Privacy and cyber-law work starts with understanding what information an organisation holds, why it holds it and who can access it. Kothari & Jain advises on privacy documentation, technology contracts, incident-related legal obligations and disputes involving digital information. A copied privacy policy cannot substitute for examining the organisation’s actual data practices.
Privacy readiness and everyday operations
- Mapping personal-data collection, use, sharing and retention.
- Review of privacy notices, consent journeys and internal responsibilities.
- Data-processing and confidentiality clauses in vendor agreements.
- Preparation for requests, grievances and incident escalation.
- Legal review of cyber incidents, notices and preservation of digital evidence.
A review should involve the people responsible for operations and technology as well as management. An organisation may need to reconcile its website wording with CRM access, HR records, cloud services and outsourced support. Deliverables should identify both document changes and operational decisions required to make those documents accurate.
Phased commencement matters
The DPDP Act commencement notification and Digital Personal Data Protection Rules, 2025 provide staged commencement. The Rules bring different provisions into effect immediately, after one year and after eighteen months from publication. It would therefore be inaccurate to describe every substantive DPDP requirement as already operational simply because the Rules have been notified.
A readiness programme should distinguish obligations presently applicable from preparations for later phases, while checking relevant amendments and sector-specific requirements. This distinction affects the advice given about notices, individual rights, reporting and enforcement. The legal position should be reviewed against the date and facts of the particular matter.
If an incident has already occurred
Containment and evidence preservation should begin with appropriate technical assistance. CERT-In’s directions impose reporting requirements for specified cyber incidents, including a six-hour reporting timeline where applicable. Do not wait for a complete forensic report before checking whether a reporting duty has arisen. Contractual and sectoral notification duties may also require attention.
Legal and technical teams should record what is known, what remains uncertain and when each fact was discovered. Avoid speculative public statements, destruction of logs or circulation of compromised data. A privacy assessment and a cybersecurity investigation serve related but different purposes.
Documents for the first discussion
Provide a data-flow summary, privacy notices, vendor agreements, retention policies and the relevant incident chronology. For a dispute, include notices received, account identifiers and original communications. Share sensitive evidence through an agreed channel after scope and conflicts are checked; passwords, authentication codes and private keys are not needed for an initial legal enquiry.
Common questions
Does a privacy policy alone establish compliance?
No. Its statements must match actual systems, access controls and business practices.
Can we wait for all DPDP phases before addressing cyber obligations?
No. Existing requirements, including applicable CERT-In directions and contractual duties, need separate assessment.
Does legal advice include recovering a hacked account or funds?
Technical recovery and bank intervention are separate processes. Legal assistance may address reporting, evidence and remedies, without guaranteeing recovery.
Discuss your matter
To arrange a discussion, call +91 8793660616 or +91 7887718191, or use our contact page. Please initially share the parties’ names, a short description and any approaching deadline so that conflicts and the appropriate scope of assistance can be checked.