This document is informational and summarizes our approach. It is not legal advice. Enterprise customers may have additional contractual terms (DPA / security addendum).
1. India: DPDP Act (Digital Personal Data Protection Act, 2023)
- Purpose limitation and lawful processing (as applicable)
- Reasonable security safeguards to protect personal data
- Support for requests and grievance redressal via privacy@counselgrid.com
- Contractual commitments for enterprise tenants via DPA
2. Advocates Act / Bar Council of India Rules (Professional Ethics)
CounselGrid is a technology platform. It does not practise law, give legal advice, or advertise or solicit work for advocates. Advocates who use it remain bound by the Advocates Act, 1961 and the Bar Council of India Rules, and remain responsible for complying with them.
How the DPDP Act and professional duties fit together: The advocate–client relationship, including confidentiality and the privilege for professional communications (Bharatiya Sakshya Adhiniyam, 2023 s.132; Bar Council of India Rules, Part VI, Chapter II, Rule 17), is governed by those laws. The DPDP Act operates in addition to them (s.38(1)) and does not apply its notice, consent and data-principal-rights provisions where processing is necessary for enforcing a legal right or claim (s.17(1)(a)). For a client’s matter, the advocate or firm is the Data Fiduciary and CounselGrid is their Data Processor: we never disclose privileged communications or the contents of an advocate’s file except as the advocate authorises or the law compels, and we route any request about a matter to the advocate or firm. Full detail: Privacy Policy §4.
3. Confidentiality and privilege
- Access controls and tenant isolation are designed to prevent unauthorized access
- Users should configure roles, permissions, and sharing appropriately
- AI outputs must be reviewed, and sensitive data should be handled in line with professional obligations
4. Security and governance
See Security & Trust for an overview of security practices. Enterprise customers may request audit materials and contractual assurances subject to agreement.
5. Data Breach Response
In the event of a data breach that compromises personal data, we will:
- Contain and investigate the breach within 24 hours of detection
- Assess the risk to affected individuals
- Notify the Data Protection Board of India as required under DPDP Act Section 8(6) and the DPDP Rules 2025 (initial intimation without delay and a detailed report within 72 hours of becoming aware)
- Notify affected users if the breach poses a high risk to their rights and freedoms
- Notify enterprise customers within 48 hours per our Data Processing Addendum
- Take remedial measures to prevent recurrence
Reporting Security Issues: If you discover a security vulnerability, please report it responsibly to privacy@counselgrid.com. We will acknowledge receipt within 48 hours and provide updates on remediation.
6. Contact
Compliance & legal: privacy@counselgrid.com
Privacy: privacy@counselgrid.com
Related documents: Terms · Privacy · Acceptable Use · DPA