Top 10 legal and compliance interview questions

Under the Indian Contract Act, 1872, an agreement becomes a contract when it has: an offer and acceptance; free consent (no coercion, undue influence, fraud, misrepresentation or mistake); parties competent to contract (majority age, sound mind, not disqualified); lawful consideration; a lawful object; and it is not expressly declared void (for example, agreements in restraint of marriage or trade, wagering agreements). There must also be an intention to create legal relations and certainty of terms. Some contracts additionally need to be in writing, stamped or registered.

• Indemnity: a promise by one party to compensate the other for specified losses, typically arising from third-party claims or breaches (for example, IP infringement claims arising from the vendor's software). It allocates specific risks.
• Limitation of liability: caps the total amount a party can be liable for (often the fees paid in the previous 12 months) and usually excludes indirect or consequential losses (lost profits).

Negotiation interplay: parties often carve out certain indemnities or breaches (confidentiality, data protection, IP infringement, fraud, wilful misconduct) from the cap, or set a separate, higher cap for them. Explaining these in business terms is a core in-house skill.

• Whether it's mutual or one-way, and that it matches the actual information flow.
• Definition of confidential information: not too broad or too narrow; whether marking is required.
• Standard exclusions: information that is public, already known, independently developed or received from third parties lawfully.
• Permitted use and disclosure: only for the stated purpose; disclosure to employees and advisers on a need-to-know basis; compelled disclosure by law with notice.
• Term of the agreement and how long confidentiality obligations survive.
• Return or destruction of information.
• Remedies: injunctive relief; avoid unlimited liability or onerous penalties.
• No hidden clauses: non-solicitation, non-compete, IP assignment or exclusivity that don't belong in an NDA.
• Governing law and jurisdiction.

• Board meetings (minimum frequency and gaps per the Companies Act) and the AGM, with notices and minutes.
• Maintaining statutory registers (members, directors, charges) and records.
• Annual filings with the ROC through the MCA portal: financial statements and the annual return, within prescribed timelines.
• Appointment of the statutory auditor and filing of related forms.
• Director KYC and disclosures of interest; event-based filings (changes in directors, share allotments, registered office).
• Tax compliances: income tax returns, TDS deposits and returns, GST registration and returns.
• Labour compliances: PF, ESI, professional tax, Shops and Establishments registration, POSH Internal Committee and annual report.
• Sector-specific licences and regulatory filings.

Mention a compliance calendar with owners and reminders to ensure nothing is missed.

The DPDP Act governs the processing of digital personal data in India (and processing outside India for offering goods or services to people in India).

• Data fiduciaries must process personal data for lawful purposes based on valid consent (free, specific, informed, unambiguous, after a clear notice) or certain legitimate uses.
• Obligations: accuracy, reasonable security safeguards, breach notification to the Data Protection Board and affected individuals, erasure when the purpose is served, grievance redressal, and contracts governing data processors.
• Data principals have rights to information, correction and erasure, grievance redressal and nomination, and duties (for example, not filing false complaints).
• Special rules for children's data (verifiable parental consent; no tracking or targeted advertising directed at children) and extra obligations for significant data fiduciaries (DPO, audits, impact assessments).
• The Data Protection Board of India enforces it, with substantial penalties.

The government notifies rules for implementation, so compliance teams track them and build consent management, data mapping, retention and security programmes.

• Employees: under the Copyright Act, the employer is generally the first owner of copyright in works made by employees in the course of employment under a contract of service, unless agreed otherwise. Employment agreements still include clear IP assignment and confidentiality clauses, covering inventions and other IP too.
• Freelancers/contractors: the author is usually the first owner, so the company needs a written assignment (specifying rights, duration, territory and consideration, as required under the Copyright Act). Without it, the company may only have an implied licence.

Practical point: every contractor agreement for logos, code or content should include IP assignment, moral rights waivers where possible, and warranties of originality.

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 requires employers to prevent and redress sexual harassment.

Employers with 10 or more employees must constitute an Internal Committee (with a woman presiding officer, at least half women members, and an external member from an NGO or familiar with the issues). They must have a written policy, display information about the committee and consequences, conduct awareness programmes and training, handle complaints within statutory timelines, maintain confidentiality, take action on the committee's recommendations, and file an annual report. Districts have Local Committees for smaller workplaces and certain cases. Non-compliance attracts penalties.

1. Map obligations: corporate, tax, labour, data protection, sector-specific and contractual obligations; create a compliance register.
2. Risk-prioritise: focus on high-impact areas (data protection, payments, labour, licences).
3. Policies and processes: code of conduct, privacy and data security, POSH, anti-bribery, vendor onboarding, document retention.
4. Ownership: assign an owner for each obligation; build a compliance calendar with reminders.
5. Training: onboarding and annual refreshers; practical, role-specific.
6. Monitoring and audits: periodic checks, evidence collection, management reporting.
7. Speak-up channel (whistle-blower mechanism) and investigation process.
8. Continuous updates as laws change and the company grows.

Emphasise enabling the business with practical, risk-based compliance.

1. Understand the commercial context: deal size, strategic importance, why the client insists.
2. Explain the risk in plain language: unlimited liability exposes the company to losses far beyond the contract value.
3. Propose alternatives: a cap linked to fees (for example, 12 months' fees), a higher separate cap for data breaches, carve-outs only for fraud or wilful misconduct, mutual caps, and insurance coverage.
4. Move quickly: offer standard fallback language from the playbook so the deal isn't delayed.
5. Escalate to the decision-maker (legal head, CFO) with a clear risk summary if the client won't move; the business decides with full information, and the decision is documented.

This shows you're a business partner who manages risk, not a blocker.

• Official sources: the Gazette of India, ministry and regulator websites (MCA, RBI, SEBI, MeitY, labour ministry), press releases and notifications.
• Legal databases and news: SCC Online, Manupatra, LiveLaw, Bar & Bench.
• Law firm newsletters and alerts; professional bodies (ICSI, Bar Council, industry associations).
• Webinars, seminars and continuing education.
• A personal tracker of updates relevant to my sector, with notes on their impact on the company.

Mention a recent development you followed and what a company would need to do about it. That proves the habit is real.