.png)
How Do You Protect IP and Trade Secrets When Hiring in India?
Section 27 of the Indian Contract Act, 1872 voids any agreement that restrains a person from working in a lawful profession or trade. That means the standard non compete clause most global companies paste into an Indian contract is unenforceable the moment it's signed. We see CTOs discover this mid negotiation more often than you'd expect. If your core asset is code, models, or proprietary architecture, learning how to protect IP and trade secrets when hiring in India is a design decision, not a paperwork exercise. It has to be made before a single offer letter goes out, and it needs to hold up across contract hiring, full time hiring, and every hybrid model in between.
Why IP Risk Looks Different When You Protect Trade Secrets and IP While Hiring in India
India does not have one standalone trade secrets law. Unlike the US Defend Trade Secrets Act or the EU Trade Secrets Directive, protection here is built from contract law, the common law doctrine of confidence, and provisions inside the Copyright Act, 1957 and the Information Technology Act, 2000. Courts uphold confidentiality obligations through precedent, not statute, and remedies usually come as injunctions rather than fixed statutory damages. This is exactly why companies that want to protect IP and trade secrets when hiring in India need contract language that does more work than a template can do on its own.
This changes how a CTO needs to think. Bengaluru and Hyderabad, where we place the largest share of senior backend, ML, and platform engineers, have matured enough that most engineers have signed multiple confidentiality agreements before and know what they're agreeing to. That's a good sign for the ecosystem. It also means a generic NDA copied from a US template, referencing a US statute, has no legal standing in an Indian court and tells a sharp candidate that your company hasn't done its homework.
We once worked with a European fintech building a fraud detection model whose US counsel had drafted an NDA around the Uniform Trade Secrets Act. That clause had zero weight in India. The real fix meant rebuilding the confidentiality terms around Section 27's narrow carve outs, plus a separate IP assignment clause under the Copyright Act, so code ownership vested in the company automatically instead of needing sign off on every commit.
There's a second, quieter risk. A large share of Indian tech hiring, especially at mid to senior levels, happens through contract hiring rather than direct full time employment. If your IP terms only exist inside a full time contract, and half your technical team is engaged through vendors on short term arrangements, you likely have gaps nobody has flagged yet. During onboarding audits we regularly find contractors from two or three different agencies working in the same repository under three different, or missing, IP assignment terms.
Contract Hiring vs Full Time Hiring: What Changes for IP Protection
This distinction matters more than most companies realize. Under full time employment, Section 17 of the Copyright Act gives the employer default ownership of work created during the job, so IP mostly transfers automatically. Under contract hiring, that default does not apply. Copyright in a contractor's work stays with the contractor unless it's assigned in writing. This is the single most common gap AnjuSmriti Global finds when auditing client contracts: companies assume contractor IP behaves like employee IP, and it simply doesn't.
Full time hiring gives you cleaner default IP protection but slower onboarding and higher long term cost. Contract hiring gives you speed and flexibility, which is why it's become the default entry point for companies testing India before setting up a full entity, but it demands an explicit, separately signed IP assignment document every time.
Most experienced technical leaders now run a blended model: contract to hire for early stage roles, converting to full time once the role and the person are proven, with IP assignment terms that stay consistent across both stages rather than resetting at conversion.
Which Indian Engineers Handle IP Sensitive Work Well, and Where the Gaps Are
Bengaluru and Pune have the deepest bench for IP sensitive senior roles: architecture level backend engineers, ML engineers who've worked on proprietary pipelines, and platform engineers from regulated sectors like fintech and healthtech. Both cities have a high concentration of engineers who came up through global product companies rather than pure services firms, where access control and code review discipline were already part of daily work.
Hyderabad follows closely, particularly for cloud and enterprise data engineering.
What these engineers bring: comfort with layered NDAs, familiarity with least privilege access models, and a working understanding of why confidentiality matters in a globally connected industry. What they often lack, particularly candidates from pure services backgrounds, is intuition about why a clause exists rather than just that it exists. They may not think twice about pasting a code snippet into a public forum to debug it, because no one ever explained that this counts as disclosure.
We test for this directly, using a scenario based confidentiality assessment built around real, anonymized situations, evaluated on how the candidate reasons through them rather than whether they can recite the NDA. This single step has caught more genuine risk than any legal document review we've run.
Which Indian Laws Actually Protect IP and Trade Secrets
Because India has no single trade secrets statute, protection comes from three overlapping instruments, and missing any one leaves a gap the others can't close.
First, the contract itself, under the Indian Contract Act, 1872. Confidentiality clauses need to name specific categories of protected information rather than use catch all language, since Indian courts enforce narrow, specific obligations more reliably than sweeping ones. Non solicitation terms tied to specific clients or defined confidential information generally hold up. Blanket non compete language does not.
Second, IP assignment under the Copyright Act, 1957. As covered above, employee IP vests with the employer by default under Section 17. Contractor IP does not, and needs a standalone written assignment.
Third, data protection under the Digital Personal Data Protection Act, 2023 and the IT Act, 2000, relevant whenever your trade secrets include customer or user data processed by an India based team. A common mistake: companies bring on an employer of record for payroll and compliance, then forget the EOR, not the client company, is technically the legal employer. Without a direct IP assignment agreement between the engineer and the client company, alongside the EOR contract, there's a gap in who actually owns the work.
A Quick Reference Framework for IP Protection
Layer | What It Covers | Common Gap We Find |
Contractual | Specific confidentiality clause, Section 27 compliant non solicit, Copyright Act §17 assignment | Contractor agreements missing explicit IP assignment |
Technical access | Least privilege repo access, gated environments, review before merge to sensitive branches | Contractors given full access before vetting completes |
Onboarding | Scenario based confidentiality training, device and BYOD policy | Training reduced to a signature on page four of an offer letter |
Vendor chain of custody | Direct IP assignment between engineer and client even under EOR or vendor contracts | IP assignment wrongly assumed to flow through the EOR |
Offboarding | Same day access revocation, exit interview, device wipe confirmation | Access revoked days after departure |
Data compliance | DPDPA 2023 and IT Act 2000 mapping for any customer data touched | GDPR style clauses copied over without India specific mapping |
The row that trips up the most CTOs is vendor chain of custody. Companies scaling through bulk hiring or building a Global Capability Centers (GCC) in India often have engineers on three or four different contractual arrangements at once, and each one needs its own IP assignment paper trail. There is no single umbrella document that covers all of them automatically.
Our Process and What Almost Went Wrong on One Mandate
Our process for an IP sensitive mandate runs across four stages: role and risk scoping over two to three days, technical vetting including the confidentiality scenario assessment over five to seven days, legal review running in parallel over three to five days, and staged access onboarding across the first two weeks rather than granting everything on day one.
That staged step exists because of a mandate that nearly went wrong. A Series B European healthtech company engaged us to hire four backend engineers in Bengaluru for a patient data risk scoring engine, IP sitting close to their core product. Under sprint pressure, the client wanted full production database access for all four engineers on day one, before IP assignment paperwork for one contract to hire engineer had been countersigned.
We held the line on staged access. During that gap, the client's own legal team found that the original contractor template, borrowed from a UK hire, had no Copyright Act §17 compliant assignment language at all. All four engineers were fully onboarded within two weeks, and the client shipped on schedule with clean IP ownership confirmed.
What This Costs
IP protection isn't a separate budget line. It's built into how the hire is structured, and cost differences mostly show up in legal review time and access tooling, not salary.
Mid level backend or ML engineers, three to five years experience, run roughly INR 18 to 28 lakh per annum on direct contract, or 2,400 to 3,800 USD monthly all in through an EOR including employer contributions and platform fee. Senior engineers or tech leads, six to nine years, run roughly INR 32 to 48 lakh per annum, or 4,200 to 6,000 USD monthly. Principal or architecture level talent, ten plus years, runs roughly INR 55 to 85 lakh per annum, or 7,200 to 11,000 USD monthly.
EOR fees typically run eight to twelve percent of gross salary above employer contributions. What clients usually reinvest the savings into is the access control and legal review layer described above, since a proper DPDPA compliant data audit costs a fraction of what a single IP dispute in an Indian court would cost.
Conclusion
AI assisted due diligence is becoming standard practice for technical vetting, with clients asking for automated code provenance checks alongside human review before an engineer gets repo access. Cloud native teams and global capability centers are also pushing IP frameworks to cover multi cloud environments rather than a single vendor stack, and DPDPA implementation rules are tightening data handling obligations for any India based team touching EU or US customer data. In live mandates today, more fintech and healthtech clients are asking us to build data compliance readiness into onboarding from day one instead of retrofitting it later.
If you want to protect IP and trade secrets when hiring in India, the direction is clear: build it as infrastructure once, correctly, rather than patching it after something goes wrong.
Ready to build an IP protection framework into your India hiring plan from day one? Talk to our team.
Interesting Reads:
FAQs
1.Does a non compete clause work for engineers hired in India?
Rarely in the broad form most companies expect. Section 27 of the Indian Contract Act voids agreements restraining someone from working in an industry after leaving. What holds up instead is a narrow non solicitation clause tied to specific clients or defined confidential information for a limited, reasonable period. A blanket "cannot work for a competitor" clause offers no real protection in India.
2.Who owns the code when an engineer is hired through an EOR?
This depends entirely on documentation. Copyright defaults to the employer under Section 17 of the Copyright Act, but the EOR, not your company, is the legal employer of record. Without a separate direct IP assignment agreement between the engineer and your company, you may not have clean legal title to the code they write.
3.Does contractor work automatically belong to the hiring company in India?
No. Contractor work product stays with the contractor by default under Indian copyright law, unlike employee work which vests automatically. Any contract hiring arrangement needs an explicit written IP assignment clause covering all deliverables. A confidentiality clause alone does not transfer ownership, and treating the two as interchangeable is a common and costly mistake.
4.Is there a dedicated trade secrets law in India?
No standalone statute exists, unlike the US or EU. Protection comes from a mix of the Indian Contract Act, the common law doctrine of confidence, and relevant Copyright Act and IT Act provisions. Courts grant relief mainly through injunctions based on precedent rather than statutory damages, which makes precise, specific contract drafting far more important than in jurisdictions with codified trade secrets law.
5.How does the DPDPA affect confidentiality contracts in India?
If your protected information includes customer or user data handled by an India based team, the Digital Personal Data Protection Act, 2023 adds a separate compliance layer covering how that data is collected, stored, and transferred. GDPR style clauses copied over without mapping to DPDPA requirements often leave gaps as implementation rules continue tightening, so building this into onboarding early is worth the effort.
6.Which Indian cities have the strongest talent for IP sensitive roles?
Bengaluru and Pune lead, largely because both have a high density of engineers from global product companies rather than pure services firms, where access discipline is already part of daily practice. Hyderabad follows closely for cloud and enterprise data roles. Engineers from services heavy backgrounds often know the paperwork but need more testing on practical confidentiality judgment.
7.Should access be granted immediately or staged during onboarding?
Staged access is safer and is our standard recommendation. Repo access can typically follow initial vetting and signed confidentiality terms, but production database access, especially involving customer data, should wait until all IP assignment paperwork is fully countersigned, not just started. Gaps in documentation are far cheaper to catch during this window than after full access is already live.
8.Can a company sue an Indian engineer directly for an IP breach if hired through a vendor?
Only if the contract structure supports it. If your only relationship runs through an EOR or staffing vendor, direct legal standing against the individual engineer may be limited. A separate direct confidentiality and IP assignment agreement between your company and the engineer, even under an EOR arrangement, gives you clearer standing and a faster path to injunctive relief if something goes wrong.
Comments