Privacy programme & policy review
Notices, consent and data-principal rights mapped to the DPDP Act.
Data Protection, IP & Employment
Data Protection & IT Law Privacy, built into the business.
We advise businesses on privacy and data protection compliance — privacy programmes, policy drafting, data governance and personal data management.
We also provide Information Technology law and technology advisory to start-ups and established online businesses on digital compliance, technology contracts, cybersecurity obligations and regulatory requirements.
Key highlights
DPDP
Act, 2023
Notices, consent and data-principal rights mapped to the law and the Rules.
72
Hours
To deliver a detailed breach report to the Data Protection Board under the Rules.
₹250 Cr
Maximum penalty
For failing to take reasonable security safeguards against a breach.
How we approach this work
01
Research-driven.
We map your actual data flows — systems, vendors and transfers — before drafting a single notice or policy.
02
Client-centric.
Compliance is sized to your business: proportionate, workable and explained to the people who must run it.
03
Result-oriented.
A programme that withstands a breach, a complaint or a regulator's question — not just a policy on a webpage.
How we help
What the work involves.
Data processing & vendor agreements
Allocating responsibility with processors, vendors and group entities.
Breach response & regulatory interface
Incident playbooks, notifications and dealings with regulators.
IT Act compliance
Intermediary obligations, electronic contracts and online-business compliance.
Questions & answers
What clients ask us.
Does the DPDP Act apply to my business?
It applies to the processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. Most businesses that collect customer or employee data are within scope.
What must be done after a personal data breach?
The Data Protection Board and each affected person must be informed without delay, and a detailed report given to the Board within 72 hours. Separate CERT-In reporting obligations may also apply.
Insights
Related insights
Data Protection & IT LawA practical DPDP compliance roadmap for growing businessesNotices, consent, vendors and breach response — in the order they matter.Sharad Besoya
Intellectual Property RightsClear the mark before you print the packagingWhy a trademark search is the cheapest insurance in a product launch.Sakshi Bothra
Employment LawsThe labour codes: what employers should update firstWage definitions, fixed-term employment and the contracts that need revisiting.Kritika Kashyap