Data protection, IP and employment law

Data protection: the DPDP Act, 2023

India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data, with implementing rules notified by the government. Core ideas:

• Data fiduciary (decides why and how data is processed: the company) and data principal (the individual).
• Processing on the basis of consent that is free, specific, informed, unconditional and unambiguous, given through a clear notice, or for certain legitimate uses defined in the law.
• Purpose limitation and data minimisation: collect only what's needed for the stated purpose; erase when no longer needed.
• Rights of data principals: access information, correction and erasure, grievance redressal, nominating someone.
• Security safeguards and breach notification to the Data Protection Board and affected individuals.
• Extra obligations for children's data (verifiable parental consent) and for significant data fiduciaries.
• Significant financial penalties for non-compliance.

Practical compliance: data mapping (what personal data, where, why), privacy notices, consent management, vendor contracts with data processing terms, access controls and security, retention schedules, breach response plans and employee training. The IT Act, 2000 and sector rules (RBI, SEBI, IRDAI, health) also apply.

Intellectual property

• Copyright (Copyright Act, 1957): original works (software code, content, designs, music). Arises automatically; registration helps as evidence. Employer usually owns works made by employees in the course of employment; contractor work needs a written assignment.
• Trademarks (Trade Marks Act, 1999): brand names, logos, slogans. Search before adopting; register in relevant classes; watch for infringement and passing off.
• Patents (Patents Act, 1970): novel, inventive, industrially applicable inventions; 20-year term; software "per se" is not patentable in India, though technical inventions involving software may be.
• Designs (Designs Act, 2000) for the visual appearance of products; trade secrets protected through contracts and confidentiality.

Employment law essentials

Appointment letters and policies; the four labour codes (wages, industrial relations, social security, occupational safety); PF, ESI and gratuity; maternity benefits; the POSH Act (Internal Committee, policy, training, complaint handling); state Shops and Establishments Acts; non-compete clauses (generally unenforceable after employment ends in India, while confidentiality and non-solicitation can be enforced more readily); and fair, documented disciplinary processes.

Check yourself

• What is the difference between a data fiduciary and a data principal?
• A freelancer designs your company's logo. What document do you need and why?
• Is a post-employment non-compete enforceable in India?