Practice Area · Technology, Data & Intellectual Property
Technology, Data & Intellectual Property: Indian-Law Counsel for Technology Contracts, Data and IP Disputes in Gujarat
Technology contracts, data protection, confidential information and IP disputes for multinationals, fintechs, software companies, manufacturers and brand owners, with Gujarat’s GCC, semiconductor, data-centre and GIFT City work in view.
Who we act forTechnology contractsFintech & GIFT CityData protectionTrade secretsBrand & IP disputesFAQs
13 May 2027
Main DPDP duties apply to businesses
6 hours
CERT-In incident reporting window
1,260
Entities in GIFT IFSC, June 2026
2,100+
Global capability centres in India, March 2026
Mahendra Bhavsar & Co. is a Gujarat-focused law firm, headquartered in Ahmedabad since 1982. We act as Indian-law counsel on technology contracts, data protection, confidential information and intellectual property, and we handle the disputes that follow when they go wrong. Our clients include multinationals and their Gujarat capability centres, fintech and financial-services businesses in GIFT City, software and IT companies, manufacturers bringing technology into Gujarat plants, brand owners, investors and the international law firms who act for them.
Technology work in Gujarat has changed shape. Semiconductor plants are in production at Sanand, global capability centres are opening in GIFT City and Ahmedabad, data centres are being planned at scale, and fintech has made GIFT City a national hub. Each of these brings contracts, data and intellectual property questions that need Indian-law answers, kept current with rules that are changing quickly. That is the work this page describes.
Clients
Who We Act For
Each client type brings a different set of technology, data and IP questions. The work is organised around them.
Multinationals & Global Capability Centres
Setting up or running engineering, technology and shared-service centres in Gujarat.
- Group services and cost-sharing agreements
- IP created in India assigned or licensed back to the group, with the Indian defaults dealt with
- Employee IP, confidentiality and invention terms
- Group data transfers under Indian data law
- Vendor contracts for set-up and operations
Fintech & Financial Services
Fintechs, their bank partners and GIFT City units building regulated technology.
- Bank–fintech partnership and lending service provider agreements
- Technology, cloud and outsourcing contracts written to RBI and IFSCA outsourcing terms
- Payment and customer data kept where the rules require
- Onshore–offshore arrangements between an Indian company and its GIFT unit
- Regulator licensing handled with the client’s regulatory advisers
Software, SaaS & IT Services Companies
As vendors to Indian and overseas customers, and as buyers of technology.
- Master services, SaaS and licence agreements
- Liability caps that take account of Indian data-protection penalties
- Service levels, acceptance and source-code escrow
- Open-source and AI-tool terms
- IP assignments that do not fall back to the statutory defaults
Manufacturers Bringing Technology to Gujarat
Chemicals, pharmaceuticals, engineering, electronics, semiconductors, batteries, textiles, ceramics and diamonds.
- Technology transfer and know-how licences from foreign partners
- Equipment and process supply agreements
- Trade-secret and cleanroom confidentiality programmes
- Design registration for product shapes
- Action against departing employees and vendors who take know-how
Brand Owners
Indian and foreign businesses protecting marks, designs and content in India.
- Trade mark, copyright and design filings
- Oppositions, rectification and cancellation
- Injunctions against infringement, passing off and counterfeits before the Gujarat commercial courts
- Domain-name and online marketplace take-downs
Investors & Acquirers
Buying or investing in technology-led businesses.
- IP chain of title
- Employee and contractor assignments
- Open-source licence exposure
- Data-protection due diligence under current and incoming law
- IP transfer on completion
International Law Firms
Acting for overseas clients with an Indian or Gujarat angle.
- Local counsel in Gujarat commercial courts
- Pre-suit mediation strategy
- Evidence and affidavit practice
- Trade mark searches, filings and oppositions at the Ahmedabad registry
- Indian-law input on technology and data contracts
Organisations Handling Personal Data
Any business with customer, employee or user data.
- A readiness plan mapped to the DPDP commencement dates
- Privacy notices, consent flows and processor contracts
- Breach response under the two separate Indian notice regimes
- Disputes and claims against vendors after an incident
Gujarat
Where Technology Work Is Growing
Five areas account for most of the new technology, data and IP work we see coming to Gujarat. Each brings its own legal questions.
Position as at 5 October 2026
Fintech and GIFT City
GIFT City’s International Financial Services Centre had 1,260 registered or authorised entities and more than US$120 billion of banking assets by June 2026, including 127 technology and ancillary service providers. The RBI rewrote its digital lending and payment aggregator rules in 2025, and replaced its outsourcing directions in November 2025. Fintechs, their bank partners and GIFT units need contracts, data arrangements and IP ownership that fit those rules.
Global Capability Centres
India had more than 2,100 global capability centres by March 2026. Gujarat’s GCC Policy 2025–30, launched in February 2025, aims at 250 or more centres in the state. A GCC’s main legal questions are who owns the IP its Indian team creates, how group services and costs are documented, and how data moves within the group.
Semiconductors and Electronics
Assembly and test plants at Sanand began commercial production in 2026, and the Dholera fabrication plant is under construction with Taiwanese technology support. This work runs on technology transfer, know-how licences, supplier agreements and strict confidentiality.
Data Centres and Cloud
Gujarat’s Data Centre Policy 2026–29, launched in July 2026, targets large-scale capacity, and a major AI data centre is planned at Jamnagar. Colocation, capacity-lease and cloud agreements follow, alongside the power and land work handled by our projects team.
Artificial Intelligence
India has no standalone AI statute. MeitY’s AI Governance Guidelines of November 2025 apply existing law, and the IT Rules amendment of February 2026 requires labelling of AI-generated content on platforms. AI procurement, licensing, training-data and liability terms are now part of ordinary technology contracting.
Gujarat also hosts the headquarters of IN-SPACe, India’s space-sector regulator, and a growing start-up base. The electric-vehicle battery plant being built at Sanand will make some of its cells on technology licensed from a Japanese partner and others on technology developed in-house, an example of the technology-transfer work this page covers.
Contracts
Software, SaaS, Cloud and AI Agreements
Most technology disputes start with a contract that was silent on the point that later mattered. We draft and negotiate technology agreements so that ownership, performance and risk are settled before the work starts.
Software Development and Licensing
Scope and acceptance, who owns the code and the improvements, licence limits, and what happens to the source code if the vendor fails. Source-code escrow where the software is business-critical.
SaaS and Cloud
Service levels and credits, data location and return, security commitments, subcontractor and sub-processor controls, suspension and exit. For regulated customers, the extra terms that RBI, IFSCA or sector rules require.
Implementation and Outsourcing
Milestones, change control, dependencies on the customer, warranties, and the remedies that actually work when a project runs late.
AI Agreements
Rights in training data and outputs, confidentiality of prompts and data, accuracy and bias responsibility, human oversight, and compliance with the labelling rules for AI-generated content.
Liability and Indemnities
Caps and carve-outs that reflect Indian data-protection penalties, which can reach ₹250 crore for a failure of security safeguards. IP indemnities and the procedure for handling third-party claims.
Governing Law and Disputes
Indian law and forum choices, arbitration clauses that can be enforced, and interim relief routes if the relationship breaks down.
Ownership
Who Owns Software and IP Created in India
Indian copyright law fills gaps that contracts leave open, and the defaults often surprise foreign groups.
Position as at 5 October 2026
- Work made by an employee in the course of employment belongs to the employer unless agreed otherwise. Work made by an independent contractor does not pass automatically; it needs a written, signed assignment.
- An assignment that does not state its term lasts five years. One that does not state its territory covers India only. Rights not exercised within a year of assignment can lapse.
- These defaults have been applied to software development contracts by the courts.
We write assignments, licences and employment terms so that the group, not the default rule, decides who owns what. For GCCs and development centres, we document the flow of IP from the Indian entity to the group and back, in a form that also works for tax and transfer-pricing advisers.
Fintech
Fintech, GIFT City and Regulated Clients
A fintech’s technology contracts are also compliance documents. The RBI and, in GIFT City, the IFSCA tell regulated businesses what their agreements with technology providers and partners must contain. We write and review those agreements against the current rules.
Position as at 5 October 2026
- Digital lending. The RBI’s Digital Lending Directions of May 2025 require written agreements with lending service providers after due diligence, explicit borrower consent before personal data is shared, borrower data stored only on servers in India, and a cap on default loss guarantees.
- Payments. The RBI’s Payment Aggregator Directions of September 2025 set what merchant agreements must cover, set the permitted uses of escrow accounts, and bar merchants from storing card credentials. All payment system data must be stored in India.
- Outsourcing and cloud. In November 2025 the RBI replaced its outsourcing directions for banks and other regulated entities. Technology and cloud contracts now need audit and inspection rights, approval of subcontractors, exit plans, data-location terms and, for overseas providers, suitable governing-law provisions. Existing agreements had to be brought into line by April 2026.
- GIFT City. The IFSCA replaced its fintech framework with a FinTech Sandbox Framework in March 2026, with separate regulatory, innovation, inter-operable and overseas sandboxes.
Partnerships
Bank–fintech, co-lending, lending service provider and payment partnership agreements.
Technology and Cloud
Platform, SaaS and cloud contracts drafted or re-papered to the regulator’s outsourcing terms.
Data
Consent flows, data-sharing terms and data-location arrangements that meet both the RBI rules and the DPDP regime.
GIFT City Structures
Services, technology licence and cost-sharing agreements between an Indian company and its GIFT unit, and IP owned in the right entity. IFSCA licensing and prudential questions are handled with the client’s regulatory advisers, and FEMA and tax points with theirs.
Related: our Banking & Institutional Finance page covers lending, security and GIFT City lenders.
Data Protection
The DPDP Act: What Applies, and When
India’s Digital Personal Data Protection Act, 2023 is coming into force in stages. The Rules were notified in November 2025. Most duties on businesses start in 2027, but the contracts, notices and systems that meet them take time to build. We help clients prepare as part of their technology and commercial work, not as a separate compliance exercise.
Position as at 5 October 2026
13 November 2025
The Act’s framework provisions and the Data Protection Board provisions commenced; the DPDP Rules, 2025 were notified.
13 November 2026
Registration of consent managers begins.
13 May 2027
The main duties on data fiduciaries apply: notice and consent, security safeguards, breach notification, children’s data, data principals’ rights, significant data fiduciary obligations and penalties. The older IT Act data-security provision (section 43A) is repealed on the same date.
- Until May 2027. The existing IT Act rules on sensitive personal data continue to apply.
- Penalties. Up to ₹250 crore for failing to maintain security safeguards, and up to ₹200 crore for failing to notify a breach.
- Cross-border data. From May 2027, transfers will be permitted except to countries the government restricts by notification, with extra localisation rules for significant data fiduciaries. Sector rules, such as the RBI’s data-location requirements, already apply.
- What we do. A gap plan mapped to the three dates · privacy notices and consent flows · data-processing clauses in vendor and customer contracts · retention and erasure terms · preparation for consent managers and for significant data fiduciary status · advice on how the DPDP regime sits with RBI, IFSCA and employment rules.
Incident Response
The First Hours After a Data Breach
Two separate clocks run in India, and they belong to two different authorities.
Position as at 5 October 2026
- CERT-In. Under the directions of April 2022, cyber incidents must be reported to CERT-In within six hours of being noticed, and ICT logs must be kept for 180 days within India.
- Data Protection Board. From May 2027, a personal data breach must be notified to the Board and to each affected person without delay, with a detailed report to the Board within 72 hours, or longer if the Board allows.
Our role is the legal response: deciding what must be notified, to whom and when; keeping the investigation privileged where possible; managing claims by and against vendors and customers; and handling the disputes that follow. Technical forensics are carried out by the client’s security providers, and we work alongside them.
Trade Secrets
Confidential Information and Departing Employees
India protects confidential business information through contract, equity and the law of confidence, not a dedicated statute. The Law Commission recommended a trade secrets law in 2024, but none has been enacted. That makes the paperwork, and the evidence behind it, the whole of the protection.
Confidentiality Architecture
Non-disclosure agreements that define the information, the permitted use and the return or destruction of it; confidentiality terms in employment, vendor and partner contracts; access controls and marking that a court will later recognise.
Manufacturing Know-How
Process recipes, formulations, drawings and equipment settings in chemicals, pharmaceuticals, engineering, electronics and semiconductor plants. Cleanroom and site confidentiality programmes for technology brought in from abroad.
Departing Employees and Vendors
Exit protocols, forensic preservation with the client’s IT team, demand letters, and suits for injunctions and delivery-up before the commercial courts.
The Non-Compete Question
Agreements in restraint of trade after employment ends are generally void under Indian contract law, so a non-compete clause is not the answer. Confidentiality, non-solicitation during employment, garden leave and well-drafted IP assignment are what hold up.
Brands
Trade Marks, Designs and Enforcement
Brand protection is a cycle: register, watch, oppose, enforce. We run all four stages for Indian and foreign brand owners, with the disputes handled by our dispute resolution team.
Registration
Trade mark searches and filings, copyright registration where it adds evidential value, and design registration for product shapes and surface patterns. The Trade Marks Registry’s Ahmedabad office covers Gujarat.
Oppositions and Registry Disputes
The opposition window is four months from advertisement and cannot be extended, so marks must be watched. Oppositions, rectification and cancellation where a conflicting mark has real commercial consequences.
Injunctions and Passing Off
Suits for infringement of trade marks, copyright and designs, and for passing off, with interim relief, search orders and delivery-up. Counterfeit goods, look-alike packaging and online marketplace listings.
Domain Names and Online Content
Domain-name complaints, take-down requests and content removal, including under the platform rules now in force for AI-generated content.
Forum
Commercial Courts, Mediation and Patent Disputes
Position as at 5 October 2026
- IP and technology contract disputes are “commercial disputes” under the Commercial Courts Act, 2015, and go to the designated Commercial Courts in Gujarat, with appeals to the Gujarat High Court’s Commercial Appellate Division.
- A commercial suit must normally go through pre-institution mediation first. The exception is a suit that genuinely seeks urgent interim relief, which the court tests on the plaint itself. The Supreme Court has recognised that continuing infringement can supply that urgency.
- Patent infringement and validity disputes are heard by the same courts. We take them on as contentious matters with patent specialist co-counsel and technical experts. We do not draft, file or prosecute patents.
We prepare the evidence, the plaint and the interim-relief application together, so that the urgency is real on the face of the papers and the hearing is not lost on a procedural point. Related: Dispute Resolution, Litigation & Arbitration.
Technology Transfer
Licensing Technology into Gujarat Plants
Gujarat’s new plants, from semiconductor assembly to battery cells, run on licensed foreign technology. The licence is the asset. We draft and negotiate technology transfer, know-how and technical assistance agreements for licensors and licensees, covering the scope of the licence, improvements and grant-backs, confidentiality and site controls, training and acceptance, royalties and the payment mechanics, and what happens on termination. Tax, transfer-pricing and foreign-exchange points are handled with the client’s advisers.
Transactions
IP and Data Due Diligence
Chain of Title
Does the target own what it says it owns? Employee and contractor assignments, founder IP, and the five-year and India-only defaults in older assignments.
Open Source
Which licences sit in the codebase, and whether any oblige the target to release its own code.
Data
Compliance under the current IT Act rules and readiness for the DPDP duties from 2027; consents that will survive a change of control; data-processing contracts with vendors.
Contracts
Change-of-control, exclusivity and assignment clauses in technology licences and customer agreements. Related: Corporate & Business Transactions.
International
Working with International Law Firms
International firms instruct us as Indian and Gujarat counsel on IP litigation, technology contracts and data questions. We give the Indian-law view in terms the international team can pass straight to its client, run the Gujarat court work with the evidence and procedural discipline those courts expect, and handle registry filings and oppositions at the Ahmedabad office. We work to the client’s timetable across time zones. Related: International & Cross-Border Work.
Insights
Related Insights from the Firm
Articles by the firm on the points this page covers.
The Firm
How We Work
- An assessment first. We look at the contract, the data flow or the dispute and tell you what Indian law requires and what we would do, before any engagement.
- Scope and fees in writing. Scope, exclusions and the fee basis are agreed before work starts.
- One point of responsibility. A named partner is responsible for the matter, whether it is a contract, a compliance plan or a suit.
- Selective by design. We take on technology, data and IP work where Indian-law and Gujarat judgment adds value. We do not draft or prosecute patents, and we say so when a matter needs a patent attorney, a forensic specialist or a regulatory licensing adviser.
FAQs
Frequently Asked Questions
Is copyright registration compulsory for software in India?
No. Software is protected as a literary work without registration. Registration is optional, but it can help as evidence in a dispute.
Our contract does not say how long the IP assignment lasts. How long is it?
Under the Copyright Act, an assignment that is silent on its term lasts five years, and one that is silent on territory covers India only. Contracts should state both.
Are non-compete clauses enforceable against former employees in India?
Generally not after employment ends. Confidentiality obligations, non-solicitation during employment and IP assignment clauses are enforceable and do most of the work.
When do the main DPDP duties start?
The main obligations on businesses apply from 13 May 2027. Consent-manager registration begins on 13 November 2026.
How quickly must a data breach be reported in India?
Cyber incidents must be reported to CERT-In within six hours. From May 2027, a personal data breach must also be notified to the Data Protection Board and affected individuals without delay, with a detailed report to the Board within 72 hours, or longer if the Board allows.
What are the maximum penalties under the DPDP Act?
Up to ₹250 crore for a failure to maintain reasonable security safeguards, and up to ₹200 crore for failing to notify a breach.
Does the IT Act still govern personal data?
Yes. Section 43A and the 2011 rules on sensitive personal data apply until they are repealed on 13 May 2027.
How long is the trade mark opposition window?
Four months from advertisement in the Trade Marks Journal, with no extension.
Must we mediate before suing for infringement?
Not where the suit genuinely seeks urgent interim relief, which continuing infringement can justify. Otherwise pre-institution mediation is required.
Where do we file a trade mark for a Gujarat business?
At the Trade Marks Registry’s Ahmedabad office, which covers Gujarat. Filing is online.
Does India have an AI law?
Not a standalone statute. MeitY’s AI Governance Guidelines of November 2025 apply existing law, and the IT Rules amendment of February 2026 requires platforms to label AI-generated content.
Do you handle patent matters?
We act in patent infringement and validity disputes with patent specialist co-counsel. We do not draft, file or prosecute patents.
Who owns software written by our employees or contractors in India?
Work made by an employee in the course of employment belongs to the employer unless agreed otherwise. Work by an independent contractor needs a written, signed assignment to pass to the customer.
What must a business do in the first hours after a data breach in India?
Report cyber incidents to CERT-In within six hours and preserve logs. From May 2027, also notify the Data Protection Board and affected individuals without delay, with a detailed report to the Board within 72 hours. Take legal advice before external statements.
Which court hears IP and technology disputes in Gujarat?
The designated Commercial Courts at district level, with appeals to the Commercial Appellate Division of the Gujarat High Court. The Gujarat High Court does not hear these suits at first instance.
How should technology transfer into a Gujarat plant be documented?
Through a technology transfer or know-how licence that fixes the scope of the licence, improvements and grant-backs, confidentiality and site controls, training and acceptance, royalties and what happens on termination.
Contact
Discuss a Technology, Data or IP Matter
Tell us about the business, the technology or brand involved and what has happened or is planned, and we will reply with how we can help and what Indian law will require.