Share the matter file. keep privilege and control attached

The Bar Council of India's Standards of Professional Conduct and Etiquette, framed under the Advocates Act, 1961, provide at Rule 17 of the section on an advocate's duty to the client that an advocate shall not, directly or indirectly, commit a breach of the obligations imposed by Section 126 of the Indian Evidence Act. The Council's own summary of the same duty states that an advocate should not by any means, directly or indirectly, disclose the communications made by his client to him. The cross-referenced Evidence Act section has since been replaced by the Bharatiya Sakshya Adhiniyam, 2023, so the professional-conduct duty now reads across to that Act.

Section 132(1) of the Bharatiya Sakshya Adhiniyam, 2023, notified as Act No. 47 of 2023 in the Gazette of India of 25 December 2023, provides that no advocate shall at any time be permitted, unless with his client's express consent, to disclose any communication made to him in the course and for the purpose of his service as such advocate. The Explanation records that the obligation continues after the service has ceased, and sub-section (3) extends it to interpreters, clerks, and employees of advocates. Section 134 protects confidential communications with a legal adviser from compelled disclosure. Provisos exclude communications made in furtherance of any illegal purpose.

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to protect personal data in its possession or under its control, including processing carried out on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. The Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of that obligation, as determined by the Board. Matter files routinely carry client, witness, employee, and counterparty personal data.

Section 17(1) of the same Act exempts specified processing from most of Chapter II, including at clause (a) processing necessary for enforcing any legal right or claim, at clause (b) processing by any court or tribunal or other body entrusted by law with a judicial, quasi-judicial, regulatory, or supervisory function where that processing is necessary for the performance of the function, and at clause (c) processing in the interest of prevention, detection, investigation, or prosecution of an offence or contravention of law. The exemption is expressed to leave Sections 8(1) and 8(5) applicable, so the security-safeguards duty is not switched off by litigation or investigation work.

The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate, and Government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice about them. Annexure I expressly includes unauthorised access of IT systems or data, data breach, and data leak, which is the category a compromised matter repository or mailbox falls into.

Article 32 of Regulation (EU) 2016/679 requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and names pseudonymisation and encryption of personal data among them. Article 83(4) places infringements of Article 32 in the tier of administrative fines up to 10 million euro, or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. This reaches an Indian adviser through European client, employee, and counterparty data.

Paragraph 6.3 of the Solicitors Regulation Authority's Code of Conduct for Solicitors, RELs and RFLs states that you keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. Indian firms and professional-services teams encounter this standard through instructing solicitors and co-counsel arrangements in England and Wales rather than directly.

Model Rule 1.6(c) of the American Bar Association's Model Rules of Professional Conduct provides that a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. The Model Rules are a template that United States jurisdictions adopt with variations, so the operative text is the one adopted by the relevant state.

ABA Formal Opinion 477R of May 2017 states that a lawyer generally may transmit information relating to the representation of a client over the internet without violating the Model Rules where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access. Formal Opinion 483 of October 2018 states that when a data breach occurs involving, or having a substantial likelihood of involving, material client information, lawyers have a duty to notify clients of the breach.

Rule 26(c)(1) of the Federal Rules of Civil Procedure allows a court, for good cause, to issue an order to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense, and Rule 26(c)(1)(G) allows an order requiring that a trade secret or other confidential research, development, or commercial information not be revealed or be revealed only in a specified way. Rule 34 governs production of designated documents or electronically stored information stored in any medium from which information can be obtained.

Regulation 3(1) of the SEBI (Prohibition of Insider Trading) Regulations, 2015 provides that no insider shall communicate, provide, or allow access to unpublished price sensitive information except where the communication is in furtherance of legitimate purposes, performance of duties, or discharge of legal obligations. The Explanation to Regulation 3(2A) records that a legitimate purpose includes sharing such information in the ordinary course of business with partners, collaborators, lenders, customers, suppliers, merchant bankers, legal advisors, auditors, insolvency professionals, or other advisors and consultants. The permission is bounded by purpose, which is exactly what a deal-room release decision has to express.

Regulation 3(5) of the same Regulations requires the structured digital database recording the nature of unpublished price sensitive information and the persons who shared or received it to be maintained internally, not outsourced, with adequate internal controls and checks such as time stamping and audit trails to ensure non-tampering. Regulation 3(6) requires it to be preserved for not less than eight years after completion of the relevant transactions, and longer where SEBI proceedings are under way. Advisers to a listed client sit inside that record.

Section 132 of the Bharatiya Sakshya Adhiniyam, 2023 bars an advocate from disclosing communications made in the course and for the purpose of the service without the client's express consent, and the Explanation records that the obligation continues after the service has ceased. A diligence data room that outlives the transaction, on storage the client's advisers do not administer, is a practical problem for that continuing obligation rather than a determination about it.

Section 42A of the Arbitration and Conciliation Act, 1996, inserted by Section 9 of the Arbitration and Conciliation (Amendment) Act, 2019, gazetted as Act No. 33 of 2019 on 9 August 2019, provides that notwithstanding anything contained in any other law for the time being in force, the arbitrator, the arbitral institution and the parties to the arbitration agreement shall maintain confidentiality of all arbitral proceedings except the award where its disclosure is necessary for the purpose of implementation and enforcement of the award. Pleadings, expert material, and hearing bundles in an arbitration sit inside that duty.

The Model Rules for e-Filing published by the e-Committee, Supreme Court of India, framed as rules for on-line electronic filing under Articles 225 and 227 of the Constitution for adoption by High Courts, provide at Rule 10.1 that originals of documents scanned and digitally signed by the advocate or the litigant in person at the time of e-filing should be preserved, for production or inspection, as may be directed by the Bench. Rule 10.4 places the responsibility of producing the originals and proving their genuineness on the party that electronically filed the scanned copies.