India: Technology

Clients now come with a problem to solve rather than a role to fill. That shift is changing what secondments are used for, and it may change how General Counsel plan their teams.

Cybersecurity regulation in India has, until now, largely spoken to the entity that suffers the breach. The 2022 CERT-In Directions issued under Section 70B of the Information Technology Act, 2000 fixed a six-hour reporting clock on the organisation that detects an incident. The new Guidelines flip the lens onto the entity upstream of that breach, the OEM or technology provider that built the product in the first place. For the first time, vendors supplying software, firmware, cloud platforms, or APIs into India carry direct, time-bound, and independently verifiable obligations of their own and not obligations that are merely passed through a customer contract, but obligations CERT-In itself may enforce.

In a rare use of its extraordinary powers under Article 142 of the Constitution of India, the Supreme Court heard a curative petition filed by DMRC, challenging an earlier order that had upheld the arbitral award. The judgment brings finality to a decade-long contractual dispute that began in 2013 with arbitration proceedings.