Sectors · Technology and services
Technology and digital enterprises
Software, SaaS and e-commerce businesses operate under the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 and the intermediary rules made under them, alongside the ordinary corporate and contract questions of a company that scales quickly.
Reviewed
What this covers
- Digital Personal Data Protection Act compliance
- IT Act compliance and intermediary liability
- Cyber law disputes and enforcement proceedings
- IP enforcement and technology licensing disputes
- SaaS and technology contract disputes and arbitration
- Corporate structuring for technology enterprises
- Cross-border technology investment and FEMA compliance
- Regulatory questions for platform businesses and marketplaces
The notes behind these capabilities
The DPDP Rules are notified, and almost nothing in them binds until 13 May 2027
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E). Rules 1, 2 and 17 to 21 came into force that day, and they are the machinery of the Data Protection Board rather than anything a company must do. Rule 4, on consent managers, starts on 13 November 2026. Everything a data fiduciary has to build, the notice, the security measures, breach reporting, erasure and the rights machinery, starts on 13 May 2027, and sections 3 to 17 of the Act start on the same day. The regulator exists now. The duties do not.
There is no AI statute in India, and the one AI rule that binds you today is about labels
A business buying or building AI in India is usually told it faces a new compliance regime. It does not, yet. There is no AI statute. The Digital Personal Data Protection Act, 2023 is the instrument that will govern most AI use of personal data, and its substantive provisions are not in force: the commencement notification of 13 November 2025 puts sections 3 to 17, the data principal rights and the penalty section at 13 May 2027. The Data Protection Board exists but was still advertising for a chairperson and four members in May 2026. One AI-specific obligation does bind now, and it is narrow: the synthetic media provisions inserted into the Information Technology Rules in February 2026, which bind intermediaries rather than every company that uses a model. So the honest answer for most businesses is that the obligation is a dated clock, not a present duty, and the eighteen months are for building.
A deepfake of your chief executive runs on a seven day clock, unless you hold a court order
The February 2026 amendment to the Information Technology Rules is reported as a three hour takedown rule. For a company whose chief executive has been deepfaked into endorsing a fake investment scheme, that is the wrong number. The three hour clock in rule 3(1)(d) starts only on actual knowledge, and since November 2025 actual knowledge arises in two ways alone: a court order, or a reasoned written intimation from an officer not below the rank of Joint Secretary. The two hour clock belongs to an individual complaining about his own impersonation or intimate imagery, not to a company complaining about its brand. What a company gets by right is the ordinary grievance route: acknowledgement in twenty four hours and resolution in seven days, with no remedy against the mirror copies. Which is why every order in this space in 2025 and 2026 is an injunction.
AI and patents, trade secrets and training data in India
Where Indian law stands on patenting AI, naming an AI as inventor, protecting models as trade secrets, and using copyright works as training data.
In Engineering Analysis Centre of Excellence Private Limited v. Commissioner of Income Tax, decided on 2 March 2021, the Supreme Court held that a payment by an Indian distributor or end user to a foreign supplier for the resale or use of software under a distribution agreement or an end-user licence agreement is not royalty and gives rise to no income taxable in India, so no duty to deduct tax arose under section 195 of the Income-tax Act, 1961. The successor withholding rule for payments to non-residents is section 393(2) of the Income-tax Act, 2025. The ruling does not decide goods and services tax (GST) on imported software or software as a service (SaaS), and it does not touch the limits that section 3(4) of the Competition Act, 2002 places on exclusive distribution.
Reference
Regulators in this sector
Forums
Practice areas that apply
- Boardroom and corporate
- Transaction advisory
- Capital markets
- Contracts and procurement
- IP and licensing
- Civil disputes
- PMLA
- Technology, data and product
- Employment
- Taxation and fiscal
- White-collar and cyber defence
- AI, data and emerging technology
- Cyber crime
- Public law and public interest litigation
- Technology disputes
- Money recovery
- Foreign exchange (FEMA)
- Prevention of sexual harassment (POSH)
- Employee's Compensation
- GST disputes
Advocates in this sector
Other notes in this sector
- Buying an antiquity in India turns on the seller's licence, registration where notified and the bar on private export, and a defect in any of them can cost the buyer the object
- A Karnataka school may charge only the fees the 1995 Rules prescribe, and a professional college only the fee a committee determines
- A Bengaluru hotel with a restaurant and a bar answers to six licensing regimes, and only the food safety rules say in terms that a lapse stops all business at the premises
- An assignment of copyright passes only the rights, term and territory it names, and it leaves the author's royalty share and moral rights behind
- A telemedicine product in India answers to three regulators at once, and only the doctor may prescribe
- Location and driving data from a vehicle telematics device is personal data under the DPDP Act from 13 May 2027
- An Internal Committee inquiry under the 2013 sexual harassment Act runs on clocks of three months, 90 days, ten days and 60 days
- Electronics Component Manufacturing Scheme: what the incentive rates, thresholds and recovery terms say
- The India and United Kingdom trade agreement took effect on 15 July 2026, and no investment treaty came with it
- A United States company investing in India: entry under the foreign exchange rules, no investment treaty, and dividend tax under the 1989 convention
- The Provident Fund wage ceiling is INR 25,000, and the 2026 Scheme changes withdrawals
- The 15 Per Cent Shareholder: What a Company Petition Is Actually Worth
- An AI vendor's indemnity moves the money, not the responsibility: contracts, diligence and disclosure
- When an Indian citizen living abroad is resident in India for tax: the day tests, the INR 15 lakh line and not ordinarily resident
- An Indian employee in Saudi Arabia or Kuwait where salary is untaxed: residence, salary, end-of-service pay and NRE interest under Indian tax law
- Online money games are prohibited in India from 1 May 2026, and the tax on the years before that survives the prohibition
- What the Labour Codes Cost You, and Who Carries It
- Retrenchment, lay-off and closure under the Industrial Relations Code: the 300-worker line
- One Crore of Operating Profit: The SME IPO Gate and What It Costs to Clear It
- What an Overseas Citizen of India cardholder may and may not do in India: rights, property, work and cancellation
- The Money Laundering Act Has Become an Asset Statute, Not Just a Criminal One
- The DPDP exemption for schools and universities covers tracking and behavioural monitoring, not every use of a student's data
- Digital lending is now one instrument, and a default loss guarantee cannot exceed five per cent of what the portfolio disbursed
- Hotel rooms up to INR 7,500 a night carry 5 per cent goods and services tax from 22 September 2025, without input tax credit