Technology Law Services for Data Privacy, Cybersecurity, SaaS & AI

A SaaS agreement typically covers service levels, data ownership and processing terms, security and confidentiality obligations, liability and indemnity, termination and data return or deletion, and compliance with applicable data protection law.

As of now, India does not have a standalone law dedicated exclusively to artificial intelligence. AI-related issues are currently addressed through existing frameworks such as data protection, IP and consumer protection law, along with sector-specific guidance, and this area continues to evolve.

The Data Protection Board of India is the authority established under the DPDPA, 2023 to oversee compliance, handle data breach matters and adjudicate certain data protection complaints, now that the Digital Personal Data Protection Rules, 2025 have been notified; appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

A software licence agreement typically covers the scope of permitted use, restrictions on modification or distribution, intellectual property ownership, support and maintenance terms, and liability for defects or non-performance.

Under the DPDPA, 2023, consent must generally be free, specific, informed, unconditional and unambiguous, and individuals must be given a clear notice describing the purpose of data collection before consent is obtained.

A data protection impact assessment is generally required for processing activities that the DPDPA or its rules identify as carrying higher risk, and involves evaluating the risks to individuals and the safeguards in place to address them.

Businesses using cloud computing services should generally review the vendor's data security and data protection commitments, where the data is stored, and how responsibilities are allocated between the business and the cloud provider under the applicable agreement.

Yes, the technology law team advises on the legal aspects of responding to a data breach or cybersecurity incident, including notification obligations under applicable law and coordination with regulators where required.

Most existing privacy policies are likely to need review and updating to align with DPDPA requirements, particularly around consent, data retention and individual rights, as the Digital Personal Data Protection Rules, 2025 are phased into force.

Yes, SaaS agreements are drafted and negotiated from either the service provider's or the customer's perspective, depending on the engagement.

Depending on the matter, this can include the Data Protection Board of India under the DPDPA, sector regulators such as the Reserve Bank of India or the Securities and Exchange Board of India for regulated entities, and authorities under the Information Technology Act, 2000.

Yes, this includes advising on platform terms of use, seller or vendor agreements, and applicable digital platform regulation, in addition to the data protection and cybersecurity aspects of running a digital platform.

Under the DPDP Rules, 2025, personal data may generally be transferred outside India unless the Central Government notifies a country to which transfers are restricted. Businesses should review their data flows and ensure appropriate contractual and compliance arrangements are in place for international transfers.

Under CERT-In directions issued in 2022, service providers, intermediaries, data centres and certain other entities must report specified categories of cyber security incidents to CERT-In. Applicable entities must also maintain logs for 180 days and designate a point of contact for coordination.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 set out conditions for intermediaries to claim safe harbour from liability for third-party content, including publishing terms of use, appointing grievance and compliance officers, and removing unlawful content within specified timelines. Significant social media intermediaries have additional due diligence obligations.

The DPDPA requires verifiable parental or guardian consent before processing the personal data of children. Data fiduciaries must not undertake tracking, behavioural monitoring or targeted advertising directed at children, unless specifically exempted. Edtech and other businesses processing children’s data should review their consent flows and processing activities accordingly.

Businesses using open source software should understand the licence terms applicable to each component, particularly copyleft obligations that may require disclosure of derivative works, attribution requirements, and any restrictions on commercial use. A licence compliance review is advisable when incorporating open source into proprietary products or preparing for M&A transactions.

Fintech businesses must navigate both technology law and financial sector regulations. This includes RBI guidelines on digital lending, payment aggregators and prepaid instruments, data localisation requirements for payment data, outsourcing norms, and general data protection obligations under the DPDPA.

Healthtech businesses handle sensitive personal data including health records and biometric data. They must comply with telemedicine practice guidelines, maintain appropriate security safeguards for health data, and ensure consent mechanisms meet the requirements of both the DPDPA and any sector-specific health data regulations that may apply.