Law, engineered for the digital road.
“Sarak” means road. Every business and every individual now travels one: data in motion, money in motion, decisions in motion. We make sure the law travels with them, built into the product, the contract and the response plan before trouble arrives.
A firm that reads both code and statute.
SARAK Law & Tech was founded by Mohd Kashif to close a gap he kept seeing: lawyers who advise on technology they have never seen working, and technologists who ship products before anyone has asked what the law requires. We sit between the two and speak both languages.
Prevention over panic
The cheapest legal problem is the one designed out of the product. We review data flows, consent screens and vendor chains early, when fixes are small.
Plain language, precise advice
You get a clear recommendation, the reasoning behind it and the risk you are accepting, written so founders, engineers and boards can all act on it.
Evidence-minded from minute one
Logs, screenshots, device images and transaction trails decide cyber matters. We treat preservation as a legal step, not an afterthought.
Three lanes. One road.
Pick a lane to see how we work. Most real problems sit where the lanes meet, which is why one team handles them together.
Cybercrime & digital fraud
Rapid response for victims and businesses.
- Complaint strategy under the IT Act and BNS
- Bank-freeze and takedown notices
- Evidence preservation and electronic-record certification
DPDP Act advisory
From first gap review to a living programme.
- Notices, consent and withdrawal design
- Retention and erasure policy
- Grievance redressal and rights-request handling
IT & sector compliance
Rules that touch platforms, intermediaries and online services.
- Intermediary and platform obligations
- Terms, privacy policies, disclaimers
- Regulator notices and responses
Technology agreements
Deals that hold up when systems fail.
- SaaS, licensing, development and hosting
- Data processing and confidentiality
- SLAs, liability caps, IP ownership
Data mapping & records
We trace what personal data you collect, where it flows, who touches it and why, then turn that into a register you can defend.
Privacy-by-design reviews
Sign-up flows, cookie and consent interfaces, analytics SDKs and children’s-data checks, reviewed with the product team, not after launch.
Control gap reviews
A legal lens on reasonable security safeguards: access control, logging, encryption, vendor access and backup, mapped to what regulators expect.
Incident playbooks & drills
Who calls whom, what is preserved, who decides on notification. Rehearsed once so nobody is improvising at 2 a.m.
Compliance tooling
Checklists, templates and dashboards that turn policy into routine, so compliance survives staff turnover.
Breach response, end to end
Containment, evidence capture, regulator and individual notifications, vendor accountability and a post-incident fix list, coordinated under one command.
Product launch clearance
A fast legal and privacy sign-off before go-live: data flows, terms, consent, contracts and open risks, in one short memo.
Vendor & processor diligence
Questionnaires, contract clauses and ongoing checks for the cloud, payment and analytics providers your business depends on.
Board-ready reporting
One page showing posture, residual risk and decisions needed, so leadership can steer with confidence rather than signatures alone.
Four stations, no detours.
Every engagement follows the same road, scaled to the size of the problem.
Listen
A focused intake: what you do, what data you hold, what keeps you up at night, what deadline is coming.
Map
We trace the data, contracts and obligations, and rank risks by likelihood and damage, not by volume of paperwork.
Build
Policies, clauses, notices, playbooks and product changes, drafted to be used rather than filed.
Defend
When something goes wrong, we respond, represent and document, with a clean record already waiting.
The DPDP Pulse.
Eight questions, two minutes. See how ready your organisation is for India’s Digital Personal Data Protection regime and which gaps to close first. Nothing leaves your browser.
Straight answers.
What is the DPDP Act and who must comply?
The Digital Personal Data Protection Act, 2023 governs how personal data of individuals in India is processed. It applies to organisations of any size that decide why and how personal data is processed, including startups and non-profits, and can reach foreign entities offering goods or services in India. Obligations roll out in phases under the DPDP Rules, so confirm the current commencement dates for your situation.
What can go wrong if we ignore it?
Beyond penalties, which the Act sets as high as ₹250 crore for failing to keep reasonable security safeguards, the practical costs are lost enterprise deals, failed diligence, regulator attention and the reputational damage of a public breach.
I was cheated online. What should I do first?
Act within hours. Call the national cybercrime helpline 1930 and file on cybercrime.gov.in, tell your bank immediately so it can attempt to freeze the beneficiary account, and keep every screenshot, SMS, call log and transaction ID untouched. Then speak to a lawyer about a formal complaint.
Do you work only with companies?
No. We advise startups, SaaS and fintech teams, MSMEs and professionals, and we also assist individuals dealing with cyber fraud, online harassment or account compromise.
How do we begin?
Write to us or message on WhatsApp with a short description. We will tell you what we need and how we would approach it before any engagement begins.
Mohd Kashif
Advocate and Partner at Crest Law Chambers, and founder of SARAK Law & Tech. Mohd Kashif works at the point where cyber law, the DPDP Act and regulatory compliance meet real products and real incidents.