Sector guide · Law firms
DPDP Act for law firms
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A law firm is a Data Fiduciary for its clients, staff and website visitors, and a Data Processor for personal data inside a matter. Section 17(1)(a) exempts processing necessary to enforce a legal right or claim, which covers litigation files, but not the firm’s marketing site, its intake forms or its HR records. The Readiness Index found the firms that sell DPDP advice scoring 71 on their own websites.
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
The exemption is narrower than firms assume
Section 17(1)(a) switches off most of Chapter II for processing necessary for enforcing any legal right or claim. A litigation file qualifies. The website contact form, the newsletter list, the recruitment pipeline, the client onboarding form and the analytics tag do not; they are ordinary processing and carry the full set of obligations.
What the scanner found on law firm websites
Edition 1 of the Readiness Index scanned twenty websites of firms advertising DPDP services, most of them law firms. Nineteen loaded tracking before consent. Sixteen disclosed no processor for their forms. Eight had no compliant notice and eight no published privacy contact (Section 8(9)). The visible duties were met; the technical ones were not.
Client data inside a matter
For the personal data a client hands over in an engagement, the client is the Fiduciary and the firm processes on its behalf. Section 8(2) requires a valid contract, which belongs in the engagement letter, and Rule 6(1)(f) requires it to bind the firm to reasonable security safeguards. Privilege protects the communication; it does not remove the processing duty.
First five actions
- Run the free scan; fix the consent order and the security headers on the website.
- Rewrite the site notice to Rule 3 and publish the Section 8(9) contact.
- Add a data processing clause to the engagement letter.
- Put Section 8(2) contracts in place with practice management, cloud and e-discovery vendors.
- Write the Rule 7 breach procedure with names and the seventy-two hour clock.
Questions people ask
- Does privilege exempt us from the Act?
- No. Section 17(1)(a) exempts processing necessary to enforce a legal right or claim. Privilege is a separate protection for communications; the firm’s other processing is fully covered.
- Is our contact form processing?
- Yes, and usually through a third-party form tool, which is a Data Processor needing a Section 8(2) contract and a mention in the notice.
- Can we run DPDP compliance for clients as a service?
- Yes. Gevox’s professionals dashboard runs each client in its own workspace with documents cited to the section; the firm supplies the judgment.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.