Who actually owns the code
Under Indian law, work created by an employee in the course of employment
generally belongs to the employer, but the position for contractors and
freelance developers is less automatic and depends on what was actually
agreed. A technology company that has built its product using a mix of
employees, contractors and early collaborators without a signed IP assignment
from each of them may not cleanly own its own codebase. This surfaces most
often during fundraising or acquisition diligence, when a buyer’s lawyers ask
for assignment documentation that does not exist.
Data protection under the DPDP Act
The Digital Personal Data Protection Act 2023 sets out obligations for
businesses that collect and process personal data, including notice and
consent requirements and obligations around data breaches. A technology
company handling user data, whether directly as a data fiduciary or as a
processor for another business, needs its consent flows, privacy notices and
data processing agreements aligned with these obligations. Retrofitting
compliance after a product has already launched, and after user data has
already been collected on inadequate notice, is considerably harder than
building it in from the start.
A platform that hosts content, reviews, listings or communications
generated by its users is generally treated as an intermediary under the
Information Technology Act 2000, and can lose the safe harbour that protects
it from liability for that content if it fails to follow the required due
diligence, including grievance redressal and takedown processes. Startups
that treat this as a formality rather than an operational requirement expose
themselves to liability for content they did not create but also did not
handle correctly.
Open-source exposure
Products built quickly tend to absorb open-source components without much
scrutiny of the licence attached to each one. Some open-source licences
require that derivative works be released under the same licence, which can
be incompatible with a company’s plan to keep its own code proprietary. This
is a routine finding in technical due diligence, and the fix, if one is
needed, is far cheaper before a component is deeply embedded in the product
than after.
