Law Firms and Legal Services: A DPDP Act Impact Study

Executive summary

Overall impact: Medium-High.

This study covers law firms and advocates' chambers, in-house legal teams, litigation funders and legal-technology providers: research databases, document management, e-discovery and review platforms, and AI tools. Legal process outsourcing is covered in Trayambic's study on GCCs, BPOs and KPOs.

Lawyers handle some of the most sensitive personal data in the economy: medical records in injury claims, whole mailboxes in fraud cases, children's details in custody disputes. Yet the Digital Personal Data Protection Act, 2023 (the DPDP Act) lifts most of its duties from processing "necessary for enforcing any legal right or claim" (s.17(1)(a)). That exemption is why we rate the sector Medium-High rather than High: three of the twelve scorecard areas rate High.

Three changes matter most.

• The claims exemption is purpose-bound. In our view it covers disputes, not the advisory, transactional and compliance work that fills most firms' days. Even for disputes, accountability for processors (s.8(1)) and reasonable security safeguards (s.8(5)) survive.
• Privilege now has a data dimension. The Supreme Court's judgment of 31 October 2025 confines production of advocates' digital devices to the jurisdictional court, with care for other clients' confidentiality, and holds that in-house counsel do not enjoy the privilege in s.132 of the Bharatiya Sakshya Adhiniyam, 2023. Firms need files and devices that let a court see one matter without exposing others.
• Deals have no general exemption. Section 17(1)(e) covers schemes and mergers approved by a court, tribunal or competent authority. In our view, share and asset purchases, and diligence on deals that never reach approval, need ordinary grounds and careful minimisation.

The Act's main obligations commence on 13 May 2027.

Background

Law firms run disputes, transactions, employment, family, criminal and regulatory practices. A matter file can hold the client's identity and conflict records, pleadings, evidence such as medical reports, CCTV, bank statements and mailboxes, witness statements and the opposing party's details. Firms also keep conflict databases, time records, know-how banks and mailing lists. Registered foreign law firms now also advise from India on foreign and international law.

In-house teams handle contracts, disputes, internal investigations and regulatory responses. The company is the fiduciary; the team works within its grounds.

Litigation funders finance claims for a share of the proceeds. They receive case papers to assess a claim and updates while it runs.

Legal-tech providers host judgments, track cause lists, store documents, process collections for review and offer AI tools for research, drafting and contract analysis.

The data principals, the people the data is about, include individual clients, clients' employees and customers, opposing parties, witnesses, victims, children, and the firm's own lawyers, clerks, interns and applicants. Typical vendors are cloud document and email providers, review platforms, translators, filing agents, investigators and AI model providers.

Legal framework

The DPDP Act and Rules

• Roles (ss.2(i), 2(k)). A data fiduciary determines the purpose and means of processing; a data processor acts on its behalf. Under s.8(1) the fiduciary stays responsible "irrespective of any agreement to the contrary".
• Claims (s.17(1)(a)). Chapter II (except ss.8(1) and 8(5)), Chapter III and s.16 do not apply where processing "is necessary for enforcing any legal right or claim". Notice, consent, children's rules, breach intimation, erasure, rights and transfer limits fall away; accountability and security remain.
• Courts (s.17(1)(b)). The same relief covers courts, tribunals and bodies with judicial, quasi-judicial, regulatory or supervisory functions, for processing necessary to those functions.
• Schemes (s.17(1)(e)). And processing necessary for a compromise, arrangement, merger, amalgamation, demerger or transfer of undertaking "approved by a court or tribunal or other authority competent to do so".
• Public data (s.3(c)(ii)). The Act does not apply to data made public by the data principal, or by a person under a legal obligation to publish it.
• Rights (s.11). Access runs only against a fiduciary to whom the person gave consent, including under s.7(a).
• Security and breach (ss.8(5), 8(6); Rules 6, 7). Safeguards, and breach notice to the Board and affected people with a 72-hour detailed report.

Other instruments

How the layers fit

Section 38 keeps privilege, conduct and criminal rules running alongside the Act. They restrict disclosure while the Act regulates processing, so true conflicts are rare. Rule 17 of the Bar Council rules still refers to s.126 of the Indian Evidence Act, 1872; in our view it now reads as a reference to its successor, s.132 of the Adhiniyam. Where a DPDP right might cut across privilege, s.17(1)(a) usually disapplies the right for that dispute.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Section 17(1)(a): what it covers and what it does not

In our view the clause works as follows.

1. 1.Purpose, not profession. It applies to processing "necessary for enforcing" a right or claim, whoever does it. A firm, a funder, a review platform and the client can all rely on it for the same dispute. It does not make a law firm exempt.
2. 2.Defence counts. A defendant resisting a claim enforces its own rights. Pre-action work counts once a claim is reasonably in prospect, not merely conceivable.
3. 3.Advice and deals do not. Drafting contracts, compliance advice, diligence and know-how are not enforcing anything. Nor is training an AI tool on closed files.
4. 4.Necessity limits scope. Harvesting an opponent's entire social-media history when two posts are in issue goes beyond what is necessary, and unlawfully obtained evidence gains no cover.
5. 5.It ends. When the matter closes and the periods for appeal, and for claims against the firm, have run, the processing is no longer necessary and s.8(7) erasure applies again.

Throughout, ss.8(1) and 8(5) apply: the firm answers for its vendors and must keep the file secure. Breach intimation under s.8(6) is disapplied for exempt data, but CERT-In reporting is not, and in our view rule 24's bar on abusing a client's confidence means the client should hear of any incident at once.

Conflict records need their own answer. Rule 33 bars acting for the opposite party in a matter where the advocate has advised the other side, so a firm needs a lasting record of whom it has acted for and against. Because the rule is made under the Advocates Act, in our view minimal conflict data (names, matter, role, dates) is retention "necessary for compliance with any law" under s.8(7). Full files are not.

Litigation funders process case papers for their own investment decision, so in our view they are fiduciaries, not processors. Whether underwriting is "necessary for enforcing" the claim is arguable; portfolio analytics are not. Under s.132, an advocate may pass client communications to a funder only with the client's express consent.

Privilege and access requests in contested matters

DPDP access rights will be tried as a discovery tool. On our reading of the text they rarely succeed.

• Against the opposing firm. An opposing party has given the firm no consent, so s.11 does not run against it, and s.17(1)(a) disapplies Chapter III for the dispute. A short written reply is enough.
• Against the client. A former employee suing her employer may ask it for all her data. Section 11 reaches data processed on consent or under s.7(a), not employment data processed under s.7(i), as Trayambic's article on employee monitoring explains; dispute processing is exempt; and an advocate's advice stays protected by s.132.
• From the firm's own client. Outside a dispute, an individual client can ask for a summary of their data and the processors it went to. Files often contain other clients' information, so responses need redaction.

The October 2025 judgment adds two practical points. In-house counsel are not "advocates" for s.132, though s.134 protects communications with the employer's legal adviser, so sensitive internal investigations should be structured with external counsel and in-house notes kept lean. And because an advocate's device may be examined only before the jurisdictional court, with care not to impair other clients' confidentiality, firms should encrypt data matter by matter so one file can be produced without exposing the rest. In arbitration, s.42A adds a statutory confidentiality duty on the parties, which in our view their counsel's handling must honour.

Data rooms, diligence and section 17(1)(e)

Under ss.230 to 232 of the Companies Act, the National Company Law Tribunal sanctions schemes of arrangement and mergers. Section 17(1)(e) exempts processing necessary for such a scheme once "approved". In our view three limits follow. It does not cover share purchases or contractual asset purchases. It plainly covers implementing an approved scheme, such as moving employee records to the transferee, but whether it covers diligence before approval is uncertain, because approval is a future event. An abandoned scheme never qualifies.

Most diligence therefore needs ordinary grounds, and the seller stays the fiduciary for what it discloses. The workable approach is minimisation.

• Show employee and customer data in banded or anonymised form: salary bands, tenure, disputes by category.
• Name individuals only where the deal turns on them, such as key managers, and tell them.
• Use clean teams, watermarking, download controls and access logs for named data.
• Treat the data room provider as the seller's processor, bound to delete at completion or abandonment (s.8(7)(b)).
• Bind bidders and their advisers to return or destroy, and keep AI review tools on processor terms with no training on deal data.

Background checks on promoters and key people are common in deals. Trayambic's article on background checks and its HR tech and staffing study cover consent, court-record searches and accuracy; the same cautions apply when a law firm commissions an investigator.

Courts, pleadings and published judgments

The court's own processing is exempt under s.17(1)(b), and preparing pleadings usually falls under s.17(1)(a). Minimisation still matters, because pleadings reach every party and often public portals. Aadhaar numbers should be masked, given s.29(4) of the Aadhaar Act. Victims of sexual offences must not be identifiable, given ss.72 and 73 of the Bharatiya Nyaya Sanhita. Medical and financial records should be filed only to the extent in issue.

Courts are also building a masking practice. In its order of 13 July 2026, the Delhi High Court, applying Laksh Vir Singh Yadav, treated masking as replacing names with neutral references in the public digital record while the court keeps the original. It weighs each request for proportionality: acquittal, discharge or quashing counts in favour, yet the court refused masking even after an FIR had been quashed on settlement, because investors had an interest in knowing whom they dealt with.

Legal-tech databases republish judgments. In our view it is unsettled whether courts publish them under a "legal obligation", as the public-data exclusion in s.3(c)(ii) requires, so databases should not rely on it. At minimum they should honour masking orders, suppress victims' identities and offer a takedown channel.

Worked example: a 70-lawyer firm in Delhi

The figures are illustrative. In one week the firm faces three issues.

1. 1.An access request. It defends a manufacturer against a former sales manager's wrongful-termination claim. Her lawyers send the firm a DPDP request for all data it holds about her. The firm replies that she has given it no consent, that its processing is necessary for the dispute and exempt under s.17(1)(a), and that disclosure is for the court. It reminds the client that any request made to the client needs separate assessment.
2. 2.A share purchase. It acts for a buyer of a 1,200-employee logistics company. No scheme is involved, so s.17(1)(e) does not apply. The firm asks for banded HR data, named data for 15 senior managers only, clean-team access for two associates and a deletion certificate from the data room provider at completion.
3. 3.An AI slip. An associate pastes a draft settlement naming the claimant and her medical condition into a consumer chatbot. The matter is a dispute, so s.8(6) intimation does not apply, but s.8(5) does. The firm asks the provider to delete the input, tells the client, logs the incident and rolls out an approved enterprise tool on processor terms with no training on inputs.

Compliance framework

Phased roadmap

• Now to December 2026: matter tagging; filing checklist; vendor inventory.
• January to March 2027: vendor contracts; data room protocol; matter-level encryption; notices.
• April to May 2027: closure reviews and purge; access-request triage; incident rehearsal.
• Ongoing: tag new matters at intake; follow masking case law, Board guidance and Bar Council changes.

Recommendations

1. 1.Treat s.17(1)(a) as a matter-level exemption recorded at intake, not a firm-wide status.
2. 2.Run one security standard for every file; the claims exemption never removes s.8(5).
3. 3.Structure files and devices so a court can examine one matter without exposing others.
4. 4.Route sensitive internal investigations through external counsel and keep in-house notes lean.
5. 5.Build data rooms on banded data, and name individuals only where the deal requires it.
6. 6.Approve AI and e-discovery tools centrally, on processor terms that bar training on client data.
7. 7.Close files: when the claim ends, the exemption ends.

Key takeaways

• On our reading, s.17(1)(a) is purpose-bound: it covers disputes, including defence and reasonably anticipated claims, not advisory, transactional or know-how work, and it ends when the claim does.
• Security safeguards and accountability for processors survive the exemption; breach intimation to the Board does not apply to exempt dispute data, but CERT-In reporting does.
• The Supreme Court's 31 October 2025 judgment limits examination of advocates' devices to the jurisdictional court and leaves in-house counsel outside s.132 privilege.
• Section 17(1)(e) needs an approved scheme; share and asset deals need banded data rooms, clean teams and deletion at completion.
• In our view, opposing parties have no DPDP access right against a law firm, and dispute processing is exempt from rights in any case.