Hyderabad IP boutique · 11 lawyers · 7 years
During a routine internal audit the firm realised: candidate CVs going back five years were in one partner's personal Gmail, employee Aadhaar copies were on a shared drive accessible to interns, opposing-party contact data was in three different Excel files, and there was no breach reporting protocol. None of this was caught by a regulator — yet. With the DPDP Act 2023 operational from 13 November 2025 and substantive obligations enforceable from May 2027, the runway is short.
The DPDP Act makes any organisation that determines the means of processing personal data a Data Fiduciary. Law firms qualify by default. Most have not yet woken up to it. Penalties go up to ₹250 crore per breach; failure to notify the Data Protection Board can attract up to ₹200 crore. This firm had no Data Protection Officer, no consent framework, no breach response runbook, no audit log.