooks, and live incident support including the parallel DPDP and CERT-In notification tracks.
Seed to growth rounds, convertible instruments and preference terms, ESOP plan design and grant documentation, product and team acquisitions, and IP and code ownership diligence.
Licensing and authorisation under the Telecommunications Act, 2023, TRAI compliance, infrastructure and tower sharing, interconnection, and broadcasting and distribution arrangements.
Factual descriptions of the kind of work handled in this sector. Client names and identifying details are omitted, and nothing here is a representation about the outcome of any case.
The authorities, tribunals and courts that cases in this sector most often involve.
Most digital lending arrangements we review were drafted as ordinary service contracts and then patched for the RBI's directions. That order is the problem — the framework changes who may hold the customer, who may collect money, and what must be disclosed before the borrower commits.
7 min read
General information about legal issues in this sector. It is not legal advice and does not create a lawyer–client relationship.
Very likely yes. You process employee personal data, and you almost certainly process personal data on behalf of customers — which makes you a data processor with contractual obligations flowing from your customers' fiduciary duties. Business customers are already pushing DPDP terms into vendor contracts, so the commercial pressure often arrives before the regulatory one.
Ownership of work done by contractors and early freelancers. Unlike employees, contractors generally retain copyright in the absence of a written assignment, and a startup that built its first version through freelancers frequently cannot show a clean chain of title. It is far cheaper to remediate before a funding round than during one.
Check that it comes from an authorised officer in the prescribed form, act within the timeline the Intermediary Guidelines prescribe, and record what you did and when. Safe harbour depends on compliance with the due diligence obligations, and the record is what evidences it. Where a notice appears defective or overbroad, that is a considered legal position to take rather than an operational decision — take advice before ignoring it.
Only if the purpose is within what you gave notice of and obtained consent for, and if your processor obligations to business customers permit it. Retrofitting consent for a new purpose is not generally available under the DPDP framework, so this needs to be designed into the notice and the contract rather than added later.
Practice areas that serve this domain
Trade marks, copyright, designs and trade secrets — protection, commercialisation and enforcement.
Acquisitions, investments, joint ventures and reorganisations — structured for the regulatory reality they have to survive.
Workforce structuring, the new labour codes, industrial relations and the disputes that follow termination.
