India's Digital Personal Data Protection Act 2023 creates obligations for data fiduciaries processing personal data — consent management, purpose limitation, data principal rights, breach notification, and the cross-border data transfer framework. GP advises technology companies on DPDP compliance programmes, privacy-by-design implementation, and the readiness assessments that the Act's enforcement framework will require when the Data Protection Board becomes operational.
The CCI's investigation into digital markets — search, e-commerce, app stores, and ride-hailing — has fundamentally changed the legal risk landscape for platform businesses in India. GP advises technology platforms on CCI compliance, including the market definition analysis, the self-preferencing and anti-steering rules that the CCI has applied in recent orders, and the merger notification obligations for technology sector acquisitions. Where a CCI investigation has been launched, GP defends the proceeding from the DG investigation through the CCI order and the NCLAT appeal.
A cybersecurity incident — ransomware, data breach, or system compromise — creates simultaneous legal obligations: CERT-In reporting within six hours, DPDP breach notification, SEBI disclosure for listed companies, customer notification, and potential regulatory enforcement. GP advises on incident response from the first hour — the legal obligations, the regulatory notifications, the evidence preservation, and the liability management that must happen simultaneously before the technical remediation is complete.
Technology companies' most valuable assets are their intellectual property — software patents, trade secrets, copyright in code, and brand identity. GP prosecutes and defends patent infringement proceedings before the IP offices and the High Courts, advises on trade secret protection and enforcement under the BNS, handles software copyright disputes, and structures IP ownership and licensing arrangements for technology M&A and joint ventures.
GP advises technology companies on corporate transactions — from seed round structuring and ESOP design for startups through Series A to D equity rounds to listed company M&A. The technology M&A practice covers the FEMA FDI framework for inbound investment, the SEBI takeover code for listed technology companies, and the intellectual property, employment, and data privacy due diligence that technology transactions require beyond the standard corporate M&A checklist.
Artificial intelligence raises legal questions that existing frameworks answer imperfectly — copyright ownership of AI-generated content, liability for AI-caused harm, regulatory obligations for AI systems processing personal data under DPDP, and the CCI's emerging analysis of AI-driven market power. GP advises on the legal framework as it currently applies to AI businesses and on the regulatory developments that are shaping the future legal environment for AI in India.
Defended a Mumbai-based fintech startup against a patent infringement claim by a larger competitor asserting a patent on a UPI-integrated transaction reconciliation method. GP challenged the patent's validity before the Intellectual Property Appellate Board, establishing that the claimed invention lacked an inventive step over prior art — specifically, over published research papers and open-source implementations that predated the patent filing by three years. The IPAB revoked the patent, extinguishing the infringement claim entirely.
Represented a Delhi-based e-commerce marketplace in a CCI Director General investigation into alleged self-preferencing of private label products and the structure of the seller fee mechanism. GP conducted an independent competition law compliance audit — identifying the specific aspects of the fee structure and product ranking algorithm that presented antitrust risk — and advised on a revised policy that eliminated the preferencing concerns. The DG closed the investigation after the revised policy was implemented.
Advised a Bangalore-based B2B SaaS company processing personal data of enterprise clients' employees on building a comprehensive DPDP Act compliance programme. GP mapped data flows, identified consent and purpose limitation obligations, drafted data processing agreements, and designed the breach detection and notification protocol. The programme was implemented across all product lines before the Data Protection Board's expected operational commencement.
The technology practice team operates across Mumbai, Delhi, Bangalore, and Chennai, with specialist capabilities in each of the practice areas listed above. Contact GP to discuss how we can assist your organisation.
GP advises technology clients across the complete spectrum of legal and regulatory needs. Tell us about your matter and we will put you in contact with the right team.