Advocate-DPO ready. POSH-safe. BCI-aligned.

Yes, and it applies from the first payroll entry. The moment you hold personal data of employees, associates, prospective clients, vendors or newsletter subscribers, you are a Data Fiduciary. Even sole practitioners are covered. Case files are the only real carve-out, and even that is narrower than most partners think.

It only exempts what you process to enforce a legal right or claim, and what is processed by courts themselves for judicial functions. Case papers, pleadings, evidence, witness statements are fine. Your HR spreadsheet, associate onboarding folder, prospective-client intake form, the CRM you built in a weekend, the mailing list you export into Mailchimp, and last quarter's vendor invoices are all outside the carve-out. That is where DPDP hits your firm.

The client can ask. You can still redact work product and privileged material before you release. Section 12(4) lets you withhold where disclosure would harm a third party, and privilege under BSA 129/132 sits above discovery in any event. What matters is that you have a workflow to spot the matter-linked records before you send anything. Our DSR portal flags those records automatically so a partner reviews them before the response goes out.

Yes, and a lot of Indian firms are already turning this into a recurring line. Section 10(2)(a) wants an India-based DPO reporting to the client's board. An advocate on retainer ticks both boxes. The hard part is delivery — running six or ten client DPO practices out of shared drives and emails burns your associates out fast. The Partner tier gives you one console and one login for all of them.

Rule 36 was liberalised in 2008. You can run a website. You can publish articles. You can list your practice areas and contact details. What you cannot do is solicit — no cold outreach, no comparative marketing, no client testimonials that read like endorsements. Anything the firm sends outbound goes through our BCI review flag before it leaves the outbox.

Yes. The POSH Act applies to any workplace with 10 or more employees, and that includes partnerships, LLPs and chambers. You need a constituted Internal Committee with a woman Presiding Officer and an external member, an annual return to the District Officer by 31 January, and quarterly awareness sessions on the record.

The April 2022 Direction applies to any entity running ICT infrastructure that suffers a reportable incident. Ransomware on your DMS, an unauthorised access to your VDR, or a compromised mail server — all in scope. Six-hour report window, 180-day log retention, named CISO. Legal DMS platforms are already inside CERT-In's attention radius after the 2023 wave of law-firm ransomware.

The biggest number is Rs 250 crore for a security-safeguards failure under Section 8(5). Add up to Rs 200 crore for missing the breach notification under Section 8(6). And the fine on your firm does not extinguish the parallel BCI professional-misconduct route, nor does it protect the client whose data leaked.

Two annual filings under the LLP Act 2008. Form 11 by 30 May, Form 8 by 30 October. Statutory audit if turnover crosses Rs 40 lakh or partner contribution crosses Rs 25 lakh. If you receive supplies from MSME vendors, add the MSME-1 half-yearly.

Yes. The Partner tier gives you co-branded tenants at yourfirm.dcomply.in with your masthead, per-client evidence isolation, and consolidated billing. The client sees your firm brand. Their engagement letter with you is still the DPA. We are the platform underneath.

It does not. Privilege is a rule of evidence — it stops compelled testimony in court. It is not a gag on statutory disclosure obligations. The Rules 2025 template limits what goes to the DPB to breach facts and mitigation steps, not the content of any privileged matter.

Advocates practice tends to hold matter files for around seven years for professional-defence reasons. That is fine — retain them, but tag them as archival-retention. When the archival period expires, DPDP purpose-limitation kicks back in and the Retention module flags the file for review or deletion. It is a two-phase policy, not a fight between the two frameworks.