Intellectual property, technology
and data protection.

Our intellectual property work covers patents, trademarks, copyright, designs and trade secrets, across registration, enforcement and litigation, and it includes managing the portfolio as an asset rather than as a filing habit. Trademarks are the right most businesses register first. We advise on adoption and clearance before money goes into a brand, handle filing and prosecution under the Trade Marks Act, 1999, reply to examination reports, and manage oppositions, renewals and the structure of a portfolio across classes. Enforcement is a separate exercise with its own economics. We act in infringement and passing-off proceedings, and parallel channels are also available: platform takedowns, domain name complaints under the UDRP and INDRP, and customs recordal against infringing imports. Which of those to reach for is a commercial decision before it is a legal one, because the question is often which remedy is proportionate to the harm and how quickly it can be obtained. A hard first letter can also turn a contained problem into a public one.

On patents we advise on patentability and on the exclusions in Section 3 of the Patents Act, 1970, including the computer programme and business method exclusion in Section 3(k), which frequently shapes how a specification is drafted. We run prosecution, work with technical teams on specifications, and look at freedom to operate before a product launches. Copyright work covers subsistence and ownership, assignment and licensing under Sections 18 and 19 of the Copyright Act, 1957, where Section 19 sets form requirements and statutory defaults on duration and territory, and the moral rights that generally survive an assignment under Section 57.

India has no standalone trade secrets statute at present. Protection comes from contract, from equitable obligations of confidence, and from how carefully an organisation controls access, which makes the ordinary housekeeping the protection rather than an addition to it.

Design registration is frequently overlooked. Registration under the Designs Act, 2000 protects the visual features of shape, configuration, pattern and ornamentation applied to an article, and novelty is assessed against what has already been published or used, subject to the limited protections for disclosure in Sections 16 and 21 of that Act, so disclosure before filing can defeat the right you were about to register. Product teams show a design at a trade fair or put it on a launch page long before anyone has thought about protection, and by then the question is no longer what to file but whether anything can still be filed at all.

Owning intellectual property and managing it are different jobs. Management starts with knowing what the company actually owns rather than what it assumes it owns, which is a live question wherever work has been done by contractors, by founders before incorporation, by agencies, or by employees whose contracts never assigned anything. Licensing then follows the commercial deal: field and territory limits, sublicensing, who owns improvements, and what happens to the licence on insolvency or a change of control. Assignment chain gaps are commonly identified during diligence on a fundraise.

India’s data protection regime moved from principle to practice with the Digital Personal Data Protection Act, 2023, and with the Digital Personal Data Protection Rules made under it, whose provisions commence in stages. The work this creates is concrete. Map what personal data the organisation actually holds and why. Establish a lawful basis for each processing activity. Rebuild consent notices to the standard of specificity the Act requires, appoint and properly empower the accountability function, and put in place a process that answers data principal requests rather than leaving them until somebody gets to them. Section 10 imposes additional obligations on data fiduciaries notified as significant data fiduciaries. None of that is a drafting exercise, which is why programmes that begin with a policy document tend to stall: the policy describes an organisation that has not been built yet, and the systems it describes carry on behaving the way they always did.

Order matters more than enthusiasm. Inventory comes first: systems, data elements, purposes, retention, recipients. Then lawful basis, then notice and consent design, then the rights process, then contracts. Retention is where the surprises are, because data is rarely deleted and nobody in the organisation owns deletion. Part of the early work is also forming a defensible view of where the organisation is likely to sit on the significant data fiduciary question and what that classification would demand of it. That view fits in a paragraph and changes what the programme has to build.

Vendor and group data flows are where compliance most often fails, because the obligation does not stop where your systems stop. We paper the processing arrangements, deal with cross-border transfer, and write breach response into the contract rather than improvising it afterwards. On incidents, the CERT-In directions require the cyber security incidents they specify to be reported to CERT-In by the entities they cover, and evidence handling in the first hours affects what can be shown if the matter later turns into litigation.

AI governance is a growing part of this practice: policy frameworks, model risk assessment, and the questions with money attached, which are who owns model output, what the training data licence actually permitted, what a vendor’s indemnity covers when a model produces infringing or defamatory output, and what has to be disclosed about an automated decision. India has no dedicated AI statute at the date of this page, rulemaking in the area is active, and what exists has been assembled out of law written for other purposes: the Information Technology Act, 2000 and the IT Rules, 2021 where an intermediary is involved, the Digital Personal Data Protection Act, 2023 where personal data is used in training or inference, copyright for training inputs and generated outputs, and guidance issued by sector regulators. Advice built to survive change therefore rests on the risk allocated in your contracts and the governance you can evidence internally.

Technology contracting is more ordinary and no less consequential. Data and exit clauses are frequently decisive in SaaS disputes, and renewal pricing repays a look before signature, because bargaining power drains away once the data is inside the system.

These areas converge in transactions. IP diligence asks whether the registered portfolio is in the company’s name and the assignments on record; data diligence asks what the target holds, on what basis, and whether the consent record supports the use the buyer has planned.