Cyber Law and Data Protection
Advice on digital activity, data protection, cyber incidents, platform obligations, and technology-related disputes.
Lexacto & Co. advises organisations on the legal framework governing digital systems, online services, and data. The practice supports clients with privacy compliance, technology agreements, intermediary obligations, incident response, and disputes involving digital activity.
When a cyber incident or regulatory issue arises, the firm helps clients assess obligations, preserve evidence, coordinate expert support, and respond to authorities and affected parties.
Digital Personal Data Protection Act, 2023
The firm advises on the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. The framework covers digital personal data processed in India and certain processing outside India connected with offering goods or services to individuals in India. It sets requirements for notices and consent or other permitted grounds for processing, and places duties on Data Fiduciaries for security safeguards, breach response, and grievance handling. Data Principals have rights that include access to information about processing, correction and erasure, grievance redressal, and nomination. The Act also provides for additional duties for Significant Data Fiduciaries and safeguards relating to children's personal data. Different provisions have phased commencement dates, so applicability and implementation planning should account for the relevant notifications.
Scope of Services
- Advisory under the Information Technology Act, 2000 and rules made thereunder
- DPDP Act readiness reviews, data mapping, and compliance planning for Data Fiduciaries and Data Processors
- Drafting and review of privacy notices, consent flows, and data-processing agreements
- Policies for retention and erasure, reasonable security safeguards, and personal data breach response
- Processes for Data Principal access, correction, erasure, grievance redressal, and nomination requests
- Advice on obligations concerning children's personal data and Significant Data Fiduciaries
- Regulatory engagement, responses to Data Protection Board proceedings, and related appeals
- Data protection compliance, privacy policies, and data-handling agreements
- Cyber incident response, breach assessment, and regulatory engagement
- Intermediary liability, platform obligations, and online content matters
- Technology, software, cloud, and digital service agreements
- Domain name disputes and online enforcement
- Civil and criminal proceedings concerning cyber offences
Forums & Authorities
The firm advises and represents clients before authorities and courts dealing with digital activity and cyber incidents.
- High Courts
- Telecom Disputes Settlement and Appellate Tribunal (TDSAT) in appeals under the Information Technology Act
- Magistrates and special courts in cyber matters
- Adjudicating officers under the Information Technology Act
- Computer Emergency Response Team (CERT-In)
Sectors Served
The practice serves organisations that operate digital services, process data, or depend on technology systems.
- Technology companies and software developers
- Digital platforms, e-commerce operators, and intermediaries
- Financial services and data-driven businesses
- Media, communications, and online service providers
Why Engage Lexacto & Co.
Cyber matters can require quick coordination across legal, technical, and regulatory teams. The firm works with clients through incident response, regulatory engagement, and proceedings, maintaining continuity from initial assessment through resolution.