Most Indian software and product-engineering firms run on a template contract that quietly gives this away. It's usually two clauses. It's fixable in a day — if someone actually reads it.
Technology & SaaS Advisory
Lynx Legal Partners LLP works with SaaS companies, IT services firms, AI/ML startups and deep-tech ventures across every stage — from the MSA you send your next enterprise client, to the DPDP programme your investors will ask about, to the IP assignment chain that has to be airtight before your next round.
You don't need a full retainer to start. You need someone to look at the two or three documents doing the most damage right now — and tell you what's wrong with them, same day.
A fixed-fee contract review (your MSA or SaaS ToS) or a DPDP gap-check — scoped and priced upfront, delivered in days. Clients typically move on to an ongoing contract desk, IP portfolio management, or an outside-GC retainer.
Often, yes. Most template MSAs carry a "work product" or "deliverables" clause assigning all IP created under the agreement to the client — read literally, that can sweep in your reusable libraries, frameworks and internal tooling, not just the client-specific build. The fix is usually two clauses: a background-IP carve-out, and a narrow assignment of named deliverables with a licence-back. Under s.19, Copyright Act 1957, an assignment must be in writing and signed — which makes it enforceable against you too.
100% of fees paid in the preceding 12 months is the common Indian benchmark, with indirect and consequential loss mutually excluded. Enterprise buyers push for 1.5x–2x, or a super-cap for data-breach and IP-indemnity claims. The carve-out list matters more than the number: confidentiality, IP infringement, data protection, fraud and wilful misconduct usually sit outside the cap. Indian courts generally enforce negotiated caps between commercial parties; s.74, Indian Contract Act 1872 limits recovery on stipulated sums to reasonable compensation.
The DPDP Act does not prescribe DPA contents the way GDPR Article 28 does. Section 8(2) requires only that a Data Fiduciary engage a processor "under a valid contract" — and the Fiduciary stays liable either way. So it all has to be drafted in: purpose limitation, security safeguards (s.8(5), Rule 6), upstream breach reporting in time for the Fiduciary's Rule 7 notification, deletion on withdrawal of consent, sub-processor control and audit rights. Rules notified 13 Nov 2025 (G.S.R. 846(E)); core obligations commence 13 May 2027. See our DPDP practice.
The contractor does — unless you have a written assignment. Section 17, Copyright Act 1957 makes the employer first owner of work created by an employee under a contract of service; that proviso does not reach independent contractors or consultants. Section 19 requires assignment in writing and signed, and supplies defaults where you are vague: five years if no duration is stated (s.19(5)), India only if no territory is stated (s.19(6)). Use a present assignment — "hereby assigns", not "agrees to assign". IP portfolio management.
Three things. Privacy: GDPR Article 3(2) applies extraterritorially — expect requests for Article 28 processor terms, an Article 27 EU representative, and a Chapter V transfer mechanism (SCCs, or the EU–US Data Privacy Framework). In the US, CCPA/CPRA and a widening set of state statutes. Contract: US buyers push US governing law and venue, uncapped IP and breach indemnities, and SOC 2 as a precondition. Sector: EU financial customers flow down DORA ICT terms; AI products face the EU AI Act. Cross-border work.
Start with an inventory, not an opinion. Generate an SBOM, then classify by licence family: permissive (MIT, BSD, Apache-2.0 — attribution, NOTICE, and a patent grant) against copyleft (GPL, LGPL, AGPL). AGPL-3.0 is the one that catches SaaS — its section 13 triggers source disclosure on network use, not only on distribution. Where a copyleft component sits in shipped code, the options are replace, isolate behind a process boundary, or licence commercially. Then check what your MSAs already warrant about open source.
Have a question that isn't here? Send it to us on WhatsApp — we answer scoping questions without a meeting.
Send us your MSA or SaaS ToS — we'll flag what's exposed, fixed-fee, same day.
Copyright© 2026 Lynx Legal Partners LLP
Lynx Legal Partners LLP · LLPIN: ABB-6277 · Registered office: Mumbai
