Data Protection, Privacy & Digital Compliance

Any business that collects customer or user data through a website or app has legal obligations about how it tells people what it collects, how it obtains their consent and how it protects the data. In India those obligations come from the Information Technology Act and, increasingly, from the Digital Personal Data Protection Act, 2023 and the rules made under it. Businesses with users in Europe may also be subject to the GDPR.

The practice advises on putting DPDP Act compliance into practice and prepares the documentation it needs: consent notices, data processing agreements, retention and governance policies and incident response procedures. It drafts privacy and cookie policies and terms of service that reflect what a platform actually does, and reviews websites and apps for legal gaps before a launch or a fundraise.