India's data bar
The legal market in India is in many ways representative of its wider economy. The country only opened itself up to foreign investment in 1991, so some industries and regulations maintain a vaguely protectionist flavour. That’s true in the law, too: international firms are not allowed to operate in the country, meaning a few large domestic corporate law firms have come to dominate the scene. On the data front, many practices have long focused on outsourcing-related work.
Data protection in India is a new area; the current rules were put in place in 2011 and consist only of eight sections within the Information Technology Act. With a few notable exceptions, those that do work in the area have not been doing so for long. The depth of expertise in the data protection and privacy space, onlookers say, is sometimes lacking. There are a few standout names who lead the pack and have been in the space for some time, but these privacy specialists are not as common as in other jurisdictions. With the GDPR-style Personal Data Protection Bill set to pass through India’s parliament soon, observers expect a spike in demand for data privacy advice.
MCM LawView more
Samuel Mani, one of three founding partners at boutique firm Mani Chengappa Mathur (known as MCM Law), is known by rivals as having a particularly commercial approach. He was previously general counsel at IT giant Infosys, whose former chairman Nandan Nilekani built Aadhaar, India’s national biometric database. The firm, based out of Bangalore, has a strong focus on advising startups and innovative technology providers; it also handles more traditional corporate work for foreign clients.
Primarily focused on technology through its transactions and outsourcing departments, MCM Law also has standalone data protection, IP and employment teams. Lawyers in the data protection practice advise companies on industry-specific privacy and data protection strategies, draft privacy policies, and audit existing frameworks. In a style more usually associated with European and US data teams, the firm advises on data use in a business-oriented way, rather than focusing on pure compliance advice.
Cyril Amarchand MangaldasView more
Cyril Amarchand Mangaldas is one of the largest and best-known firms in India. The result of the break up of legacy Amarchand & Mangaldas & Suresh A Shroff, from which rival firm Shardul Amarchand Mangaldas was also born, onlookers consider it to be the cream of the crop for corporate matters.
A traditional TMT practice emerged at the firm through licensing, procurement and outsourcing work; the firm now offers data protection advice. Although the firm’s data protection and privacy practice is relatively new, its depth of experience in TMT and corporate work puts it in a strong position as demand grows for data protection advice.
J Sagar Associates, now more commonly known just as JSA, is a large full-service firm. At 27 years old and with 300 lawyers across seven cities, it is a well-established player, highly regarded by lawyers both at home and abroad. Like others, its data practice forms part of its larger TMT practice, which encompasses privacy and cybersecurity. Practice head Probir Chowdhury, based in Bangalore, advises multinational companies on different aspects of technology law, including data protection. Mirroring the company’s TMT practice more generally, Chowdhury has recently carried out an increasing amount of work in fintech, as the Indian scene rapidly develops.
Mandates have included advising Brocade Communications Systems and Extreme Networks on the latter’s acquisition of Brocade’s data centre business; assisting an online payments system company with its international data-transfer processes; and helping Accenture with cybersecurity due diligence. The firm also advises multinational companies on data localisation requirements.
Kochhar & CoView more
Another big player in the data protection space in India is Stephen Mathias, head of Kochhar’s Bangalore office and the firm’s technology practice – which spends nearly half its time on privacy and data protection work. Mathias entered the technology and data protection scene having helped set up a number of outsourcing projects in the country, and with a history of organising technology contracts and software licensing agreements.
The firm has an international outlook, with much of its work coming from referrals from leading European and American firms. The firm helps companies in reviewing data usage and compliance; its approach is to help clients comply with the law in India with as little disruption as possible to global privacy policies. The team has worked on more than 200 privacy assignments in the past two years.
As well as offices in six cities in India, Kochhar & Co has outposts in Dubai, Singapore, Jeddah and Atlanta. Major work for Mathias and Kochhar includes helping blue-chip tech companies set up their operations in India.
Trilegal partner Rahul Matthan, based in Bangalore, is widely acknowledged as one of a few Indian data protection leaders. He helped formulate the existing data protection rules, and is cited by others as having a highly comprehensive, policy-based approach to assisting clients. Bangalore-based Nikhil Narendran, who works as part of Matthan’s team, also holds a strong reputation in the area.
Data work at Trilegal falls under the firm’s TMT practice. Work has included advising Accenture on the country’s rules for sensitive personal data, carrying out a review of privacy policies for the Depository Trust & Clearing Corporation, and assisting JP Morgan on data protection issues related to an outsourcing effort. The firm’s TMT lawyers also work in M&A, telecommunications regulation, commercial contracts, technology outsourcing, e-commerce, IP, and media and entertainment. The firm has four offices across India.
Nishith DesaiView more
Nishith Desai is a relatively large firm with four offices in India and another four abroad. It has a reputation for good work in the technology sector and is considered to take a slightly less traditional approach than some of its contemporaries. The firm’s technology law practice places a special focus on IT and business process outsourcing. The firm has developed a niche in this area and has assisted outsourcing companies with data storage and collection policies, as well as on the data protection challenges associated with cloud computing.
The firm also has a strong focus on research and strategy, which has included setting up a research centre. Clients include tech giants Amazon, Facebook and Google, as well as the likes of Mastercard and Cisco. Mumbai-based partner Gowree Gokhale holds a strong reputation in the area.