A Digital Product Is Not One Asset. It Is a Stack of Rights Across Five Regimes.

Founders describe their product as “the platform” or “the app”, as though it were a single thing that a single filing could protect. Legally it is nothing of the sort.

A working SaaS product typically contains: source code protected as a literary work, interface graphics protected as an artistic work, written content protected as a literary work, a database protected only to the extent of its selection and arrangement, an algorithm that copyright does not protect at all, a brand name that only trademark law protects, a domain governed by dispute policies rather than statute, and customer data governed by data protection law rather than IP law.

Each of these sits in a different regime, is owned under a different default rule, and is enforced by a different route. Protecting one and assuming the rest are covered is the most common and most expensive mistake in Indian technology businesses.

---

The Rights Map

---

SOFTWARE

What copyright does and does not do

Section 2(o) of the Copyright Act, 1957 expressly includes computer programmes within the definition of a literary work. Copyright therefore protects your source code and object code as written expression.

It does not protect:

• What the software does — its functionality
• The algorithm or method underlying it
• The logic, structure or workflow, at the level of abstraction
• The idea for the product

A competitor who studies your product, understands what it does, and writes entirely their own code to do the same thing has not infringed your copyright. This is not a loophole. It is the fundamental boundary of copyright, and it is why code copyright alone is never a sufficient IP strategy for a software business.

Section 14 also gives the owner of a computer programme an additional right the other literary works do not have — the right to sell or give on commercial rental any copy of the programme.

Patents and Section 3(k)

Section 3(k) of the Patents Act, 1970 excludes from patentability “a mathematical or business method or a computer programme per se or algorithms.”

The words “per se” carry the entire question. Indian practice, guided by the Guidelines for Examination of Computer Related Inventions, has accepted that an invention is not excluded merely because it is implemented in software, where the claimed invention demonstrates a genuine technical effect or technical advancement rather than being a computer programme as such. Claims that read as pure business methods, pure algorithms or software untethered from any technical contribution are refused.

Practical position: most Indian SaaS and application businesses will not obtain patent protection, and should not build a strategy around the expectation of it. Where there is a genuine technical contribution — signal processing, hardware interaction, network efficiency, a novel technical architecture — patentability is worth assessing on the specific claims. It is a specialist exercise, not a default filing.

Trade secrets: where the real protection sits

India has no dedicated trade secrets statute. Protection comes from the law of confidence, from contract, and from the practical measures you actually implement.

For most software businesses, the algorithm, the model weights, the pricing logic, the training data, the architecture and the customer list are more valuable than the code, and none of them is protected by registration. They are protected by:

• Confidentiality agreements with employees, contractors, vendors and prospects
• Access control — least-privilege, logging, and revocation on exit
• Classification — marking what is confidential, because unmarked material is hard to enforce
• Onboarding and exit processes — signed acknowledgements, device return, access revocation, exit interviews recorded
• Contractual restrictions that are enforceable in India

On that last point: Section 27 of the Indian Contract Act, 1872 makes agreements in restraint of trade void, and post-employment non-compete clauses are generally unenforceable in India. What is enforceable is a properly drafted confidentiality obligation, protection of trade secrets, and in appropriate cases non-solicitation. Employment contracts that rely on a broad non-compete and neglect the confidentiality clause are protecting nothing.

Registering software copyright

Registration is voluntary but worth doing for the core codebase, because Section 48 makes the Register prima facie evidence. The Copyright Office requires the source code to be filed — commonly the first and last ten pages, or the entire code where it runs to fewer than twenty pages — filed without blocked-out portions.

Practical points:

• Register major versions, not every commit
• Where confidentiality of the whole codebase is a concern, discuss the extent of filing before you begin
• Keep version control history intact — it is close to definitive evidence of authorship and date, and often more useful in a dispute than the registration itself

---

WEBSITES

A website is the clearest example of the layered-rights problem, and the ownership of each layer is frequently different.

The typical Indian business owns almost none of its own website. It paid an agency, received a login, and never obtained an assignment. When it later tries to move to a new agency, sell the business, or stop a copycat site, the ownership gap surfaces.

The legal document layer

Separately from IP, a website carries a compliance layer that most sites either omit or copy from a competitor — which is itself copyright infringement of the competitor’s documents.

• Terms of Use — the contract governing access, acceptable use, IP ownership, disclaimers, limitation of liability, governing law and jurisdiction
• Privacy Policy — mandatory in substance for any site collecting personal data
• Cookie notice and consent, where tracking is used
• Refund, shipping and cancellation policies for e-commerce
• User-generated content policy and takedown mechanism, where users post content
• Grievance officer details and complaint mechanism, where the platform is an intermediary
• Disclaimers appropriate to the sector — and, for law firms and certain regulated professions, advertising restrictions must be observed

Under the Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, an intermediary’s safe harbour under Section 79 is conditional on observing prescribed due diligence, which includes publishing its rules, privacy policy and user agreement, appointing a grievance officer and observing defined response timelines.

The Digital Personal Data Protection Act, 2023 establishes India’s consent-based data protection framework, with obligations on data fiduciaries regarding notice, consent, purpose limitation, security safeguards and breach reporting, and significant financial penalties for contravention. Implementation is being phased in through rules, and current obligations should be confirmed against the position in force at the time of compliance.

---

MOBILE APPLICATIONS

An app carries every layer a website does, plus:

• App name and icon — trademark and copyright; note that app store listings are a common route for imitators and each store has an IP takedown mechanism
• Screen designs and icons — copyright as artistic works; registration under the Designs Act, 2000 for screen displays and icons is available in principle under the Locarno classification, though Indian Registry practice in this area has been restrictive and is evolving
• APIs and SDKs — governed by their own licence terms, which must be read before integration
• Third-party libraries — see open source below
• Permissions and data collection — DPDP Act and platform policy compliance
• In-app content — separate copyright layers

---

DATA AND DATABASES

This is where Indian law is weaker than founders assume.

There is no sui generis database right in India. Unlike the European Union, India does not confer a standalone right in a database merely because it took investment to compile. A database is protected as a compilation under Section 2(o), but only to the extent of originality in the selection and arrangement of its contents. The underlying facts and data are not protected.

The consequences:

• A competitor who independently compiles the same facts has not infringed
• Scraping your public data may not be a copyright infringement at all
• Your protection has to come from contract — terms of use prohibiting scraping and bulk extraction — from technical measures, and from the Information Technology Act, 2000, where unauthorised access or downloading is involved

Section 43 of the IT Act provides for compensation where a person, without permission of the owner, accesses a computer system, downloads or extracts data, introduces a contaminant, damages, disrupts or denies access. Section 66 makes such acts committed dishonestly or fraudulently a criminal offence.

A practical enforcement technique worth mentioning: seeded data. Deliberate, harmless, unique entries planted in a database are the single most effective proof of bulk copying, because their presence in a competitor’s dataset cannot be explained by independent compilation.

---

DIGITAL CONTENT

Courses, videos, ebooks, templates, music, photographs and downloadable resources.

• Copyright subsists automatically; registration of the substantial anchor assets is worth the cost
• Technological protection measures and rights management information carry their own statutory backing: Section 65A of the Copyright Act penalises circumvention of an effective technological measure applied to protect a right, and Section 65B penalises knowing removal or alteration of rights management information — each punishable with imprisonment up to two years and fine
• Platform takedown routes exist for every major distribution channel and should be used at scale rather than case by case
• Dynamic injunctions, developed by the Delhi High Court in the rogue-website line of cases, allow mirror sites and variants to be added to a blocking order without fresh proceedings — the appropriate remedy where content is redistributed through changing channels

---

OWNERSHIP: THE PROBLEM THAT DEFEATS EVERYTHING ELSE

Every protection strategy on this page fails if the company does not own the asset.

The rules that decide it

Section 17(c) of the Copyright Act — a work made in the course of employment under a contract of service belongs to the employer. This covers salaried employees.

It does not cover contractors, freelancers, agencies or consultants, who work under a contract for services and remain first owners of what they create — regardless of who paid, who briefed, and who approved.

Section 17(b) — a photograph, painting, portrait, engraving or cinematograph film made at the instance of any person for valuable consideration belongs to that person. Note what is absent from that list: code, written content, logos and illustrations. Commissioning them does not transfer ownership.

Section 19 — an assignment must be in writing, signed, and must specify the work, the rights, the duration, the territory and the consideration. If duration is not specified it is five years. If territory is not specified it is India only. If the assignee does not exercise the rights within one year, the assignment in respect of those rights is deemed to have lapsed.

What this means in a typical startup

The founder pre-incorporation gap is the one that kills funding rounds. Code written by the founders before the company existed belongs to them personally. It must be assigned to the company by a written deed. Diligence teams look for this specifically.

The documents every technology business should actually have

• Employment agreements with IP assignment, confidentiality and, where appropriate, non-solicitation — not an unenforceable non-compete
• Contractor and agency agreements with a Section 19 compliant assignment specifying perpetual duration and worldwide territory
• Founder IP assignment deeds transferring all pre-incorporation work to the company
• NDAs for vendors, prospects, investors and pilots
• Intern and consultant agreements
• Open source policy and a maintained dependency inventory
• Terms of Use, Privacy Policy and platform policies, drafted rather than copied
• Software escrow agreements, where enterprise customers require continuity assurance
• SaaS agreements, EULAs and SLAs, with the licence scope, data ownership and IP ownership expressly stated

---

OPEN SOURCE: THE RISK NOBODY BUDGETS FOR

Open source is not free of obligation. It is licensed code with conditions, and the conditions vary sharply.

Permissive licences — MIT, BSD, Apache 2.0 — generally require attribution and notice retention, and Apache 2.0 additionally addresses patent grants. These are commercially low risk when complied with.

Copyleft licences — GPL, AGPL and similar — require that derivative works be distributed under the same terms, including making corresponding source available. AGPL extends the obligation to software provided over a network, which is precisely the SaaS model.

The commercial consequence is direct: a proprietary product that incorporates strongly copyleft code, in a way that makes the product a derivative work, may face an obligation to release its own source. This is discovered during due diligence, not before, and it can reduce or destroy the value of the transaction.

What to do:

• Maintain a software bill of materials — a current inventory of every dependency and its licence
• Adopt a written open source policy setting out which licence categories are approved, which require review, and which are prohibited
• Run licence scanning in the build pipeline
• Preserve attribution and notice files in distributions
• Obtain legal review before incorporating any copyleft-licensed component into a distributed or network-served product

---

CRIMINAL AND DIGITAL REMEDIES

Beyond copyright, the Information Technology Act, 2000 provides remedies that are frequently more effective against insider theft and hacking than copyright proceedings.

Section 65 is the provision to know when a departing engineer takes or deletes the source code. It addresses conduct that copyright law handles awkwardly, and it carries criminal consequences.

Alongside these, the copyright remedies apply — civil suit under Section 55, with jurisdiction available where the plaintiff carries on business under Section 62, ex parte injunctions, Local Commissioner appointments under Order 26 CPC for imaging devices and servers, and criminal liability under Section 63 and specifically under Section 63B for knowing use of an infringing copy of a computer programme.

---

What to Actually File — A Practical Checklist

---

Mistakes We Are Regularly Asked to Fix

1. No assignment from the development agency — the company does not own its own product
2. Founder pre-incorporation code never assigned to the company, discovered during diligence
3. Employment contracts with an unenforceable non-compete and a weak or absent confidentiality clause
4. Copyleft-licensed components embedded in a proprietary SaaS product, discovered at acquisition
5. Assuming a patent will protect a software product that is a computer programme per se
6. Assuming the database is protected because it took investment to build
7. Terms of Use and Privacy Policy copied from a competitor — non-compliant, and itself infringing
8. Registering the trademark but not the code, or the code but not the trademark
9. Disclosing an invention publicly before assessing patentability, destroying novelty
10. No software bill of materials, so licence exposure is unknown
11. No exit process for departing engineers, so access and code leave with them
12. Relying on copyright alone for functionality that copyright has never protected

---

How Delhi Legal Company Protects Digital Assets

• IP audit — mapping every layer of the product to its correct regime, and identifying who actually owns each one
• Chain of title repair — founder assignment deeds, employee and contractor agreements with Section 19 compliant assignments, and NDAs
• Registrations — copyright for code and content, trademark for the product and brand, design registration where the interface warrants it, and patentability assessment where there is a genuine technical contribution
• Open source review — dependency and licence analysis, written open source policy, and remediation advice before a transaction
• Contracts — SaaS agreements, EULAs, SLAs, escrow, API and reseller terms, development and outsourcing agreements
• Compliance layer — Terms of Use, Privacy Policy, intermediary due diligence under the IT Rules, 2021, and DPDP Act readiness
• Enforcement — takedowns, notices, civil suits with ex parte relief and Local Commissioner appointments, criminal complaints under the Copyright Act and the IT Act, and domain recovery through INDRP and UDRP

---

Frequently Asked Questions (FAQs)

1. Is software protected by copyright in India?

A. Yes. Section 2(o) of the Copyright Act, 1957 expressly includes computer programmes within the definition of a literary work, so source code and object code are protected automatically on creation. Registration is voluntary but useful, because Section 48 makes the Register prima facie evidence.

2. Does copyright protect what my software does?

A. No. Copyright protects the code as written expression, not the functionality, the algorithm, the logic or the idea. A competitor who studies your product and independently writes their own code to achieve the same result has not infringed your copyright.

3. Can I patent my software in India?

A. Only in limited circumstances. Section 3(k) of the Patents Act, 1970 excludes mathematical methods, business methods, algorithms and computer programmes per se. Where the claimed invention shows a genuine technical effect or technical advancement beyond the programme as such, patentability may be arguable, but it requires a specialist assessment of the claims rather than a default filing.

4. How do I protect my algorithm then?

A. As a trade secret, through confidentiality agreements, access control, classification of confidential material and disciplined onboarding and exit processes. India has no dedicated trade secrets statute, so protection comes from contract and the law of confidence, which makes the quality of your documentation and your internal controls decisive.

5. Are non-compete clauses enforceable in India?

A. Post-employment non-competes are generally unenforceable, because Section 27 of the Indian Contract Act, 1872 makes agreements in restraint of trade void. What is enforceable is a properly drafted confidentiality obligation protecting trade secrets, and in appropriate circumstances a non-solicitation clause. Contracts that rely on a broad non-compete and neglect confidentiality are protecting very little.

6. My agency built our website and app. Do we own it?

A. Almost certainly not, unless there is a written assignment complying with Section 19. Section 17(c) makes the employer the first owner only where the work was created by an employee under a contract of service. An agency or freelancer works under a contract for services and remains the first owner regardless of payment.

7. What must a valid IP assignment contain?

A. Under Section 19 it must be in writing, signed by the assignor, and must specify the work, the rights assigned, the duration, the territorial extent and the consideration. If duration is not stated it is deemed to be five years; if territory is not stated it is deemed to be India only; and if the rights are not exercised within one year the assignment in respect of them is deemed to have lapsed.

8. I wrote the code before incorporating the company. Is that a problem?

A. Yes, and it is one of the most common findings in startup due diligence. Work created before the company existed belongs to you personally. It must be transferred to the company by a written founder assignment deed, and investors will ask for it.

9. Is my database protected in India?

A. Only partially. India has no sui generis database right. A database is protected as a compilation under Section 2(o), but only to the extent of originality in the selection and arrangement of its contents. The underlying facts and data are not protected, so protection must come from your terms of use, technical measures and the IT Act.

10. Someone is scraping data from my website. What can I do?

A. Copyright may not assist if the material is facts and data. The practical routes are breach of your terms of use, and the Information Technology Act — Section 43 provides for compensation where a person without permission accesses a system or downloads or extracts data, and Section 66 makes such conduct done dishonestly or fraudulently a criminal offence. Seeded unique entries in the dataset are the most effective proof of bulk copying.

11. What are the risks of using open source code?

A. Open source is licensed code with conditions. Permissive licences such as MIT, BSD and Apache 2.0 generally require attribution and notice retention. Copyleft licences such as GPL and AGPL can require derivative works to be released under the same terms, and AGPL extends that obligation to software delivered over a network — which directly affects SaaS products. This is routinely discovered during acquisition diligence rather than before.

12. What should our open source policy include?

A. A maintained software bill of materials listing every dependency and its licence, a written policy classifying licences as approved, review-required or prohibited, automated licence scanning in the build pipeline, retention of attribution and notice files in distributions, and mandatory legal review before any copyleft-licensed component is incorporated into a distributed or network-served product.

13. Can I register the design of my app screens or icons?

A. Registration of screen displays and icons is available in principle under the Designs Act, 2000 through the Locarno classification, though Indian Registry practice in this area has been restrictive and is evolving. Copyright protection as artistic works applies in any event, and trademark protection may be available for a distinctive icon used as a badge of origin.

14. A departing engineer took our source code. What are the remedies?

A. Alongside copyright remedies, Section 65 of the Information Technology Act, 2000 penalises knowingly or intentionally concealing, destroying or altering computer source code required to be kept, with imprisonment up to three years or fine up to ₹2,00,000 or both. Sections 43 and 66 address unauthorised access, downloading and extraction. A civil suit with an application for appointment of a Local Commissioner to image devices and servers is often the most effective immediate step.

15. A competitor is using pirated copies of our software. Is that a criminal offence?

A. Yes. Section 63B of the Copyright Act specifically penalises knowing use of an infringing copy of a computer programme, with imprisonment of seven days to three years and fine of ₹50,000 to ₹2,00,000. It reaches corporate end-users, not only distributors, and the usual sequence is notice, licence audit and conversion to paid licensing.

16. Someone has cloned our website. What is the fastest route?

A. Capture the evidence first with notarised screenshots and archived captures, then file a host and registrar abuse complaint and search engine removal request, and issue a notice. Where the copying extends to the logo and brand name, plead trademark alongside copyright, and consider domain recovery through INDRP for .in domains or UDRP for generic extensions.

17. Can I copy a Terms of Use or Privacy Policy from another website?

A. No, on two grounds. Those documents are literary works and copying them is copyright infringement. More practically, they are drafted for another business’s model, jurisdiction, data flows and risk profile, and a policy that does not describe what you actually do provides no protection and creates compliance exposure.

18. What legal documents does a website need?

A. At minimum Terms of Use, a Privacy Policy, and cookie disclosure where tracking is used. E-commerce sites need refund, shipping and cancellation policies. Platforms hosting user content need a content policy, a takedown mechanism and grievance officer details, and intermediaries must observe the due diligence requirements under the IT Rules, 2021 to retain safe harbour under Section 79.

19. What does the DPDP Act mean for my website or app?

A. The Digital Personal Data Protection Act, 2023 establishes a consent-based framework with obligations on data fiduciaries regarding notice, consent, purpose limitation, security safeguards and breach reporting, backed by significant financial penalties. Implementation is being phased in through rules, and the obligations in force at the time of your compliance exercise should be confirmed rather than assumed.

20. Do I need software escrow?

A. Enterprise and government customers frequently require it, and it can be a condition of the deal. An escrow agreement deposits the source code with a neutral third party for release to the customer on defined trigger events such as insolvency or a failure to support, giving continuity assurance without transferring ownership.

21. Who owns the AI-generated code my team used an assistant to produce?

A. This is an unsettled area. Section 2(d)(vi) of the Copyright Act defines the author of a computer-generated work as the person who causes the work to be created, but its application to modern AI systems is evolving in India and internationally, and the tool’s own terms of use may allocate rights. The practical approach is to allocate ownership expressly by contract, keep records of human contribution, and review the terms of any tool used in production code.

22. Should I register copyright for every version of my software?

A. No. Register major versions and significant releases. Continuous registration of every build is disproportionate, and your version control history provides strong evidence of authorship and dates in any event.

23. What trademark classes should a software business file in?

A. Typically Class 9 for downloadable software and applications and Class 42 for software as a service, platform services, development and IT consultancy. Class 35 is added where the platform provides business, advertising or marketplace services, and Class 41 where training or content is offered.

24. Our product is being copied but the code is different. Do we have a claim?

A. Under copyright, probably not, because copyright does not protect functionality. Consider whether the interface graphics have been copied, whether the brand name or get-up creates confusion supporting a trademark or passing off claim, whether confidential information was misused by a former employee or contractor, and whether any patentable technical contribution exists.

25. We are raising funding. What IP will diligence ask for?

A. Founder assignment deeds for pre-incorporation work, employment and contractor agreements with IP clauses, the open source dependency and licence inventory, trademark and copyright registrations, domain ownership records, third-party licences for libraries, fonts and stock assets, customer contract IP clauses, and confirmation that no copyleft obligation attaches to the distributed product.

26. What does Delhi Legal Company charge for a digital IP audit?

A. It depends on the size of the codebase, the number of contributors and vendors, and whether remediation documents are required. We quote in writing, and the audit typically pays for itself by identifying ownership gaps before an investor or acquirer finds them.