Acquiring an Indian technology company can provide a foreign investor with access to skilled talent, intellectual property, customers and a growing digital market. However, Technology Acquisition Checks must go beyond financial and commercial due diligence. Buyers need to establish whether foreign ownership is permitted, whether regulatory approvals are required, and whether the target can continue operating after the acquisition.

The regulatory review should begin before the parties sign a binding agreement. Early checks can identify restrictions affecting the transaction structure, completion timetable, purchase price and post acquisition plans. They can also help the buyer address compliance gaps before they become costly disputes or regulatory obstacles.

1. Confirm Foreign Direct Investment Eligibility

The first step is to identify the target’s actual business activities and check the foreign direct investment rules applicable to each activity. A software development company may face a different regulatory assessment from a business operating in telecommunications, digital payments, defence technology or another regulated sector.

India’s foreign investment framework operates under the Foreign Exchange Management Act, 1999, the Foreign Exchange Management (Non Debt Instruments) Rules, 2019 and the applicable foreign investment policy, as amended. Depending on the sector, investment may be permitted under the automatic route or may require government approval. Sectoral limits and specific operating conditions may also apply.

The buyer should examine the target’s revenue streams, customer contracts, licences and group structure rather than rely solely on its registered business description. A company may provide software while also undertaking a regulated activity through a subsidiary or contractual arrangement.

The investor’s ownership chain must also be reviewed. India's rules concerning investments from countries sharing a land border with India may require government approval in specified circumstances, including certain investments involving beneficial ownership from those countries. The relevant policy and exceptions should be assessed before choosing an investment vehicle.

The Reserve Bank of India’s Master Direction on Foreign Investment in India provides an important starting point for reviewing the applicable foreign exchange framework.

2. Determine Whether the Acquisition Requires Sectoral Approval

Foreign investment eligibility does not automatically establish permission to operate a regulated technology business. The buyer should identify all licences, registrations and regulatory conditions relevant to the target’s products and services.

For example, a fintech company may require authorisation or registration under the applicable payment, lending or securities framework. A telecommunications business may need to comply with licensing and security conditions. A company supplying defence related technology may face additional foreign investment or procurement restrictions.

The due diligence team should obtain copies of relevant licences, registration certificates, approval letters, regulatory filings and correspondence. It should check whether approvals remain valid, whether conditions have been satisfied and whether any inspection findings or enforcement proceedings remain unresolved.

The buyer should also determine whether a change in shareholding, ownership or control triggers prior approval, notification or other action. Some regulatory requirements depend on the type of licence, the percentage of shares being acquired or the rights granted to the investor.

Where approval is necessary, the acquisition agreement should allocate responsibility for the application and make the required approval a condition to completion. The parties should not assume an existing licence will automatically remain unaffected by a change in control.

3. Assess Competition Law and Merger Control

A technology acquisition may require scrutiny under India’s competition law even if the target has modest revenue. Merger control analysis should consider the size of the parties, the transaction value, the target’s Indian operations and the buyer’s wider corporate group.

The Competition Commission of India administers India’s merger control regime. A transaction may qualify as a notifiable combination if the applicable asset, turnover or deal value thresholds are met, subject to relevant exemptions and other conditions.

The deal value threshold is especially important for technology acquisitions. Under the applicable framework, transactions exceeding ₹2,000 crore may require prior approval where the target has substantial business operations in India, even where traditional asset or turnover thresholds are not met. The detailed tests for substantial business operations and any applicable exemptions should be checked against the current regulations.

Technology companies may have significant strategic value despite limited current revenue. Their value may arise from proprietary software, data assets, user networks, patents or future growth potential. A buyer should therefore avoid concluding that a transaction falls outside merger control simply because the target is a small startup.

If a filing is required, the parties must assess the applicable standstill obligations and timetable. Closing before receiving necessary approval can create serious legal consequences. Competition review should begin early enough to avoid delays after signing.

4. Review FEMA Compliance, Share Transfers and Payment Arrangements

Where the acquisition involves shares in an Indian company, the buyer must determine how the purchase will comply with foreign exchange regulations.

A secondary acquisition involves the transfer of existing shares from a seller. A primary investment involves the company issuing new shares to the investor. The distinction affects the documentation, payment arrangements, pricing rules and reporting obligations.

The buyer should examine the target’s historical foreign investment records, share allotments, valuation reports and filings. Incomplete or inconsistent records may indicate unresolved compliance issues and complicate completion.

Applicable pricing requirements must be considered for the proposed transfer. The parties should also confirm the permitted payment route, supporting remittance documents and reporting obligations. Depending on the transaction, filings such as Form FC TRS may apply to a transfer, while Form FC GPR may be relevant to an issue of equity instruments to a non resident.

The acquisition agreement should specify which party will complete each filing, provide supporting documents and address any historical reporting gaps. The buyer should also consider whether the target’s existing capital structure complies with applicable law before acquiring the shares.

5. Examine Data Protection and Cybersecurity Obligations

Technology companies often hold valuable personal data, confidential business information and records relating to customers, employees or users. A change of ownership does not remove the company’s existing data protection obligations.

The buyer should examine how the target collects, uses, stores and shares personal data. Relevant records include privacy notices, consent mechanisms, data processing agreements, retention policies, access controls and incident response plans.

India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 require careful consideration. The applicable commencement notifications and phased implementation dates should be checked before determining which obligations apply at signing and completion.

Cybersecurity due diligence should cover previous incidents, vulnerability assessments, security audits, access management, disaster recovery and third party service providers. The buyer should also establish whether the company has complied with applicable incident reporting and log retention requirements, including relevant directions issued by CERT In.

Where customer data or technical information is transferred to overseas group companies after completion, the buyer should assess the legal basis, contractual safeguards and applicable restrictions. Integration plans should not assume data can be freely moved across borders merely because the target has been acquired.

6. Verify Intellectual Property Ownership and Technology Rights

Intellectual property can be the principal asset in a technology acquisition. The buyer should confirm the target owns or has enforceable rights to use its software, source code, patents, trademarks, databases, technical designs and other proprietary material.

The review should include founder agreements, employment contracts, contractor arrangements, university research agreements and technology licences. A company may use valuable software without owning it. It may also depend on code or inventions created before incorporation or under a contract with another organisation.

Open source software requires particular attention. The buyer should identify the licences used in the product and assess whether they impose obligations affecting distribution, modification or commercialisation. Third party platform dependencies and restrictions on the transfer of licences should also be examined.

For AI and data intensive businesses, the review should extend to training data rights, model licences and the permitted use of third party datasets. Any restrictions on commercial use could affect the value of the acquired business.

The acquisition agreement should include suitable warranties concerning ownership and infringement, alongside specific protections for known issues. Where assignments or consents are missing, the buyer should determine whether they can be secured before completion.

7. Check Corporate Records, Tax and Pending Disputes

A regulatory review should include the target’s corporate records and statutory compliance history. The buyer should verify the share register, constitutional documents, board approvals, past share issues, existing shareholder agreements and any restrictions on transfers.

The target’s financial and tax records should be examined for unpaid liabilities, disputed assessments, withholding tax issues and related party transactions. An acquisition may transfer economic exposure to historical liabilities even when the underlying issue arose before the buyer became involved.

The buyer should also review pending litigation, regulatory investigations, customer complaints and employment disputes. Material contracts should be checked for change of control clauses, termination rights, consent requirements and restrictions on assignment.

Where the transaction involves several subsidiaries, the review should cover each entity holding material assets, contracts, licences or intellectual property. A group level review alone may miss issues affecting the particular entity being acquired.

If the buyer plans to reorganise the group after completion, the proposed structure should be assessed for tax, foreign exchange and regulatory implications before implementation.

8. Build Regulatory Findings into the Acquisition Agreement

The purpose of regulatory due diligence is to inform the deal, not simply to produce a list of risks. Findings should be translated into clear completion conditions, warranties, indemnities and post completion actions.

For example, a missing approval may need to be obtained before closing. An outstanding filing may require correction. A data security weakness may call for a remediation plan, while an uncertain intellectual property assignment may need to be resolved before the buyer pays the full purchase price.

Buyers working with foreign investment consultants should ensure the commercial, corporate and regulatory teams coordinate their findings. Advice on the investment route should be consistent with the proposed ownership structure, payment mechanics and intended business activities.

The agreement should also allocate responsibility for regulatory applications, information requests and compliance with any conditions imposed by authorities. It should state what happens if approval is delayed, refused or granted subject to conditions the parties cannot accept.

Where the buyer intends to establish a new Indian entity or restructure an existing group, foreign business registration considerations should be addressed alongside the acquisition. Incorporation alone does not satisfy foreign investment, sectoral licensing or ongoing compliance requirements.

Conclusion

A foreign investor acquiring an Indian technology company should verify regulatory eligibility, identify necessary approvals and review the target’s compliance history before committing to completion. Competition law, foreign exchange rules, data protection, cybersecurity and intellectual property can each affect the transaction’s timing, value and long term viability.

Effective Technology Acquisition Checks connect legal findings with commercial decisions. A structured review helps the buyer negotiate appropriate protections, address critical issues before completion and plan for lawful integration after the acquisition

Frequently Asked Questions

What regulatory checks are required before acquiring an Indian technology company?

The main checks include foreign investment eligibility, sectoral licences, change of control requirements, competition law approval, FEMA compliance, data protection, cybersecurity, intellectual property ownership, tax and corporate records.

Does every foreign acquisition of an Indian technology company require government approval?

No. Many investments may proceed under the automatic route, subject to applicable conditions. Approval may be required because of the sector, the investor’s ownership, the proposed transaction or a specific licensing requirement.

Can a technology acquisition require CCI approval even if the target has low revenue?

Yes. The deal value threshold may apply where the transaction exceeds ₹2,000 crore and the target has substantial business operations in India, subject to the applicable rules and exemptions. Traditional revenue and asset tests are not the only consideration.

Why is data protection due diligence important in a technology acquisition?

The target may hold personal data and sensitive business information. The buyer needs to identify compliance gaps, past breaches, data sharing restrictions and obligations relevant to post acquisition integration.

When should regulatory due diligence begin?

It should begin before signing a binding acquisition agreement. Early review helps identify approval requirements, estimate the timetable, negotiate completion conditions and reduce the risk of an unexpected obstacle to closing.

This update was released on 27 Nov 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.