The past year has quietly but decisively changed what “standard” commercial contracts will need to look like. In November 2025, India’s long-discussed privacy reform finally became operational with the notification of the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), giving shape and timelines to the Digital Personal Data Protection Act, 2023 (“DPDP Act”). At the same time, SEBI’s Business Responsibility and Sustainability Reporting (“BRSR”) and BRSR core framework (a subset of BRSR) (“BRSR Core”), moved from being a new disclosure template to an embedded part of listed companies’ reporting cycles. The BRSR seeks disclosures from listed entities on their performance against the nine principles of the ‘National Guidelines on Responsible Business Conduct’ (“NGBRCs”).

Outside India, the EU AI Act has entered into force and is now working towards its general date of application on 2 August 2026, while European sustainability and supply-chain rules are being refined rather than rolled back. For Indian businesses, 2025 has been the year in which direction became clear. 2026 will be the year in which this direction has to be written into contracts. Six clusters of clauses in particular will define how parties allocate risk: representations and warranties, introduce ESG as contractual risk allocation and not as a disclosure, data-sharing arrangements, cross-border data transfers, provisions on AI tools, and green supply-chain covenants.

Looking back at 2025

The DPDP Rules give operational shape to India’s data protection regime by confirming a phased approach to implementation, clarifying expectations around “reasonable security safeguards”, and introducing a structured time-bound framework for personal data breach notification to affected individuals and to the Data Protection Board.

On ESG, SEBI’s BRSR Core framework embeds a mandatory assurance “glide path” for key Environmental, Social and Governance (“ESG”) indicators. In 2025, SEBI also refined value-chain obligations to make them more workable, including revised criteria for identifying value-chain partners and more focused disclosure expectations. Thereby, ESG disclosures shall be applicable to top 250 listed companies (by market capitalisation), on a voluntary basis from financial year 2025-26. Further, provisions allowing entities, in the first year of value-chain ESG reporting, to treat disclosure of the previous year’s data as voluntary, such as permitting FY 2024-25 data to be optional for FY 2025-26 reporting, serve to meaningfully reduce the initial compliance burden.

Globally, 2024–25 has seen a steady growth in ESG-related enforcement, greenwashing litigation and stakeholder scrutiny. Contractual representations, warranties and covenants are increasingly being used to allocate ESG-related regulatory and litigation risk, especially in cross-border transactions. These developments make it increasingly difficult for listed entities to ring-fence ESG risk internally, pushing them to contractually allocate ESG compliance, data accuracy and remediation obligations across their value chains.

Representations and warranties:

The first area where change is visible is the front part of the boilerplate - representations and warranties. Across sectors, two patterns from 2025 are instructive:

• Regulators and investors are asking for evidence, not just statements. BRSR Core pushes listed entities to disclose standardised ESG metrics – from greenhouse gas emissions and energy use to employee well-being and fair treatment of customers.
• Litigation and enforcement around inaccurate or overstated sustainability claims are increasing globally.

In 2026, ESG representations are likely to be unpacked and articulated along their Environmental, Social and Governance dimensions, rather than being subsumed within generic governance warranties. Environmental representations will increasingly focus on the accuracy and completeness of sustainability data, such as emissions, energy use and waste metrics, together with compliance with applicable environmental permits and regulatory consents, particularly where such data feeds into statutory disclosures or investor reporting. Social representations are expected to address labour and human-rights risks more explicitly, including compliance with labour laws, the absence of forced or child labour and modern slavery in operations and key suppliers, and the existence of effective grievance redressal and whistle-blower mechanisms. Governance representations, in turn, will go beyond anti-bribery and corruption compliance to cover ESG oversight structures, including board-level or committee-level responsibility for ESG matters, documented policies, internal controls and escalation frameworks. Together, these representations reflect a shift from high-level assurances to evidence-based guarantees designed to withstand regulatory scrutiny, assurance exercises and enforcement action.

In the coming years, parties can be expected to move away from a single, catch-all statement that “each party complies with applicable law” and towards more nuanced, evidence-backed, risk-sensitive guarantees with commitments to notify the counterparty of any material investigation. Increasingly, core governance principles themselves may form part of the representation package, for example, the business is conducted in an ethical, transparent and accountable manner, supported by documented policies, controls and oversight mechanisms. ** Data-sharing and breach clauses:** With the DPDPA and DPDP Rules now framed, data-sharing provisions will be read as part of a compliance programme rather than as standalone boilerplate. This will influence standard data-processing clauses in 2026 in several ways:

• Role clarity: contracts will need to be explicit about who is the data fiduciary and who is the processor to specify the purposes and scope of personal data processing in line with the underlying commercial arrangement.
• Notice and purpose specification requirements: contracts must ensure that notices provided by the data fiduciary to data principals contain all mandatory disclosures, including (i) personal data and purpose of processing such personal data (ii) manner in which the data principal may make complaint to Data Protection Board of India established by Central Government (“Board”).
• Detailed security schedules: minimum technical controls aligned with DPDP expectations, rather than general “industry standard” wording. Data protection failures are increasingly being viewed not merely as compliance lapses, but as governance failures with ESG consequences, particularly under investor scrutiny.
• Structured incident-response obligations: notification timelines that allow the data fiduciary to meet 72-hour reporting expectations to the Board, together with clear cooperation and evidence-sharing commitments.
• Retention and deletion duties: implementing the DPDP Rules’ approach to data retention and erasure following prolonged inactivity, while preserving logs and key records for at least one year or as otherwise mandated.

Going forward, the contracts will need to embed operational obligations with clear allocation of data fiduciary and data processor roles, structured breach-response timelines, verifiable consent mechanisms, and transfer constraints where applicable. In effect, data-processing terms will become compliance artefacts rather than boilerplate, requiring organisations to hard-wire governance and accountability into their commercial arrangements. ** Cross-border transfers:** Commentary on the DPDP Rules emphasises that transfers of personal data outside India remain conditionally possible and are subject to any country-specific restrictions that may be notified by the Central Government. Significant Data Fiduciaries (“SDFs”) may have tighter localisation requirements for specified personal data & associated traffic data categories, which must remain in India.

In parallel, the European Union’s AI Act and existing data-protection rules continue to shape global expectations around data flows, risk assessments and technical measures – with most AI Act provisions becoming applicable from August 2026.

For 2026 contracts, this suggests three trends: Data-flow mapping as a contractual deliverable; ‘Change in law’ mechanisms tailored to data migration etc, and recognising that future regulatory changes may require architectural changes and thus, a cost allocation for redesign.

AI tools: By the end of 2025, AI tools had become part of day-to-day commercial operations – drafting assistance, customer engagement, fraud detection, logistics optimisation and more. What has changed is that regulators now expect governance around these tools.

Under the DPDP Rules, organisations designated as SDF’s may be subject to enhanced governance obligations, including the requirement to undertake data protection impact assessments for processing activities that present heightened risk to data principals, as may be prescribed or notified. While the DPDP Act does not regulate artificial intelligence systems as a standalone category, SDFs are expected to exercise appropriate oversight and to perform due diligence on technical and algorithmic systems that process personal data, including AI-driven tools. In the EU, the AI Act introduces a tiered regime distinguishing prohibited AI, high-risk AI and general-purpose AI models, with core obligations becoming appslicable between 2025 and 2026. Such assessment is done to verify and assess whether there is anything that is likely to pose a risk to the data principals.

In contracting terms, this is likely to translate into AI-specific disclosure clauses, using case-based restrictions and providing for audit and testing rights. For Indian counterparties that serve global clients, these clauses will increasingly be driven by foreign regulatory expectations as much as by domestic law. In ESG terms, AI governance is fast becoming a core ‘G’ metric, with contractual clauses acting as the first line of accountability.

Green supply-chain covenants: SEBI’s BRSR and BRSR Core frameworks, together with later refinements, have made it clear that listed entities are expected to report not only on their own footprint but also, progressively, on their value-chain partners. Globally, supply chains remain at the centre of ESG scrutiny, from working-conditions and modern-slavery concerns to Scope 3 emissions and biodiversity impact.

In 2026, green supply-chain covenants are likely to focus on data and disclosure obligations, cascading obligations, i.e. expecting Tier 1 suppliers to impose similar standards and monitoring on their own key partners, remediation rather than immediate termination and alignment of incentives.

**2026: What should commercial contracts now aim to do? ** A practical way to approach 2026 contracting is to ask, for each significant relationship:

1. Are our ESG related representations and warranties anchored in evidence and systems, not just aspirations?
2. Do our data-sharing and breach clauses reflect the structure and timelines of the DPDP Rules, including phased commencement?
3. Have we mapped and contractually addressed cross-border data flows, including the possibility of future localisation requirements for some datasets?
4. Are we treating AI tools that touch personal data and high-impact decisions with the level of contractual governance that forthcoming regulations expect?
5. Do our ESG and supply-chain clauses provide the ESG information and assurance that BRSR Core, investors and global counterparties will expect over the life of the contract?

“Beyond boilerplate” in 2026 will not mean longer contracts. It will mean clauses that are specific, operational and aligned with the regulatory journey that began in earnest in 2025 – allowing businesses to meet new standards without losing sight of commercial practicality.

As the DPDP regime, BRSR Core, and global AI and sustainability rules continue moving from “principles” to “systems”, commercial contracts will be expected to reflect that same change in maturity. This could mean replacing aspirational language into defined expectations, measurable outcomes, and clear demarcation of responsibilities between parties. In other words, the new generation of “boilerplate” clauses will be less about legal formalities and more about operational resilience. They will help businesses demonstrate that they have the systems, controls and governance structures required under India’s DPDP framework, BRSR Core regime and the upcoming global AI compliance landscape. This would also result in a major shift in India’s business outlook – where ESG and data protection clauses will increasingly be judged, not by how well they read, but by how well they withstand and operate under stress and real world situations — audits, incidents, regulatory scrutiny and litigation.

The writers are Nazneen Ichhaporia, Partner and Head - PE, M&A, Privacy & Data Protection, ANB Legal and Rohini Nair, Partner - Funds & Private Equity, ANB Legal

(Disclaimer: The opinions expressed in this column are that of the writer. The facts and opinions expressed here do not reflect the views of www.economictimes.com.)