Legal, Regulatory & Contractual Requirements Register

Legislation checked · 26 June 2026 Not yet advocate-reviewed Execution steps not yet documented

Drafted by:: Lekha editorial team
Version:: v0.1
Last checked against current law:: 15 May 2026
Next scheduled review:: 15 November 2026

Statutory sources (4)

Digital Personal Data Protection Act, 2023Official statuteofficial source
Indian Contract Act, 1872Official statuteofficial source
Code of Civil Procedure, 1908Official statuteofficial source
Arbitration and Conciliation Act, 1996Official statuteofficial source

These badges show which checks this document has passed. They are not a judgment of whether it is legally valid or right for your situation — for a high-stakes matter, have an advocate review it →

After you download

Fill every [BRACKETED PLACEHOLDER] before signing — open the downloaded file and search for "[" to catch any you missed.
Check stamp duty for your state — many Indian documents are only enforceable on adequate stamp paper or e-stamp; the amount varies by state and document type.
Sign as required — check whether the document needs witnesses, and whether all parties must initial each page.
Check registration — some documents (e.g. certain leases, gift deeds) must be registered with the Sub-Registrar to be fully effective.
Keep signed originals safe and give every party a copy; note any filing, renewal, or compliance deadlines the document creates.

Generic checklist — document-specific stamping and filing steps for this template are being documented.

Generate a Legal, Regulatory & Contractual Requirements Register for India, free. A living register of the legal, statutory, regulatory and contractual requirements the organisation must meet, aligned with ISO/IEC 27001:2022 controls A.5.31–A.5.34. India-first coverage of the DPDP Act 2023, IT Act 2000 with CERT-In Directions, Copyright Act 1957, and sectoral rules, plus GDPR where operating abroad. Fill a guided online form and download as PDF or DOCX — no signup, no watermark, no cost.

✅ Free, no signup

Generate and download with no account and no payment.

⬇ DOCX & PDF

Download as PDF / DOCX.

🇮🇳 India-first

Follows Indian legal conventions and state rules.

Frequently asked questions

Is the Legal, Regulatory & Contractual Requirements Register free to use?

Yes. Lekha is completely free — generate and download your Legal, Regulatory & Contractual Requirements Register with no payment and no account required.

What format do I get?

You can download the Legal, Regulatory & Contractual Requirements Register as PDF, DOCX.

Is this Legal, Regulatory & Contractual Requirements Register valid in India?

The template follows India legal conventions. For high-stakes matters, have it reviewed by a qualified lawyer — Lekha lists verified advocates for free.

Organisation details

Organisation / company name *

Next review date

Approved by (name)

Approved by (role)

2 required fields left.

📋

Template verified May 2026 — checked against applicable central Acts and current state rules. Legal requirements can change; for property transactions above ₹5 lakh, employment disputes, or business agreements above ₹10 lakh, have a lawyer review it before signing →. Run Lekha Audit on any document you receive →

Attachments

Keep your letterhead, logo, or supporting documents handy while you fill the form. To analyse a document with AI, use Lekha Audit above.

Click or drag files here

Letterhead (PNG/JPG), Logo, PDFs — max 5 MB each

Live preview

0 of 2 essentials added — almost there · +5 optional

Compliance Framework Alignment

ISO/IEC 27001:2022 — A.5.31 Legal, statutory, regulatory and contractual requirements
ISO/IEC 27001:2022 — A.5.32 Intellectual property rights
ISO/IEC 27001:2022 — A.5.33 Protection of records
ISO/IEC 27001:2022 — A.5.34 Privacy and protection of PII
Digital Personal Data Protection Act, 2023 (India)
Information Technology Act, 2000 & CERT-In Directions, April 2022 (India)
Copyright Act, 1957 (India)

This register is the single, maintained source that identifies and tracks the requirements the organisation is obliged to meet. It is a working template to support an ISO/IEC 27001 information security management system — not a substitute for advice from a qualified advocate or company secretary. Verify each entry against the version of the law in force at your review date.

ISO/IEC 27001:2022 — Controls A.5.31 to A.5.34

Effective Date: [Effective Date]
Next Review Date: [Review Date]
Register Owner: ()
Operating Footprint: General / SaaS / IT services
Data Role: Data Fiduciary (DPDP Act)

1. Purpose

This Register records the legal, statutory, regulatory and contractual requirements relevant to information security and data protection that ("the Organisation") is bound to satisfy. It exists to make those obligations explicit, assign accountability for each, and evidence to auditors, customers and regulators that requirements are identified, understood and kept current. It supports ISO/IEC 27001:2022 control A.5.31, which requires such requirements to be identified, documented and kept up to date for each information system and for the Organisation as a whole.

2. Scope

This Register applies to all information assets, systems, services and processing activities operated by the Organisation, whether hosted on-premise, in the cloud, or by a third party on its behalf. It covers requirements arising under Indian law by default and, where the Organisation processes data of individuals located abroad, the applicable foreign requirements. Contractual requirements imposed by customers, vendors and partners are recorded alongside statutory ones because they carry equivalent binding force.

3. How This Register Is Maintained

The Register is owned by , , who is accountable for its accuracy. Each entry names a requirement, its legal or contractual source, why it applies to the Organisation (applicability), how the Organisation meets it, the accountable owner, and the date the entry is next due for review. Entries are reviewed on the schedule at Clause 9 and whenever a triggering event occurs, so that superseded, amended or newly-enacted requirements are reflected without delay.

4. Privacy and Protection of Personal Data (A.5.34)

The Organisation acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. In support of control A.5.34, the requirements governing the collection, processing, storage, cross-border transfer and erasure of personal data — and the rights of Data Principals — are captured in the Register below with a named owner. Where the Organisation processes data of individuals located abroad, the corresponding privacy requirements are recorded and satisfied in parallel.

5. Protection of Records (A.5.33)

In support of control A.5.33, records that must be retained to meet a legal, regulatory, contractual or evidentiary need are protected against loss, destruction, falsification, unauthorised access and unauthorised release, for the retention period the applicable law prescribes. The Organisation's default retention period is 8 year(s), overridden where a specific statute (for example tax, company-law or sectoral rules) sets a longer or shorter period. Retention periods, storage media and disposal methods are documented so that records remain readable and usable throughout their required life.

6. Intellectual Property Rights (A.5.32)

In support of control A.5.32, the Organisation respects the intellectual property rights of others and protects its own. Open-source and third-party licensed software is inventoried, and each component's licence terms (for example attribution, copyleft and redistribution obligations) are tracked so the Organisation stays within them. Copyright in software, documentation and creative works is governed by the Copyright Act, 1957; software is expressly protected as a "literary work" under that Act. The Register records the obligations arising from licences the Organisation both grants and holds.

7. Applicable Requirements — Register

The table below is the operative record of applicable requirements. Each row states the requirement, its source, why it applies, how it is met, the accountable owner, and the next review date. Owners and review dates in square brackets are to be completed by the Organisation.

Requirement	Source	Applicability	How Met	Owner	Next Review
Lawful processing of personal data; consent, notice, purpose limitation and Data Principal rights (access, correction, erasure, grievance redressal)	Digital Personal Data Protection Act, 2023	Applies — Organisation is a Data Fiduciary	Consent-and-notice flows, purpose-limited processing, rights-request handling, and a grievance officer; DPA terms with processors	[DPO / Compliance]	[review date]
Personal data breach notification to the Data Protection Board and to affected Data Principals	Digital Personal Data Protection Act, 2023 (breach notification duty)	Applies — Data Fiduciary must notify	Documented incident-response runbook that triggers Board and Data-Principal notification on a personal-data breach	[DPO / Security]	[review date]
Reasonable security practices and procedures for protecting information systems and data	Information Technology Act, 2000	Applies — Organisation operates computer resources in India	Documented ISMS aligned with ISO/IEC 27001; access control, encryption and monitoring baselines	[CISO]	[review date]
Report specified cyber security incidents to CERT-In within 6 hours of detection; retain logs for 180 days; sync clocks to NPL/NIC	CERT-In Directions under s.70B(6), IT Act, 2000 (April 2022)	Applies — Organisation operates in India / serves Indian users	6-hour incident-reporting procedure to CERT-In, 180-day log retention, and time-synchronised systems	[Security / IT Ops]	[review date]
Retain and protect statutory records (accounting, tax, company-law and employment records) for the prescribed period; default retention 8 year(s)	Companies Act 2013; Income-tax Act 1961; applicable labour statutes	Applies — Organisation is a registered entity with employees	Records retention schedule with protected, tamper-evident storage and controlled, logged disposal	[Finance / HR / Legal]	[review date]
Comply with software copyright and open-source / third-party licence terms (attribution, copyleft, redistribution)	Copyright Act, 1957	Applies — Organisation develops and/or uses software	Software Bill of Materials; licence-obligation register; use restricted to licensed entitlements	[Engineering / Legal]	[review date]
Customer- and vendor-imposed security obligations: breach-notification windows, audit rights, data localisation, sub-processor and certification terms	Customer agreements, Data Processing Agreements, vendor contracts, NDAs	Applies — Organisation is party to such contracts	Contract-obligation tracker feeding this Register; DPAs with all processors; certification upkeep	[Legal / Account Mgmt]	[review date]

8. Contractual Requirements

Beyond statute, the Organisation is bound by information-security and data-protection terms in its customer agreements, Data Processing Agreements, vendor contracts and non-disclosure agreements. Each material contractual obligation — for example a customer-mandated breach-notification window, an audit right, a data-localisation term, a certification commitment (such as maintaining ISO/IEC 27001), or a sub-processor restriction — is logged as a Register entry with the same six attributes, so that a promise made in a contract is tracked with the same rigour as a legal duty.

9. Review and Update

This Register is reviewed at least annually and additionally on the occurrence of any of the following: enactment, amendment or repeal of a relevant law or rule (for example commencement of the DPDP Rules or a revised CERT-In direction); a new or amended customer or vendor contract with security obligations; entry into a new market or jurisdiction; a significant change to systems or processing activities; or a finding from an audit, incident or regulator. The next scheduled review date is [Review Date]. Horizon-scanning for forthcoming legal change is part of each review so obligations are prepared for before they take effect.

10. Accountability and Non-Compliance

The named owner of each entry is accountable for keeping the Organisation compliant with that requirement and for evidencing compliance on request. The Register owner escalates any gap, lapsed control or missed review to management. Non-compliance can carry serious consequences — for example, monetary penalties under the DPDP Act, 2023, offences under the Information Technology Act, 2000, and civil or criminal liability for infringement under the Copyright Act, 1957 — in addition to breach of contract and loss of certification. Identified gaps are logged, risk-rated and remediated on a tracked plan.

This Register has been reviewed and approved by the management of and is effective from [Effective Date]. It is a controlled document and supersedes all prior versions.

__GAP[lrr_approver_role|CEO / Managing Director]__

Maintained by — __GAP[lrr_owner_role|Compliance Officer / DPO]__

Connected legal intelligence

Everything on Lekha that relates to this document — the clauses inside it, what to do next, the law to learn, and the risks to watch. Educational, not legal advice.

Clauses inside, explained

Data protection (DPDP)Definition of Confidential Information Indemnity Governing law & jurisdiction

Full clause library →

Acts this document touches

Trace each Act to the clauses and other templates connected to it.

Digital Personal Data Protection Act, 2023 Indian Contract Act, 1872 Code of Civil Procedure, 1908 Arbitration and Conciliation Act, 1996

Common risks to watch

Data protection (DPDP). Allocates responsibilities for handling personal data under Indian law.
Definition of Confidential Information. Defines exactly what information the recipient must keep secret.
Indemnity. Allocates who bears the cost if a third party brings a claim.
Governing law & jurisdiction. Fixes which State's courts and which body of law decide any dispute under the document.

Learn the law

🛡️ DPDP Act 2023 & Indian Privacy LawEverything a startup, SME, or CA needs to know about India's new data law

📖 GuidesDPDP Act 2023: what every Indian website now needs →

Applicable compliance

Track these in your organisation's compliance register.

DPDP Act 2023 readiness

Published privacy policy

Open compliance register →

Related templates

Vendor DPA Information Security Policy HIPAA Security Rule Policy HIPAA Notice of Privacy Practices (NPP)HIPAA Business Associate Agreement (BAA)HIPAA Breach Notification Policy

🤖 Ask Vidhi about this documentor use the ✨ Ask AI bubble on any page.

Legal, Regulatory & Contractual Requirements Register

After you download

Frequently asked questions

Organisation details

📎Attachments

Connected legal intelligence

⚖️ Clauses inside, explained

🏛️ Acts this document touches

⚠️ Common risks to watch

📚 Learn the law

✅ Applicable compliance

📄 Related templates