Technology, data protection and AI lawyers in India
We advise technology companies, and the businesses that buy from them, on data protection, platform liability, software contracts and AI, reading the product and the data flows as closely as the statute.
Offices in Kozhikode, Kochi and New Delhi. Meetings in person or by video call.
Book a ConsultationWhatsApp the officeThe challenge
India's Digital Personal Data Protection Act and Rules now sit alongside the GDPR, the CCPA and sector rules from RBI, SEBI and CERT-In. A single product can be subject to several of them at once.
Privacy and platform risk is mostly decided in engineering and product choices: what is collected, where it is stored, who can see it and how consent is captured. Legal advice that never reaches those choices does not reduce the risk.
How we help
- DPDP Act programmesNotices, consent flows, data processing agreements, retention schedules and breach response.
- Global privacyGDPR, CCPA and UAE data protection compliance for Indian companies with foreign users.
- Technology contractsSaaS, licensing, master services and data processing agreements.
- Platform and intermediary lawIT Act obligations, takedown processes and the IT Rules.
- AI governancePolicies, risk assessments and contracts for building and buying AI systems.
- Fintech and paymentsPayment aggregator, escrow and marketplace structures under RBI rules.
Forums and jurisdictions
Questions clients ask
Does the DPDP Act apply if our servers are outside India?
Yes, in many cases. The Act applies to digital personal data processed in India and also to processing outside India connected with offering goods or services to people in India.
When do the DPDP Rules take effect?
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with a phased start. The Data Protection Board provisions apply first, and most obligations of data fiduciaries apply 18 months after notification.
How quickly must a cyber incident be reported to CERT-In?
CERT-In's directions of April 2022 require specified cyber security incidents to be reported within six hours of noticing them. A personal data breach also triggers separate notice duties under the DPDP framework.
Does an Indian company need to comply with the GDPR?
It does if it offers goods or services to people in the European Union, or monitors their behaviour, even without an office there. Many Indian SaaS and IT services companies fall within it through their customers.
What are the penalties under the DPDP Act?
The Schedule to the Act provides penalties of up to Rs 250 crore for failing to take reasonable security safeguards, with other caps for other breaches. The Data Protection Board decides the amount case by case.
Discuss your matter with us
A first consultation sets out where you stand, the realistic routes open to you and what each will involve.
Related insights
Other practice areas
Newsletter
Don't miss our future updates! Get subscribed today!
CONTACT
3rd Floor, HIS Centre, Kombara Junction, Near High Court of Kerala, Kochi, Kerala 682018
T1, G1001, HiLITE Business Park, Thondayad Bypass, Kozhikode, Kerala 673014
136/2, Rameshwar Nagar, Model Town, New Delhi 110033
© 2026 M S Sulthan Legal Associates. All rights reserved.
