Technology · Data protection · AI
Technology, Data Protection and AI Lawyers in Bangalore
We draft and review IT and commercial contracts. We advise companies on the Digital Personal Data Protection Act, 2023 (DPDP Act), cross-border data rules and artificial intelligence (AI) governance. One of our advocates brings 17 years of technology industry experience.
Overview
Legal advice that understands technology
Technology businesses need contracts and policies that match how their software, data and AI actually work. We know how enterprise software and data projects run in practice.
The DPDP Act and the Digital Personal Data Protection Rules, 2025 set new duties for every business that handles personal data in India. The Data Protection Board of India can impose penalties of up to ₹250 crore for some breaches.
What we handle
Our work in this area
These are the matters we see most often. Real cases rarely fit one box, so ask us even if yours looks different.
DPDP Act compliance
- DPDP gap assessment
- Privacy notices and consent
- Consent managers and children’s data
- Significant Data Fiduciary (SDF) duties
Data contracts
- Data Processing Addendums (DPAs)
- Data Fiduciary and Processor contracts
- Cross-border data transfer terms
- GDPR alignment for overseas clients
Breach and incidents
- Data breach response plan
- CERT-In reporting (6-hour rule)
- Notices to the Data Protection Board
- Internal investigation support
IT contracts
- Master Services Agreements (MSAs)
- Statements of Work (SOWs) and SLAs
- SaaS agreements and EULAs
- Software licences and NDAs
AI governance
- AI use policies
- AI vendor contracts
- AI risk assessments
- ISO/IEC 42001 alignment and EU AI Act awareness
Disputes
- Technology contract disputes
- Arbitration of IT disputes
- Information Technology Act, 2000 matters
Courts and forums
Where we appear
- Data Protection Board of India
- CERT-In
- Arbitral Tribunals
- Commercial Courts, Bengaluru
- High Court of Karnataka
Good to know
Things to know about data protection
The DPDP Act applies to most businesses
Any business that collects personal data of people in India, in digital form, must follow the Act.
Consent must be clear
Consent must be free, specific, informed and easy to withdraw. A clear privacy notice is required.
Vendors need contracts
A Data Fiduciary must use a valid contract with any Data Processor that handles personal data for it.
Report incidents fast
CERT-In directions require many cyber incidents to be reported within 6 hours of noticing them.
Related practice areas
Contact Base Legal
Phone +91 63660 42792 or +91 81974 06465 · contact@baselegal.in · Monday to Saturday, 9:00 AM to 8:00 PM