Frequently Asked Questions
My SaaS agreement names Bengaluru courts exclusively. Is that enforceable?
Generally yes, provided Bengaluru has some connection to the transaction which it does where the vendor operates from here. Parties cannot confer jurisdiction where none exists, but they can narrow a choice between forums that both have it. Filing elsewhere in the face of such a clause invites a return of the plaint under Order VII Rule 10.
Are liability caps and liquidated damages clauses enforceable?
A cap on liability is generally upheld between commercial parties. A liquidated damages figure is recoverable only up to reasonable compensation for loss actually suffered, under Section 74 of the Contract Act the stipulated sum is a ceiling, not an entitlement, and the claimant must still show loss. Drafting the clause as a genuine pre-estimate, with the basis recorded, materially improves its prospects.
Can I compel the other side to perform rather than just claim damages?
More readily than before. The 2018 amendment to the Specific Relief Act made specific performance the general rule rather than a discretionary remedy, and introduced substituted performance the option to have the work done by a third party at the defaulting party's cost, on notice. Both changed the calculus in services and development contracts significantly.
Who owns work product created by a contractor?
Not automatically the client. Copyright in a commissioned work vests in the author unless there is a written assignment complying with Section 19 of the Copyright Act, and an oral understanding or a purchase order reference will not do. Every contractor and consultant agreement should carry an express present assignment, not an agreement to assign later.
The board has removed me as a founder. What is available?
Two tracks, usually run together. Contractual claims under the shareholders' agreement — vesting, reserved matters, board composition — go to arbitration if the agreement so provides. Claims that the affairs of the company are being conducted oppressively go to the NCLT under Sections 241 and 242, which arbitration cannot displace. Which track carries the real relief depends on whether you want your shares or your seat.
Where does an appeal from NCLT Bengaluru go?
To the NCLAT bench at Chennai, not New Delhi. Karnataka falls within the southern appellate jurisdiction, which surprises founders and investors who assume all company appeals converge on Delhi. It affects counsel selection and cost, and should be settled before the first petition is drafted.
An investor is threatening a criminal complaint over a failed round. Is that sustainable?
Not merely because the company failed. A missed milestone or a breach of a subscription agreement is a civil wrong; cheating requires dishonest intention at the inception of the transaction. Where the complaint re-pleads a contractual dispute, quashing before the Karnataka High Court is the response, run alongside protection under Section 482 BNSS.
Is angel tax still a concern for a Bengaluru round?
No. Section 56(2)(viib) was abolished with effect from assessment year 2025-26, removing the premium-valuation charge for all classes of investor, resident and non-resident alike. Valuation reports remain relevant for FEMA pricing on foreign investment and for transfer pricing, but the angel tax exposure that shaped so many earlier rounds is gone
We want to move our holding company from Singapore or Delaware back to India. How does that work?
Through an inbound cross-border merger under Section 234 of the Companies Act read with the FEMA Cross Border Merger Regulations, 2018, sanctioned by the NCLT. Compliance with those Regulations carries deemed RBI approval, which removes a step that used to dominate the timeline. Expect nine to eighteen months in practice, and model the tax cost carefully that, rather than the process, is usually what decides whether it happens.
Why are so many Bengaluru companies redomiciling to India now?
Chiefly to list here. A domestic listing requires an Indian holding company, and the route has become materially more navigable since the 2018 Regulations. The trade-offs are the tax charge on the merger, the loss of a familiar governing law for the investor documents, and a rewrite of the entire cap table and ESOP pool all of which should be scoped before the board commits.
Does investment from a Chinese or Hong Kong investor need approval?
Yes. Press Note 3 requires prior government approval for any investment where the investor is situated in, or the beneficial owner is a citizen of, a country sharing a land border with India. Beneficial ownership is the operative test, so a fund domiciled in Singapore or Mauritius does not by itself resolve the question the ownership chain has to be traced.
We are setting up a subsidiary abroad from Bengaluru. What governs that?
The FEMA Overseas Investment Rules and Regulations, 2022, which replaced the earlier framework and clarified several long-standing grey areas, including round-tripping. Investment in a foreign entity that in turn holds an Indian entity is now permitted within limits and structure conditions, which matters for any group planning to retain both an Indian and an overseas parent.
When does DPDP actually start to bite?
It already has, in part. The Rules were notified on 13.11.2025 with a phased eighteen-month runway, and the Data Protection Board is operational now and taking complaints. Consent Manager registration opens around November 2026, and the substantive obligations consent architecture, notices, data principal rights, breach protocols all land on 13.05.2027. No grace period beyond that has been signalled.
What is the actual exposure if we get this wrong?
Penalties run to Rs. 250 crore per breach category and stack across categories, so a single incident can generate cumulative exposure well beyond that figure. The categories that matter most for a product company are failure to take reasonable security safeguards, failure to notify a breach, and failure to meet obligations relating to children's data.
Does DPDP apply to a Bengaluru company whose customers are all overseas?
Largely not, on its own terms the Act reaches processing outside India only where it connects to offering goods or services to data principals within India. But the obligation usually arrives through the contract instead: a foreign controller subject to GDPR or a similar regime will flow processor commitments down, and an Indian vendor is bound by those regardless of whether DPDP applies directly.
How do the CERT-In and DPDP breach obligations interact?
They are separate regimes with separate clocks and both apply. CERT-In Directions require reporting of specified cyber incidents within six hours of noticing them, while DPDP requires notification to the Board and to affected data principals on its own timeline. An incident response plan that addresses only one of the two will fail the other.