Understanding CIRP Under IBC 2016: A Creditor’s Strategic Guide

India's digital economy has made personal data one of the most valuable assets for modern businesses. Customer information, employee records, contact databases, financial details and online identifiers are routinely collected and processed. With the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), businesses must now treat data protection as a core legal and governance responsibility, not merely an IT issue. At Legum Solis, our Technology, Data & Privacy practice helps businesses develop legally resilient data governance frameworks and navigate India's evolving privacy regime.

What Is the DPDP Act 2023?

The Digital Personal Data Protection Act, 2023 is India's principal framework for processing digital personal data. It sets out the obligations of organisations that process personal data and recognises the rights of individuals, referred to as Data Principals. Businesses that determine the purpose and means of processing personal data generally fall within the concept of a Data Fiduciary. The important point for businesses is straightforward: if your organisation collects or processes personal data digitally, you should assess your DPDP compliance position now.

What Is the DPDP Compliance Timeline?

The DPDP Act and DPDP Rules follow a phased commencement framework rather than a single compliance deadline. The Rules were notified in November 2025, and their provisions come into force in three stages:

• November 2025 (immediately): The foundational provisions, including definitions and the establishment of the Data Protection Board of India.
• November 2026 (after 12 months): The provisions relating to Consent Managers and their registration.
• May 2027 (after 18 months): The substantive obligations on Data Fiduciaries, including notice, consent, Data Principal rights, security safeguards, breach reporting, children's data and the enforcement and penalty framework.

The phased approach gives businesses time to update their data practices, contracts, privacy notices, security measures and internal processes. It should not be mistaken for permission to postpone compliance planning. A serious compliance programme requires legal, operational and technological changes that cannot be completed overnight, and the Data Protection Board is already in place.

1. Identify What Personal Data Your Business Collects

The first step is a personal data inventory. Businesses should identify:

• What personal data is collected
• Whose data is being collected
• Why the data is being processed
• Where it is stored
• Who can access it
• Which vendors or third parties receive it
• How long it is retained
• When it is deleted

This exercise should cover websites, mobile applications, CRM systems, HR platforms, marketing databases, cloud services and other business applications. Without understanding your data flows, it is difficult to build meaningful DPDP compliance.

2. Review Your Consent Mechanisms

Consent is an important legal basis under the DPDP framework. The Act requires consent to be free, specific, informed and unambiguous, and it provides for the withdrawal of consent. The Act also recognises certain "legitimate uses" for which personal data may be processed without consent, so businesses should map each processing activity to the correct basis rather than assume consent is always required. Businesses should review their existing:

• Website consent banners
• Privacy notices
• App permissions
• Marketing opt-ins
• Customer registration forms
• Employee data processes
• Email and SMS marketing mechanisms

A generic privacy policy copied from another website is unlikely to be an adequate compliance strategy. Your consent architecture should correspond with the way your organisation actually collects and processes personal data. Businesses that handle children's data should also note that the framework requires verifiable parental or guardian consent, subject to the exemptions provided under the Rules.

3. Update Your Privacy Notice

A compliant privacy notice should communicate relevant information to Data Principals in a clear and accessible manner. Businesses should review whether their current privacy policy accurately explains their data-processing activities, their purposes and the mechanisms available to individuals. The policy should also be consistent with the organisation's actual internal practices. A legally sophisticated privacy policy cannot protect a company if its employees, systems and vendors operate differently.

4. Establish Data Principal Rights Processes

The DPDP Act gives individuals various rights concerning their personal data, including rights relating to access to information, correction and erasure, grievance redressal and nomination, subject to the statutory framework. Businesses should establish an internal mechanism for receiving, verifying, tracking and responding to such requests. This means assigning responsibility, creating standard operating procedures and maintaining an auditable record of requests and responses.

5. Strengthen Data Security and Breach Response

Data protection compliance is also a cybersecurity responsibility. The DPDP framework requires Data Fiduciaries to maintain reasonable security safeguards. In the event of a personal data breach, the framework requires notification to the Data Protection Board and to affected Data Principals, within the timelines prescribed under the Rules. Businesses should therefore maintain a documented data breach response plan covering identification, containment, investigation, notification and remediation. Your legal team and your technology and security teams should know their respective responsibilities before an incident occurs.

6. Review Contracts With Vendors and Processors

Many businesses do not directly manage every system in which personal data is stored or processed. Cloud providers, SaaS platforms, payroll companies, CRM providers, marketing agencies and technology vendors may handle personal data on behalf of an organisation. Companies should therefore conduct a data protection contract review covering confidentiality, security safeguards, breach reporting, data use, retention, deletion and allocation of liability. Vendor due diligence should become part of the organisation's broader DPDP compliance programme. Businesses that transfer personal data outside India should also review the applicable cross-border transfer position, as the Act permits transfers subject to such restrictions as the Central Government may notify.

7. Prepare for Higher Compliance Obligations

Certain organisations may be notified as Significant Data Fiduciaries, which brings additional statutory obligations, such as periodic audits and data protection impact assessments. Businesses operating large-scale digital platforms, or processing substantial volumes or sensitive categories of personal data, should monitor regulatory developments closely and assess whether enhanced governance requirements may apply to them.

A Practical DPDP Compliance Checklist

Before the applicable compliance requirements become enforceable for your business, management should ideally have:

• A documented personal-data inventory
• A data-flow map
• Updated privacy notices
• Proper consent mechanisms
• Data-retention and deletion policies
• Data Principal request procedures
• Vendor and processor agreements
• Security safeguards
• Data-breach response procedures
• Employee data-handling protocols
• Internal compliance ownership and accountability
• Periodic legal and technology audits

Why Legal Advice Matters

DPDP compliance is not simply about drafting a privacy policy. It requires alignment between law, technology, contracts, business processes and corporate governance. At Legum Solis, our Technology, Data & Privacy practice advises businesses on DPDP Act compliance, data governance, cybersecurity, incident response, technology contracts and SaaS agreements. Our objective is to help organisations build practical compliance frameworks that withstand regulatory scrutiny while remaining commercially workable.

Frequently Asked Questions

1. What is the DPDP Act 2023? The Digital Personal Data Protection Act, 2023 is India's framework governing the processing of digital personal data. It establishes obligations for Data Fiduciaries and provides rights to individuals, known as Data Principals. 
2. When does the DPDP Act become applicable to businesses? The DPDP Act and DPDP Rules follow a phased commencement framework rather than a single universal deadline. The Data Protection Board provisions are already in force, the Consent Manager provisions follow at 12 months, and the main obligations on Data Fiduciaries apply from May 2027. Businesses should identify which provisions apply to them and plan accordingly. 
3. Who needs to comply with the DPDP Act? Businesses and other organisations that determine the purpose and means of processing digital personal data may qualify as Data Fiduciaries and must comply with the applicable obligations. The framework can also apply to entities outside India that process personal data in connection with offering goods or services to individuals in India. 
4. What are the key DPDP compliance requirements for businesses? Businesses should assess their data inventory, privacy notices, consent mechanisms, Data Principal request procedures, security safeguards, breach response processes and vendor contracts. Compliance should be aligned with the organisation's actual data-processing practices. 
5. What is a Data Fiduciary under the DPDP Act? A Data Fiduciary is a person or organisation that determines the purpose and means of processing personal data. Data Fiduciaries are responsible for complying with the obligations applicable to them under the DPDP Act and Rules. 
6. What happens if a business fails to comply with the DPDP Act? Non-compliance can expose an organisation to regulatory action and significant financial penalties under the Act, which can extend up to ₹250 crore for certain violations such as failure to maintain reasonable security safeguards. Businesses should identify compliance gaps early and implement appropriate legal, technical and organisational measures before the relevant provisions become enforceable.

Conclusion

The DPDP Act 2023 represents a significant shift in how businesses in India must approach personal data. With the DPDP Rules, 2025 notified and the phased enforcement framework moving into operation, businesses should not wait for the final compliance date before beginning implementation. The right approach is proactive: understand your data, identify your legal obligations, fix contractual and operational gaps, strengthen security controls and establish a repeatable privacy governance framework. Legum Solis assists businesses in navigating India's evolving technology and data protection landscape with strategic legal advice tailored to their operational realities.  

Need guidance on DPDP compliance? Whether you are preparing a data inventory, reviewing consent flows or renegotiating vendor contracts, the Technology, Data & Privacy team at Legum Solis can help you evaluate your position and plan your next steps. Get in touch with us to discuss your matter.

India remains one of the world's most attractive destinations for foreign investment, offering opportunities for international businesses, private equity investors, multinational corporations and strategic investors. However, investing in India requires careful attention to sectoral caps, entry routes, pricing norms, reporting requirements and the Foreign Exchange Management Act, 1999 (FEMA). In 2026, India's FDI framework remains liberal across many sectors, while regulated activities continue to carry specific conditions or approval requirements. Recent policy changes, including the liberalisation of the insurance sector, make it important for investors to review the applicable sector-specific rules before structuring a transaction. At Legum Solis, our corporate and transaction advisory practice assists international businesses with FDI structuring, joint ventures, private equity transactions, M&A and regulatory compliance.

What Is FDI in India?

Foreign Direct Investment refers broadly to investment by a person resident outside India into an Indian company or eligible Indian instrument, subject to the applicable FDI Policy, the FEMA framework and sector-specific regulations. India follows two principal routes for FDI:

• Automatic Route: Investment can generally be made without prior Government approval, provided the applicable sectoral cap, conditions and regulatory requirements are satisfied.
• Government Route: Prior approval of the Government is required for sectors or transactions where the applicable policy prescribes the approval route.

The Department for Promotion of Industry and Internal Trade (DPIIT) policy framework permits FDI of up to 100% under the automatic route in many sectors, subject to applicable laws, sectoral conditions and security requirements.

Key Sectoral Updates Investors Should Watch in 2026

The first question for any foreign investor should be: what sector does the Indian target operate in? The answer can determine the applicable foreign ownership limit, the entry route, whether Government approval is required and which sector-specific conditions apply.

Insurance

A significant 2026 update is the increase of the FDI limit in the insurance sector to 100% under the automatic route. This was introduced through DPIIT's Press Note 1 (2026 Series) and given effect under the foreign exchange framework through amendments to the FEMA Non-Debt Instruments Rules. The higher limit applies to insurance companies and specified insurance intermediaries, and it remains subject to approval or verification by the Insurance Regulatory and Development Authority of India (IRDAI). The Life Insurance Corporation of India continues to be subject to a separate 20% cap. Investors should therefore review the updated sector-specific framework rather than rely on older FDI limits.

E-Commerce

The FDI framework continues to distinguish between permitted marketplace activities and inventory-based e-commerce. FDI is not permitted in the inventory-based model, while marketplace activities remain subject to specific conditions.

Other Regulated Sectors

Sectors such as banking, defence, telecom, pension, retail and other regulated activities have their own sectoral caps, entry routes and conditions. Investors should verify the applicable sectoral table before finalising the transaction structure. The key takeaway is simple: a headline FDI percentage is not enough to determine whether an investment is permissible. The sector, investment instrument, ownership structure, entry route and applicable conditions must all be assessed together.

FDI Structuring: The First Legal Decision

Before funds enter India, investors should determine the most appropriate investment structure. Common structures include:

• Acquisition of shares in an existing Indian company
• Subscription to newly issued shares
• Joint ventures with Indian promoters
• Wholly owned subsidiaries
• Strategic investments
• M&A transactions
• Private equity and venture capital investments

The structure should be assessed against sectoral caps, pricing rules, tax implications, corporate law requirements, FEMA regulations, beneficial ownership considerations and exit mechanisms. A poorly structured transaction can create regulatory complications long after the investment has been completed.

Key FEMA Compliance Obligations

FDI compliance does not end when the money reaches the Indian company. Depending on the nature of the transaction, the company must comply with RBI reporting requirements through the prescribed FIRMS framework.

• Issue of shares (Form FC-GPR): An Indian company issuing equity instruments to a non-resident, where the issue is reckoned as FDI, must report it in Form FC-GPR within 30 days of the date of issue. The instruments themselves must generally be issued within 60 days of receiving the consideration, failing which the amount may have to be refunded.
• Transfer of shares (Form FC-TRS): Transfers of equity instruments between a resident and a non-resident are reported in Form FC-TRS within 60 days of the transfer or of the receipt or remittance of funds, whichever is earlier, subject to applicable exemptions.

Late reporting attracts a Late Submission Fee, and failure to report at all can lead to compounding proceedings under FEMA and complications during diligence for future funding rounds.

Pricing and Valuation Requirements

Another critical area is the pricing of shares. Transactions involving the issue or transfer of securities to or from non-residents must comply with the applicable pricing guidelines and valuation requirements. Investors should therefore obtain appropriate valuation advice and ensure that transaction documents, consideration and regulatory filings remain consistent. This is particularly important in FDI transactions, share transfers, rights issues, preferential allotments and M&A structures.

Beneficial Ownership and Government Approval Requirements

Foreign investors must also consider India's beneficial ownership and security-related requirements. Under Press Note 3 (2020), an investment where the investor, or the beneficial owner of the investment, is situated in or is a citizen of a country sharing a land border with India requires Government approval. Certain relaxations have been introduced from time to time, so the current position should be verified for each transaction. Legal due diligence should therefore examine not only the immediate investor but also the ultimate beneficial ownership structure.

Corporate and Post-Investment Compliance

Once the investment is completed, the Indian entity must continue to comply with applicable corporate and foreign exchange regulations. This may include:

• Maintaining statutory registers and corporate records
• Board and shareholder approvals
• ROC filings
• RBI/FEMA reporting
• FLA return requirements
• Maintaining investment documentation
• Compliance with sector-specific licences
• Share transfer documentation
• Monitoring foreign ownership limits
• Compliance with downstream investment rules

RBI guidance also requires eligible Indian entities with outstanding foreign liabilities or assets to submit the Foreign Liabilities and Assets (FLA) return on the RBI's FIRMS portal, generally by 15 July each year.

Why FDI Legal Due Diligence Matters

For a foreign investor, entering India is not simply a question of identifying a promising business opportunity. The legal architecture of the investment determines whether the transaction can be completed efficiently and whether the investment can subsequently be operated, expanded or exited without regulatory obstacles. At Legum Solis, we advise international investors and Indian businesses on FDI structuring, joint ventures, private equity, M&A, shareholder agreements and regulatory compliance. Our cross-border capability is further supported by our association with the GRATA International network, providing access to counsel across multiple jurisdictions.

Frequently Asked Questions

1. What is FDI in India? Foreign Direct Investment (FDI) is investment by a person resident outside India into an Indian company or eligible Indian instrument, subject to the applicable FDI policy, FEMA regulations and sector-specific requirements.
2. What is the difference between the Automatic Route and the Government Route for FDI? Under the Automatic Route, eligible foreign investment can generally be made without prior Government approval, subject to applicable conditions. Under the Government Route, prior approval is required before investing.
3. What are the key FDI compliance requirements in India? Key requirements include complying with sectoral caps and entry routes, pricing and valuation rules, FEMA regulations, beneficial ownership requirements and the prescribed RBI reporting obligations.
4. What are the major FDI sectoral updates in 2026? A significant development is the increase of the FDI limit in insurance to 100% under the automatic route, subject to IRDAI approval or verification and other applicable conditions. Other regulated sectors continue to have their own caps, entry routes and requirements.
5. What FEMA filings are required for FDI in India? Depending on the transaction, filings may include Form FC-GPR for the issue of eligible equity instruments to non-residents (within 30 days of issue) and Form FC-TRS for applicable transfers between residents and non-residents (within 60 days). Other reporting requirements, such as the annual FLA return, may also apply.
6. Why is legal due diligence important for foreign investors in India? Legal due diligence helps identify sectoral restrictions, approval requirements, FEMA obligations, ownership issues, pricing requirements and potential regulatory risks before an investment is completed. This helps investors structure transactions effectively and avoid compliance problems.

Conclusion

FDI in India in 2026 continues to offer opportunities across manufacturing, technology, services, infrastructure and other sectors. However, sector-specific caps, entry routes, Government approvals, FEMA requirements, pricing norms, beneficial ownership rules and reporting obligations can significantly affect how an investment should be structured. For foreign investors, reviewing these requirements before committing funds helps reduce regulatory risk and avoid costly compliance issues later. Legum Solis advises domestic and international clients on FDI structuring, cross-border transactions, M&A and India's evolving corporate and regulatory framework.

Planning an investment into India?

Whether you are structuring an acquisition, setting up a joint venture or reviewing FEMA compliance for an existing investment, the Corporate & Transaction Advisory team at Legum Solis can help you evaluate your position and plan your next steps. Get in touch with us to discuss your matter.The trade mark is among the most commercially valuable assets a business can own. In the physical world, infringement was visible — a counterfeit product on a shelf, a misleading sign on a storefront. In the digital age, infringement is faster, more diffuse, and often harder to trace. This has not diminished the importance of trade mark protection; it has made the strategy for protecting marks more demanding. This article addresses the key challenges of digital trade mark protection and the approaches that generate results.

Registration First: The Non-Negotiable Foundation

No digital enforcement strategy substitutes for a valid registered trade mark. Registration under the Trade Marks Act, 1999 confers the exclusive right to use the mark in relation to the registered goods and services, and establishes a rebuttable presumption of validity. Without registration, a brand owner must rely on the common law action of passing off — which requires proof of reputation, misrepresentation, and damage in each enforcement action. In the digital context, registration should extend to:

• Word marks (the brand name itself, and common variants)
• Device marks (logos, wordmarks with stylisation)
• Colour marks where the colour has acquired distinctiveness
• Domain-adjacent registrations across Classes 35, 38, and 42 for online businesses

International registration via the Madrid Protocol system is essential for brands operating across markets. India became a member of the Madrid Protocol in 2013, enabling Indian brand owners to file in 130+ jurisdictions through a single application managed by the Trade Marks Registry.

Domain Name Disputes

Domain name hijacking — the registration of a domain that is identical or confusingly similar to a trade mark, typically with the intent to sell it back to the mark owner or to divert commercial traffic — is among the most common digital trade mark issues. The Uniform Domain Name Dispute Resolution Policy (UDRP), administered by WIPO, provides an efficient mechanism for recovering such domains without litigation. To succeed under UDRP, a complainant must establish:

• That the domain is identical or confusingly similar to a trade mark in which the complainant has rights
• That the registrant has no rights or legitimate interests in the domain
• That the domain was registered and is being used in bad faith

Indian courts have also shown willingness to grant interim injunctions against domain squatters in appropriate cases, particularly where the domain is being used to host a competing or fraudulent website.

Social Media Infringement

Brand impersonation on social media platforms — fake accounts using a brand's logo and name to deceive consumers — creates both reputational damage and consumer protection liability. The major platforms (Meta, Instagram, X, LinkedIn) operate trade mark reporting portals that, when used correctly, result in swift takedown of infringing accounts. Where infringement is systematic — for instance, a network of fake accounts operated by the same entity — platform takedowns must be supplemented with legal proceedings. Courts have in recent years passed ex parte injunctions restraining infringers from operating social media accounts bearing infringing marks, with liberty to execute against newly created accounts without requiring fresh orders.

E-Commerce Marketplace Enforcement

Counterfeit goods sold through e-commerce marketplaces represent a significant challenge for brand owners. The major platforms (Amazon, Flipkart, Meesho, Myntra) operate brand protection programmes that enable registered trade mark owners to identify and report infringing listings for expedited removal. Enrolment in these programmes — Amazon Brand Registry, Flipkart Brand Alliance — should be a standard step in any digital brand protection strategy. However, reliance on platform mechanisms alone is insufficient against organised counterfeit networks. Forensic investigation, test purchases, and coordinated enforcement actions — including raids under the Code of Criminal Procedure — are required for durable results.

Building Your Digital Protection Stack

• Register your mark in all relevant classes and jurisdictions
• Register your primary domain in all major TLDs (.com, .in, .co.in)
• Enrol in platform brand protection programmes
• Set up monitoring for new domain registrations containing your mark (services like Corsearch or MarkMonitor)
• Monitor social media for impersonation and product review manipulation
• Engage enforcement counsel capable of coordinating platform takedowns, UDRP proceedings, and court actions

Trade mark protection in the digital age is not a one-time exercise. It is an ongoing programme that requires regular monitoring, rapid response, and the capacity to escalate from administrative to judicial enforcement when platform mechanisms are insufficient.When a commercial dispute arises, the choice of forum is rarely a neutral decision. It shapes the timeline, the cost, the privacy of proceedings, the enforceability of the outcome, and — in ways that are harder to quantify — the tenor of the commercial relationship during and after the dispute. Making this choice intelligently requires understanding what each forum actually delivers, not what the received wisdom about it suggests.

The Case for Arbitration

Arbitration under the Arbitration and Conciliation Act, 1996 (as amended) has become the dominant dispute resolution mechanism for sophisticated commercial contracts in India. The reasons are well-documented:

• Confidentiality: Arbitral proceedings are private. Unlike court litigation — where pleadings are public record — arbitration allows parties to resolve disputes without public disclosure of commercial information, internal processes, or financial details.
• Party autonomy: Parties choose their arbitrators, their seat, their governing rules (institutional or ad hoc), and their procedural timeline. This control is unavailable in court.
• International enforceability: An arbitral award is enforceable in over 170 countries under the New York Convention. A court decree requires bilateral enforcement treaties that India has with only a handful of jurisdictions.
• Finality: The grounds for challenge to an arbitral award under Section 34 of the Act are narrow. A court cannot re-examine the merits of the dispute. An award, once rendered, is durable.

"The right arbitration clause in a contract is worth more than the right to litigate after a dispute arises."

The Limitations of Arbitration

Arbitration is not uniformly superior. Its limitations are real and material in certain contexts:

• Cost: Institutional arbitration before reputed bodies (ICC, SIAC, DIAC, MCIA) involves significant institutional fees, arbitrator fees, and counsel costs. For disputes below ₹5 crore, court litigation may be more cost-effective.
• Interim relief: While courts have broad powers to grant interim relief in support of arbitration under Section 9, the ability to obtain emergency interim measures without triggering the arbitral process can be procedurally complex.
• Multi-party disputes: Consolidation of related disputes involving non-parties to the arbitration agreement is difficult. Complex multi-party commercial disputes may be better resolved through court proceedings where intervention and joinder are more readily available.
• Criminal elements: Disputes involving fraud, forgery, or other criminal dimensions require parallel criminal proceedings. Arbitration cannot substitute for the coercive machinery of criminal law.

The Case for Court Litigation

Indian courts — particularly the High Courts and the Commercial Courts established under the Commercial Courts Act, 2015 — offer capabilities that arbitration cannot replicate:

• Interim relief: Courts have power to grant ex parte ad interim injunctions, attachment before judgment, and appointment of court receivers — powerful tools in disputes where asset preservation is critical
• Precedent: Where a party seeks a determination of legal principle that will govern future dealings — not just the immediate dispute — court judgments create precedent. Arbitral awards do not.
• Cost: For smaller disputes, court fees and the commercial court framework offer a more cost-proportionate forum
• Insolvency intersection: Disputes involving insolvent entities must ultimately be adjudicated before the NCLT, making arbitration of limited utility in those contexts

Getting the Arbitration Clause Right

The arbitration clause is where most disputes are lost before they begin. A poorly drafted clause can result in:

• Uncertainty about the seat and governing law
• Inability to appoint arbitrators without court intervention
• Ambiguity about the scope of disputes covered
• Reference to defunct or non-existent arbitral institutions

A model institutional arbitration clause specifies: the institution (e.g., MCIA, DIAC, ICC), the seat of arbitration, the number of arbitrators, the language of proceedings, and the governing law. For international contracts, the choice of Singapore (SIAC) or Dubai (DIAC) as seat offers enforceability advantages over domestic seats when enforcement abroad is anticipated. At Legum Solis, our disputes practice regularly advises on dispute resolution clause drafting as a preventive measure — not merely as counsel after a dispute has arisen. The cost of a well-drafted clause is trivially small. The cost of a defective one can be the dispute itself.When the Insolvency and Bankruptcy Code (Amendment) Ordinance, 2021 introduced the Pre-Packaged Insolvency Resolution Process (PPIRP), it represented the most significant structural innovation to the IBC framework since the Code's original enactment. Designed exclusively for micro, small, and medium enterprises (MSMEs), PPIRP promised a faster, cheaper, and less disruptive insolvency process — one that preserved management continuity while offering creditors a structured resolution pathway. Four years since its introduction, what does the evidence tell us? And where does the framework still fall short?

The PPIRP Framework: What It Was Designed to Do

PPIRP is a debtor-in-possession mechanism — the promoters and management of the MSME remain in control of the entity during the resolution process, unlike CIRP where the RP displaces management on the commencement date. The process begins before the NCLT is even approached: creditors must approve the base resolution plan submitted by the debtor before the PPIRP application is filed. The timeline is aggressive: PPIRP must be completed within 120 days from commencement, compared to 330 days under CIRP. The cost architecture is correspondingly leaner — the debtor's management continues operations, reducing the overhead of an appointed RP running the entity.

Eligibility: The MSME Constraint

PPIRP is available only to corporate debtors classified as MSMEs under the MSMED Act. This means:

• Manufacturing enterprises with investment up to ₹50 crore and turnover up to ₹250 crore
• Service enterprises with investment up to ₹50 crore and turnover up to ₹250 crore

Eligibility must be established at the time of filing. A corporate debtor that has outgrown MSME classification — or that has uncertain registration status — cannot access PPIRP. The MSME registration requirement is a hard condition, not a procedural formality.

What Works

The debtor-in-possession architecture is PPIRP's most significant practical advantage. In a CIRP, the replacement of management creates disruption to operations, client relationships, and institutional knowledge that often destroys enterprise value before any resolution plan can be approved. Under PPIRP, continuity of management mitigates this risk substantially. The pre-negotiation requirement — that a base plan be agreed with creditors holding 66% of total financial debt before PPIRP commences — means that the NCLT process can be swift. If the pre-pack plan has already been negotiated, the 120-day window is often more than sufficient.

Where the Framework Falls Short

Despite its structural logic, PPIRP has seen limited uptake in practice. Several factors explain this:

• Creditor coordination: Obtaining 66% creditor consent for the base plan before commencement requires a level of coordination among lenders — often including multiple banks — that is difficult in practice, particularly where creditors have divergent interests
• Debtor reluctance: MSMEs are often promoter-driven businesses where the personal reputation and assets of the promoter are intertwined with the company. Promoters are reluctant to initiate insolvency proceedings even in a debtor-in-possession format, fearing reputational damage and lender scrutiny
• Operational creditor exclusion: Operational creditors have no role in PPIRP — they are not included in the pre-pack plan negotiation and have limited recourse to challenge an approved plan. This creates fairness concerns that have not been fully resolved
• Regulatory uncertainty: Several provisions — including the scope of the moratorium and the treatment of personal guarantees during PPIRP — remain areas of interpretive uncertainty pending further judicial clarification

The Path Forward

PPIRP has the right structural instincts — debtor control, pre-negotiation, speed, cost efficiency — but requires refinement to achieve the uptake its designers intended. Recommendations from the Insolvency Law Committee (ILC) and the IBBI have pointed to enhanced creditor coordination mechanisms, broader awareness among MSMEs and their lenders, and greater judicial familiarity with the process as the key to unlocking PPIRP's potential. For MSMEs facing genuine financial stress, PPIRP remains a genuinely superior option to CIRP in cases where early engagement with creditors is possible. The window for that engagement — before a creditor files a CIRP application — is the critical one. Waiting for a creditor to act removes the debtor-in-possession advantage entirely. Our insolvency team regularly advises MSME promoters and lenders on PPIRP eligibility, base plan structuring, and the coordination mechanics required to make the process work. Early legal advice — before the first creditor default notice — is almost always more effective than crisis counsel.The enforcement landscape for white-collar crime in India has shifted materially over the last three years. The Enforcement Directorate (ED), the Central Bureau of Investigation (CBI), and the Serious Fraud Investigation Office (SFIO) have all expanded their investigative capacity, sharpened their use of digital forensics, and — critically — increased the pace at which they refer cases for prosecution. For businesses and their boards, what was once an abstract risk has become an operational one. This article maps the key enforcement trends and their implications for corporate compliance.

The PMLA: From Margin to Centre

The Prevention of Money Laundering Act, 2002 has become the central instrument of financial crime enforcement in India. Its reach is vast: the list of scheduled offences — the predicate crimes whose proceeds the PMLA targets — now encompasses over 150 offences, including fraud, corruption, cybercrime, tax evasion, and violations of the Companies Act. The ED's attachment powers under Section 5 of the PMLA allow it to provisionally attach property — including bank accounts, fixed assets, and real estate — suspected to represent proceeds of crime, without prior judicial approval. The burden of proving that attached property does not represent proceeds of crime then falls on the person whose property is attached. This reversal of the burden of proof, upheld by the Supreme Court in Vijay Madanlal Choudhary v. Union of India (2022), has made PMLA attachment an extraordinarily powerful investigative tool.

SFIO: The Corporate Investigation Arm

The Serious Fraud Investigation Office has expanded its mandate aggressively under the Companies Act, 2013. SFIO investigations are now triggered not only by Ministry of Corporate Affairs references but also by NCLT orders — meaning that CIRP proceedings against a corporate debtor can simultaneously trigger an SFIO inquiry into the conduct of the debtor's former management. Importantly, Section 212(11) of the Companies Act provides that once an SFIO investigation is ordered, no other investigating agency can investigate the same offence without SFIO approval. This consolidation of investigative authority has accelerated SFIO's operational relevance.

Digital Forensics and the Changed Evidence Landscape

Investigative agencies have dramatically upgraded their digital forensic capabilities. Email communications, messaging platform records, mobile device extractions, and cloud storage data are now routinely obtained through search and seizure operations or through compelled production orders. The assumption that digital communications are private — or that informal channels like WhatsApp are outside the reach of law enforcement — is operationally wrong. For compliance teams, this has direct implications for document retention policies, internal communication practices, and the handling of sensitive decisions. A culture in which consequential business decisions are made verbally and never documented — a practice that was once thought to reduce legal exposure — now creates a different risk: the appearance of concealment when investigators find the outcome but not the deliberation.

Cross-Border Enforcement Cooperation

The ED, CBI, and SFIO have strengthened their cooperation with foreign enforcement agencies through mutual legal assistance treaties (MLATs) and direct agency-to-agency channels. Assets parked in UAE, Singapore, and UK jurisdictions — once thought relatively insulated from Indian enforcement — have been successfully traced, frozen, and repatriated in several high-profile cases over the last two years. The practical implication: a purely domestic enforcement response to a cross-border investigation is inadequate. Counsel must have both domestic and international enforcement experience and must be capable of coordinating across jurisdictions.

Board-Level Responsibilities and the Director's Dilemma

The tightening of white-collar enforcement has elevated the legal exposure of company directors — including independent directors — who may be summoned for questioning, named in enforcement complaints, or have their passports impounded during investigations. The "I was not aware" defence has been progressively eroded by judicial decisions holding that wilful blindness and negligent oversight can constitute the requisite mens rea for certain offences. Directors should ensure:

• Board minutes accurately reflect deliberation and dissent on significant decisions
• Related-party transactions are approved through proper processes with independent director concurrence
• Material information is not withheld from the board through selective presentation by management
• A direct reporting line to the board exists for the Chief Compliance Officer that bypasses operating management
• Access to independent legal counsel is available at board level — not merely through company counsel who is accountable to management

White-collar defence is one of the most demanding areas of legal practice — it requires the integration of criminal law knowledge, corporate governance expertise, and investigative sophistication. Our disputes and white-collar practice advises boards, audit committees, and individuals under investigation, providing both strategic advice and active representation in enforcement proceedings.A shareholders agreement (SHA) is the constitutional document of a privately held company — more important, in many respects, than the articles of association, because it governs the relationship between shareholders in ways that the articles cannot. A poorly drafted SHA is a deferred dispute: the omissions and ambiguities that seemed unimportant at closing become battlegrounds when investor expectations and promoter decisions diverge. This article identifies ten provisions that appear in every well-drafted SHA and the specific risks that each provision addresses.

1. Reserved Matters and Affirmative Voting Rights

Reserved matters are decisions that require the consent of a specified shareholder (typically the investor) regardless of board or majority shareholder approval. Common reserved matters include: approval of annual budgets above a threshold, incurrence of debt above a specified limit, changes to the company's business, related-party transactions, and changes to capital structure. Without reserved matters, a majority shareholder can bind the company to decisions that materially affect the investor's position without any recourse. The scope of reserved matters should be calibrated to the investor's concern — too narrow, and the protection is illusory; too broad, and it creates operational paralysis.

2. Tag-Along Rights

A tag-along right requires that if a promoter proposes to sell shares to a third party, the investor must be offered the right to sell a proportionate number of their shares on the same terms and conditions. This prevents a scenario where promoters realise liquidity through a sale while minority shareholders are left behind in a company whose dynamics have fundamentally changed.

3. Drag-Along Rights

The mirror image of tag-along: a drag-along right allows a majority shareholder (or a shareholder above a specified threshold) to compel minority shareholders to sell their shares in a third-party acquisition on the same terms. This is essential for investors and promoters seeking a clean exit — a strategic acquirer will invariably require 100% of the share capital, and a minority shareholder who refuses to sell can hold the entire deal hostage.

4. Anti-Dilution Rights

Anti-dilution provisions protect an investor from the economic impact of a subsequent equity issuance at a lower valuation (a "down round"). Broad-based weighted average anti-dilution is the market standard: it adjusts the investor's conversion price based on a formula that takes into account both the price and the volume of the new issuance, moderating the adjustment relative to full-ratchet anti-dilution (which resets the conversion price to the new round price regardless of volume).

5. Liquidation Preference

A liquidation preference entitles an investor, in the event of a liquidation, dissolution, or deemed liquidation (including a sale or merger of the company), to receive a specified return on their investment before any proceeds are distributed to ordinary shareholders. A 1x non-participating preference — the investor gets back their invested amount and no more — is protective without being punitive. A participating preference — the investor gets their preference back and then participates pro rata in any remaining proceeds — can be economically severe for founders in lower-valuation exits.

6. Right of First Refusal (ROFR)

A ROFR requires that before any shareholder sells shares to a third party, they must first offer those shares to the other shareholders (or the company) at the same price and on the same terms. This keeps ownership within the existing shareholder group and prevents the introduction of unwanted third parties without consent.

7. Deadlock Resolution

Deadlock — where shareholders with equal voting power cannot agree on a material decision — is one of the most disruptive events in a privately held company. Well-drafted SHAs provide a structured resolution mechanism: a multi-step escalation to senior management, followed by mediation, followed — if all else fails — by a buy-sell (Russian Roulette) provision under which one party names a price at which they will buy the other out, and the other party must either accept the sale or buy at that price. Russian Roulette is a blunt instrument and should be a mechanism of last resort — but its presence in the SHA creates a powerful incentive to resolve disputes through earlier steps before it is invoked.

8. Non-Compete and Non-Solicitation

Promoters and key founders should be bound by non-compete and non-solicitation covenants during their association with the company and for a defined period post-exit. Under Indian law, Section 27 of the Contract Act makes post-employment non-compete clauses potentially unenforceable as restraints of trade, depending on scope and duration. Careful drafting — limiting the geographic scope, activity scope, and duration — is essential to maximise enforceability.

9. Information Rights and Reporting Obligations

Investors require timely, accurate information about the company's financial position to manage their portfolio and discharge their fiduciary duties. A well-drafted SHA specifies: monthly management accounts (within a specified number of days of month-end), quarterly audited or reviewed financials, annual audited accounts, and prompt notification of material developments. Information rights should survive a shareholder's exit for the period during which they retain any residual rights under the SHA.

10. Governing Law and Dispute Resolution

The governing law and dispute resolution clause is frequently the last to be negotiated and the first to matter when a dispute arises. For SHAs involving international investors, the choice of Singapore law and SIAC arbitration is common — it provides a neutral forum, sophisticated arbitrators with expertise in corporate disputes, and an award enforceable under the New York Convention in over 170 jurisdictions. For domestic SHAs, the seat of arbitration, the number of arbitrators, and the institution should be specified with particularity. A well-drafted SHA arbitration clause can mean the difference between a dispute resolved in eighteen months and one that lingers in court for a decade. Our corporate practice has advised founders, venture capital funds, and strategic investors on shareholders agreement negotiation and drafting across sectors. If you are in the process of raising capital or structuring a joint venture, we welcome the opportunity to advise on the SHA — before the term sheet is signed, not after it is.