KV TechLegal
Areas of work

Data protection and privacy

DPDP Act · GDPR · Breach readiness

In short

If your business collects personal data from customers, employees or users, India's DPDP Act applies to it, and serving customers in the EU brings in the GDPR. We work out which rules apply and help put them in place.

Where problems usually start

Many organisations can show their data protection position only through a privacy policy, and it is usually the one document no one has checked against the systems. The data held, the vendors processing it and the retention periods are not written down anywhere. The first real test tends to be an enterprise customer's security questionnaire, answered in a hurry.

How we approach it

Most of this work is under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, whose main obligations apply from 13 May 2027. Businesses that serve customers in the EU also answer to the GDPR, and AI features used there fall under the EU AI Act, which we cover under AI governance. Rules on moving data across borders are still taking shape in several countries, including India, where the government can restrict transfers to particular countries. We start with what personal data a business holds, where it came from and why it is kept. From there we settle which parties act as fiduciaries or controllers and which as processors, bring notices and consent up to the required standard, and put processing terms in place with vendors.

What our work involves

For startups and in-house teams

A startup launching its first product and a compliance team at an established business start from the same place: a notice and consent flow that matches the product, processing terms ready for customers and vendors, and a dated plan to 13 May 2027.

Sectors where this comes up

Notes on this