Business Contracts & Commercial Agreements

Written contracts reduce ambiguity, protect your legal and commercial interests, and serve as key evidence in the event of disputes. In India, oral agreements are legally valid but far harder to enforce—making written contracts essential for risk management and compliance.

Yes. Under the Indian Information Technology Act, 2000, digitally signed agreements using Aadhaar eSign, DSC, or platforms like DocuSign are legally valid, with a few exceptions (e.g., real estate, powers of attorney).

A Master Services Agreement (MSA) sets the general terms of engagement, while the Statement of Work (SOW) defines project-specific details like timelines and deliverables. We help businesses structure both for recurring or milestone-based services.

Yes. You can cap your liability through contract clauses—usually to the amount paid under the agreement or a specific limit. We ensure your limitation of liability and indemnity clauses are enforceable under Indian contract law.

An NDA must clearly define confidential information, duration of the obligation, and permitted disclosures. We draft mutual or one-sided NDAs that are enforceable and aligned with Indian judicial standards.

Yes. Each relationship type involves distinct legal rights, risks, and obligations. We draft role-specific agreements—such as vendor agreements, consulting contracts, and distribution deals—with appropriate clauses for termination, compliance, and deliverables.

Yes, foreign entities can enforce contracts in Indian courts, provided the contract includes a valid governing law and jurisdiction clause. We advise MNCs on risk allocation and enforceability in Indian commercial courts or arbitration forums.

Without a dispute clause, jurisdiction defaults to civil courts, which may be slow and costly. We recommend including an arbitration clause with a preferred seat to ensure quicker and more predictable dispute resolution.

No. While contracts can structure commercial terms, they cannot override mandatory provisions of Indian law—like minimum wage, labour rules, or tax laws. We review all contracts for legal compliance.

It’s advisable to review key contracts annually or before a major business change, such as new regulations (like DPDP), funding rounds, mergers, or entering new markets. We offer ongoing retainer-based legal reviews to keep your documents up to date.

Start by conducting a Data Audit to map all personal data you collect, store, and share (especially from customers, employees, vendors). Then:

• Draft a Privacy Policy tailored to Indian law

• Build a Consent Management System

• Update contracts with DPDP-compliant clauses

• Nominate a Grievance Officer and designate internal compliance roles

We assist in executing this end-to-end through a DPDP Compliance Pack.

You must:

• Execute a Data Protection Consent + Notice with all Indian employees

• Localise your Employee Data Policy for India

• Include a lawful purpose and retention clause

• Review global HR tech tools for Indian data compliance

• Update your internal training and SOPs to align with Indian law

We provide a DPDP-compliant Employee Privacy Toolkit with everything ready to roll out.

You should enter into a Data Processing Agreement (DPA) or add a DPDP clause in your Master Services Agreement (MSA) if:

• You process data on behalf of the client

• You act as a data fiduciary using third-party processors The DPA must define responsibilities, cross-border data handling, breach notification, and deletion protocols. We draft watertight, India-ready DPAs.

Key clauses to include:

• Compliance with Indian privacy laws (DPDP, IT Act, etc.)

• Indemnity for data breaches or non-compliance

• Data breach notification timelines (within 72 hours or less)

• Audit and inspection rights for clients or partners

• Retention and deletion obligations post-termination

We tailor these to your vendor, client, or partner agreements for risk coverage.

Consent must be free, specific, informed, and unambiguous. You should:

• Use granular opt-ins, not default “I agree” checkboxes

• Log timestamped records of consent

• Allow easy withdrawal of consent

• Update your Privacy Notice to reflect processing purposes

We offer templated Consent Language + Privacy Notices for HR, websites, and platforms.

Yes. Each data subject category requires a tailored Privacy Notice:

• Employee Privacy Policy (for HR data)

• Customer-facing Privacy Policy (for platforms/websites)

• Vendor/partner data clauses in MSAs or NDAs

We draft customised, DPDP-ready policies for each audience and review existing ones for compliance gaps.

Yes, but only to countries approved by the Indian government (a whitelist is expected). Until then, include in your contracts:

• Cross-border transfer clauses

• Data localisation fallback options

• Appropriate security representations from third parties

You must ensure that these vendors:

• Sign a Data Processing Agreement (DPA)

• Host data in permitted geographies

• Have security certifications (ISO 27001, SOC2, etc.)

• Allow audits if requested

We review third-party tools for legal risk and prepare SaaS onboarding templates to mitigate liability.

Include a clause specifying that Indian law governs and that disputes be resolved in Indian courts or arbitration centers (like Mumbai, Bangalore, or Delhi). For MNCs, this helps centralise data-related disputes and ensures the DPDP Act applies.

You must:

• Draft a Data Breach Response Policy

• Appoint a Grievance Officer or internal breach response team

• Train your staff on breach escalation

• Set protocols for notifying the Data Protection Board and affected individuals

We provide a ready-to-implement incident response SOP aligned with the DPDP Act.