Compliance

This document is informational and summarizes our approach. It is not legal advice. Enterprise customers may have additional contractual terms (DPA / security addendum).

1. India: DPDP Act (Digital Personal Data Protection Act, 2023)

• Purpose limitation and lawful processing (as applicable)
• Reasonable security safeguards to protect personal data
• Support for requests and grievance redressal via privacy@counselgrid.com
• Contractual commitments for enterprise tenants via DPA

2. Advocates Act / Bar Council of India Rules (Professional Ethics)

CounselGrid is a technology platform. For advocates and legal professionals, professional rules govern confidentiality, advertising/solicitation constraints, and the practice of law. Users remain responsible for compliance with applicable rules.

How these interact (no blanket override): The DPDP Act and professional obligations generally operate in parallel, and the DPDP Act is intended to be in addition to other applicable laws. Where professional rules require a higher standard of confidentiality or additional safeguards, users must follow those rules. Where there is an apparent tension between a data protection obligation and privilege/confidentiality, users should address it in a legally compliant manner (including considering privilege), and seek counsel where appropriate. Nothing in CounselGrid’s documentation is intended to limit professional obligations.

3. Confidentiality and privilege

• Access controls and tenant isolation are designed to prevent unauthorized access
• Users should configure roles, permissions, and sharing appropriately
• AI outputs must be reviewed, and sensitive data should be handled in line with professional obligations

4. Security and governance

See Security & Trust for an overview of security practices. Enterprise customers may request audit materials and contractual assurances subject to agreement.

5. Data Breach Response

In the event of a data breach that compromises personal data, we will:

• Contain and investigate the breach within 24 hours of detection
• Assess the risk to affected individuals
• Notify the Data Protection Board of India as required under DPDP Act Section 6
• Notify affected users if the breach poses a high risk to their rights and freedoms
• Notify enterprise customers within 48 hours per our Data Processing Addendum
• Take remedial measures to prevent recurrence

Reporting Security Issues: If you discover a security vulnerability, please report it responsibly to security@counselgrid.com. We will acknowledge receipt within 48 hours and provide updates on remediation.

6. Contact

Compliance & legal: privacy@counselgrid.com
Privacy: privacy@counselgrid.com

Related documents: Terms · Privacy · Acceptable Use · DPA