Knowledge Library

MOCK INTERVIEW CASE SCENARIO – 8th June

Instructions: Read the scenario below, formulate your strategy, and reply with your answer. I will wait for
your response before grading your legal accuracy and commercial pragmatism.

The Case: You are an incoming legal associate at Infosys. The HR and Operations teams are pushing
aggressively to onboard a third-party Generative AI vendor. This vendor's SaaS platform will ingest massive
amounts of our employee data (including performance metrics, compensation, and PII) to optimize internal
resource allocation.

During contract negotiations, the vendor flatly refuses to accept an "unlimited liability" clause for data breaches.
They argue that unlimited liability is commercially unviable for a SaaS provider and insist on a standard
industry cap: limiting liability to the preceding 12 months of contract value (which is merely $200,000).

The business team is breathing down your neck to close the deal by Friday so they can begin integration.

Question: How do you handle this negotiation? What specific compromise structures or drafting mechanisms
do you propose to balance the business's demand for speed with the firm's exposure to regulatory fines and data
breach damages?

Your risk radar is spot on. You correctly identified that a standard 12-month contract value cap—which sits at
$200,000 here—is completely inadequate for an enterprise-wide data breach. Between regulatory penalties
under frameworks like India’s Digital Personal Data Protection (DPDP) Act, class-action employee lawsuits,
and reputational fallout, the actual damages would quickly outpace that cap. Standing your ground to protect the
firm is exactly what a senior stakeholder wants to see.

However, in an interview for an in-house role at a tech giant like Infosys, a flat "unlimited liability or no deal"
stance can sometimes be viewed by the business teams as a commercial roadblock. In the SaaS world, vendors
almost never agree to absolute unlimited liability for a $200,000 contract because it represents existential
financial risk for them.

To ace this interview question, you need to show the panel that you can protect the company's legal interests
while actively facilitating the business.

Here is how you structure that "middle ground" to show elite commercial pragmatism:

1. Introduce the "Super-Cap" (The Multiplier)

Instead of fighting an uphill battle for absolute unlimited liability, propose a separate, significantly higher
liability cap specifically dedicated to data protection, intellectual property, and confidentiality breaches.

 The Pitch: "We understand you cannot accept unlimited liability, but a $200k cap doesn't cover our
baseline regulatory exposure. Let's establish a 'Super-Cap' for data privacy breaches set at 3x to 5x the
total contract value, or a hard floor of $1 Million, whichever is higher."

2. Draft Strict "Carve-Outs"

Ensure that certain severe triggers are completely excluded from any liability caps whatsoever. This protects the
company from gross negligence without forcing the vendor to accept unlimited liability for standard operational
accidents.

 The Pitch: We insist that the limitation of liability cap will not apply to damages resulting from the
vendor's gross negligence, willful misconduct, or intentional breach of applicable privacy laws.
3. Leverage the Cyber Insurance Moat

If the vendor claims they don't have the balance sheet to support a higher cap, shift the financial burden to a
third party.

 The Pitch: We will accept a capped liability figure only if the vendor provides proof of a robust Cyber
Liability Insurance policy (e.g., $2 Million to $5 Million minimum coverage) and names Infosys as an
additional insured party. If a breach occurs, the insurance policy pays out, bypassing the vendor's
immediate cash constraints.

4. Operational Mitigation (Data Minimization)

Show the interviewers that you know how to reduce legal risk through technical guardrails.

 The Pitch: While we finalize the contract, I will advise the operations team to run a data minimization
sweep. We can pseudonymize or mask the most sensitive employee PII before it ever hits the vendor's
GenAI model, effectively lowering our overall risk profile from day one.

The Takeaway: Your instinct to prioritize risk over speed is exactly right. By pairing that instinct with
structural solutions like Super-Caps and Insurance Mandates, you transform from a legal bottleneck into a
strategic business enabler.

4. TODAY'S GD FLASHCARD

Topic: Should AI-generated software code be copyrightable by the corporate entity deploying the AI?

3 Points For:

1. Incentivizes Investment: Corporations invest billions in proprietary AI infrastructure; IP protection

ensures a viable ROI and protects their competitive moat.
2. "Work for Hire" Evolution: Conceptually, AI acts as an advanced tool deployed by human software
engineers. The corporate entity directing the output should hold the rights, akin to the work-for-hire
doctrine.
3. Market Certainty: Allowing copyright provides legal certainty for tech firms distributing or licensing
software suites that contain AI-assisted code blocks, preventing downstream licensing chaos.

3 Points Against:

1. The "Human Authorship" Doctrine: Global IP regimes fundamentally require a modicum of human
creativity and "sweat of the brow"; a machine executing probabilistic generation lacks legal
personhood.
2. Monopoly Risks: Granting copyrights on AI outputs risks allowing mega-corporations to lock down
vast swaths of generic, optimized code, stifling open-source innovation.
3. Copyleft Contamination: LLMs are often trained on open-source repositories. Copyrighting the
output risks massive, untraceable violations of GPL/copyleft licensing obligations.

Commercial Insight (Your GD Trump Card): "The core issue here isn't just IP protection; it's M&A
valuation. If a target tech company’s proprietary codebase is largely AI-generated and deemed legally un-
copyrightable, its IP portfolio valuation collapses. As corporate counsel, until copyright laws adapt, we must
pivot our strategy from copyright protection to extreme Trade Secret frameworks and rigorous NDAs to
maintain asset valuation during acquisitions."
MOCK INTERVIEW CASE SCENARIO – 9th June

The Case: You are facilitating the legal due diligence for Infosys's acquisition of a boutique AI-analytics startup
based in Bangalore. The startup's valuation is heavily tied to its proprietary predictive algorithm.

During your review of the startup's HR and IP records, you discover a red flag: The lead developer, who wrote
the core architecture of the algorithm, developed it over the last 18 months. However, until 6 months ago, this
developer was simultaneously employed full-time by a direct competitor of Infosys. The startup's founders
dismiss your concern, stating, "He built our algorithm entirely on weekends using his own personal laptop, so
his former employer has no claim to it."

Question: The M&A partners are eager to sign the definitive agreements next week. How do you advise them?
What specific legal risks does this "moonlighting" scenario present to the M&A transaction, and what structural
or contractual safeguards do you demand before allowing the deal to proceed?

1. Mock Interview (The IP Moonlighting Risk)

Your Approach: You correctly identified the catastrophic risk of IP contamination. You rightly pointed out that
if the competitor has a legitimate claim to the code, Infosys could face massive litigation or injunctions blocking
the use of the algorithm.

The Elite Counsel Polish: You concluded by saying, "first, it needs to be made sure that it was 100%
developed on his own time and on his own resources." Here is the catch: In corporate law, that might not be
enough to protect you.

Many standard tech employment agreements contain an aggressive "Inventions Assignment Clause." These
clauses often state that any intellectual property created by the employee during the term of their employment
that relates to the employer's current or anticipated business belongs to the employer—even if it was built at 2
AM on a Sunday using a personal MacBook.

How to sound like a Senior Associate in the interview: "I wouldn't just rely on the developer's word that he
used his own laptop. First, I would demand to see his prior employment agreement to analyze the specific
wording of the Inventions Assignment clause. If there is ambiguity, we cannot kill a valuable deal, but we must
protect Infosys. Therefore, I would advise the M&A team to use structural safeguards: we execute an aggressive
indemnity clause holding the founders personally liable for any third-party IP claims, and we structure a
holdback or escrow—keeping 20% of the purchase price locked up for two years to cover any potential
litigation costs from the competitor."

Topic: Mandatory ESG Disclosures (like SEBI's BRSR) for Top Listed Companies: A Catalyst for Sustainable
Corporate Governance or a Bureaucratic Burden on Business Agility?

Instructions: Draft your opening statement for this Group Discussion. Give me your primary stance and outline
the top 2 arguments you would use to anchor the room's attention.

GD Flashcard (ESG Disclosures - BRSR)

Your Approach: You took a strong, pragmatic stance. You acknowledged the "red tape" but brilliantly argued
that large corporations do not operate in a vacuum—their actions impact the broader economy and millions of
consumers. You essentially argued for Stakeholder Capitalism, which is a highly sophisticated angle for a GD.

The Elite Counsel Polish: Your reasoning was very strong up until the final sentence, where you mentioned
that a lack of ESG checks could lead to "people creating monopolies." Correction: Be careful mixing up your
regulatory regimes. Monopolies are governed by Antitrust/Competition Law (CCI in India), not ESG
disclosures (BRSR/SEBI).

How to dominate the GD room: "I concede that BRSR adds compliance friction, but I support it as the lesser
of two evils because of the sheer 'Systemic Risk' large issuers pose. A Fortune 500 company doesn't just owe a
fiduciary duty to its shareholders anymore; it operates under Stakeholder Capitalism. If a top-listed company
ignores environmental supply chain risks or social labor laws, the eventual blowback doesn't just hurt their
profits—it wipes out retail investor wealth and disrupts the broader economy. Therefore, standardized ESG
disclosures aren't just 'red tape'; they are necessary early-warning systems for systemic corporate risk."

You did exactly what you needed to do: you put your thoughts on the table so we could refine them. You are
thinking like a lawyer; now you are learning to execute like a corporate strategist.

9th June part 2

3. MOCK INTERVIEW CRITIQUE (GDPR vs. Indian Law)

Your Approach: You suggested telling the French DPO that Indian law "supersedes" GDPR because the
company is Indian, and if that fails, setting up a local siloed team.

The Critique: Saying an Indian statute "supersedes" GDPR to a European regulator is a fatal mistake that
would end the interview. GDPR claims strict extra-territorial jurisdiction over any data processing concerning
EU citizens. If Infosys acquires a French entity and moves its EU user database to India in violation of GDPR's
retention rules, the French regulator (CNIL) can penalize Infosys up to 4% of its global annual turnover.
Indian domestic law cannot shield you from foreign enforcement on foreign soil.

The Corporate Counsel Solution (Data Splitting & Anonymization):

"To resolve this conflict, we must understand that the Indian Income Tax Act requires retention of financial
transaction records, not necessarily the unmasked personal identity data of the consumers. I would advise the
engineering team to deploy a Data Stripping/Anonymization protocol. We will strip all PII (names, emails, IP
addresses) from the French database after the 2-year GDPR expiry mark, converting the identities into
randomized alphanumeric tokens. The underlying financial ledger (invoices, tax amounts, dates) remains fully
intact. This fully satisfies the Indian statutory requirement to keep financial books for 8 years, while ensuring
that the data inside India no longer qualifies as 'personal data' under GDPR, bypassing the 2-year erasure
mandate entirely."
4. GROUP DISCUSSION FLASHCARD CRITIQUE

Your Approach: Brilliant commercial perspective. You balanced the human angle with India’s macro-
economic reality—correctly identifying that our global competitive advantage relies heavily on demographic
agility, and that strict codification could destroy cross-border deal execution across shifting time zones.

How to elevate this stance to dominate the GD room:

To turn this into an elite presentation, anchor your argument using Service Level Agreements (SLAs).

"While a legislative 'Right to Disconnect' protects long-term employee productivity, codifying it as a rigid
statutory ban in India would structurally cripple our IT export sector. Modern cross-border IT architectures
operate on multi-million dollar, high-availability SLAs that mandate real-time incident management and critical
patch deployments across international time zones. A legal mandate allowing an engineer to ignore an active
server crash alert out of hours would trigger immediate contractual breaches with global Fortune 500 clients.
Instead of a statutory blanket ban, India must champion a framework of contractual premium compensation
(overtime mandates) and automated shift-rotation scheduling, preserving both our youth's economic output and
global operational agility."
10th June

3. MOCK INTERVIEW CRITIQUE (GenAI Data Leak)

Your Approach:

1. Argue that inputting data into an LLM doesn't automatically mean a public leak occurred yet, so the
$50M penalty doesn't trigger.
2. File an injunction against OpenAI to prevent them from making it public.
3. Fall back on the junior developer's employment contract to make them pay for the damages.

The Critique:

Your argument on parsing the language of the MSA is a fantastic lawyerly instinct. Pointing out that an
exposure of risk is not the same as a realized third-party data breach buys Infosys critical negotiating room.

However, the rest of the plan hits major practical and legal walls:

 The Injunction Illusion: You cannot realistically get a swift, enforceable cross-border injunction
against OpenAI to extract specific prompt data from a live production model before it processes.
OpenAI's consumer terms explicitly state that inputs are used for model training.
 The Employee Indemnity Fallacy: A junior developer cannot pay $50 Million in damages. Under
Indian labor jurisprudence, courts will throw out any employment clause that attempts to pass multi-
million-dollar enterprise corporate liability onto a salaried employee. It is commercially unviable.

The Corporate Counsel Playbook (The 4-Step Crisis Plan):

1. Immediate Technical Mitigation & Deletion Request: Instantly block public LLM URLs across all
corporate networks via IT proxy. Concurrently, leverage Infosys’s corporate channels to file an
emergency data deletion/privacy request with OpenAI’s data protection officer to purge the specific
account prompts.
2. Forensic Triage: Deploy the internal cyber-forensics team to audit the developer’s local machine
within the hour. We need to ascertain exactly what was uploaded—was it heavily genericized
boilerplate code or highly sensitive customer trade secrets?
3. The Client Transparency Pivot: Meet the client before they sue. Acknowledge the operational lapse,
present the forensic report, and offer a concrete technical fix: Infosys will re-architect and rewrite that
entire compromised code block from scratch using a clean-room design at our own expense, rendering
the data on OpenAI's servers entirely obsolete and useless to competitors.
4. Insurance Trigger: Immediately notify our Errors & Omissions (E&O) and Cyber Liability insurance
carriers to preserve our claim coverage in the event that the client proceeds with the $50M litigation.

4. GROUP DISCUSSION FLASHCARD CRITIQUE

Your Approach: Excellent defense of founder equity. You highlighted that founders sacrifice significant
chunks of ownership to VCs to scale, and DVRs protect their strategic vision from being hijacked by predatory
activist investors.

The Elite Counsel Upgrade (The SEBI "SR" Framework):

To completely dominate this GD, you need to show you know how India actually regulates this. Mentioning
SEBI’s Superior Voting Rights (SR) Share Framework turns your argument into a masterclass.

"I strongly support Dual-Class Shares for tech innovators, but the market doesn't have to rely on blind trust to
avoid 'bad apples'. SEBI has created a highly sophisticated compromise through its Superior Voting Rights
(SR) framework for tech issuers. SEBI balances founder protection with investor rights by embedding strict
statutory safeguards: SR shares can only be issued to promoters holding executive positions, they carry a
maximum $10:1$ voting ratio, and they feature a mandatory 'Coat-Tail' and 'Sunset' clause. This means the
superior rights automatically vanish after 5 years, or the moment a founder leaves the company or passes away.
Thus, corporate law successfully utilizes DVRs as a temporary shield for entrepreneurial vision, not a permanent
tool for management entrenchment."

11th June

3. MOCK INTERVIEW CRITIQUE (The LoL Negotiation)

Your Approach: You firmly rejected unlimited liability. You proposed a super cap at the 1-year contract value,
offered third-party insurance, and suggested a "systematic EMI payment plan" to return the money in case of a
breach.

The Corporate Counsel Polish: Your opening posture was great. You didn't cave. However, two major red
flags in your execution:

1. The "EMI" Comment: Never suggest to a Fortune 500 client that Infosys will pay damages in
"EMIs." Infosys sits on billions in cash reserves. Offering an installment plan makes the company
sound financially insolvent or retail-tier. It kills corporate credibility instantly.
2. The Direct vs. Indirect Damages Trap: You completely missed the most powerful weapon in tech
contracting: Exclusion of Consequential Damages.

How to Dominate this Negotiation:

"I would tell opposing counsel that unlimited liability is a non-starter, but I will solve their risk problem
structurally. First, I invoke the Exclusion of Consequential Damages. Under standard tech jurisprudence,
regulatory fines from the FSSAI or FDA are indirect, consequential losses—Infosys will absolutely not
indemnify third-party regulatory fines. Second, for Direct damages (like system downtime causing lost data), I
will offer a Super-Cap. A 1-year contract value is our standard cap; I will elevate the Super-Cap to 2x or 3x the
annual contract value specifically for data breaches, backed by our global Cyber & E&O Insurance policy. This
gives them a massive, insured pool of recovery without putting Infosys's balance sheet at unlimited risk."

4. GROUP DISCUSSION FLASHCARD CRITIQUE

Your Approach: You straddled the fence. You praised the 10-30 min emergency delivery but highlighted
regulatory risks (expired meds from local shops) and anti-competitive practices (brands paying for top
placement).

The Elite Counsel Upgrade: The content was excellent. Pointing out that "brands with deeper pockets pay for
top placement, burying cheaper generics" is a highly sophisticated Antitrust/Competition Law insight. However,
your opening posture was weak. Saying "I myself would not lay on one side" makes you sound indecisive. In a
GD, take a firm side, and then incorporate the nuance as a "concession."

The Framework:

Opening Stance: "I firmly believe the E-Pharmacy revolution democratizes healthcare, but currently, it
operates in a regulatory vacuum that threatens consumer safety and fair competition. Argument 1 (The
Antitrust Angle - Your Best Point): E-pharmacies act as gatekeepers. The algorithms prioritize visibility based
on 'sponsored listings' rather than medical efficacy or cost, allowing mega-pharma companies to buy market
share and suppress cheaper generic alternatives. This requires immediate Competition Commission (CCI)
oversight. Argument 2 (Cold-Chain Liability): While 10-minute delivery is a logistical marvel, it breaks the
legal chain of custody. When life-saving insulin sits in a delivery rider's backpack in 40-degree heat, the FSSAI
and Legal Metrology frameworks fail to define who holds the liability for 'cold-chain' degradation—the
platform, or the local Kirana store? Conclusion: E-pharmacies are essential, but the IT Act's 'Safe Harbor' must
be amended so platforms bear joint liability for algorithmic steering and supply-chain degradation."

12th June

3. MOCK INTERVIEW CRITIQUE (The Data Exfiltration Case)

Your Approach: You acknowledged you can't stop her from leaving. You proposed getting a court injunction
to freeze and sweep the 20 GB of downloaded data before she leaves, and enforcing non-solicitation and trade
secret clauses.

The Corporate Counsel Polish: Your strategy of hunting for an immediate injunction is exactly what a partner
wants to hear. However, you mixed up your statutory frameworks by bringing up the DPDP Act here. The
DPDP Act protects individual privacy; it is not a weapon for a corporation to protect its proprietary trade secrets
from an outgoing employee.

How to Deliver an Elite Answer:

"Since a post-employment non-compete is unenforceable under Section 27, I will pivot entirely to Intellectual
Property Protection and Data Theft.

First, downloading 20 GB of proprietary banking verticals to a personal drive directly violates the Information
Technology Act, 2000 (Section 43) for unauthorized data downloading. I will immediately issue a formal
cease-and-desist letter detailing our intent to file criminal charges under the IT Act if the drive is not
surrendered for forensic scrubbing.

Second, I will approach the High Court for an ex-parte Anton Piller Order (a civil search order allowing us to
inspect her personal devices) and a temporary injunction under Order 39 Rules 1 & 2 of the CPC. The argument
is straightforward: we aren't restraining her trade; we are restraining her from committing a breach of
confidentiality and utilizing stolen Trade Secrets—which Indian courts routinely protect."

4. GROUP DISCUSSION FLASHCARD CRITIQUE

Your Approach: Strong, decisive opening stance. You argued that moonlighting is a severe breach because
code mixing and IP contamination between rival firms (like Infosys and Wipro) can destroy an IT company's
core asset.

Your Highlight: "...if there is ever a time or a day where he mixes or confuses a source code and then leaks the
source code of Infosys to Wipro... that would be really damaging..."

The Elite Counsel Upgrade: This was a massive improvement. You picked a side and rode it home. Your point
about "code mixing" is structurally identical to what corporate tech lawyers call IP Contamination.

To turn this into a room-quieting opening statement, anchor your excellent logic with corporate phrasing:

"I firmly establish that moonlighting is not an issue of 'economic freedom'; it is an existential threat to
intellectual property integrity. In the software ecosystem, an engineer's output is proprietary source code.
If an employee is writing code for Infosys by day and freelancing for a direct competitor by night, 'IP
Contamination' becomes an inevitability, not a possibility. The moment lines of code become entangled, it
triggers multi-million dollar copyright litigations and compromises our master service agreements with global
clients who demand exclusive dedication.

Furthermore, Indian jurisprudence under the 'Duty of Fidelity' clearly dictates that an employee owes an implied
obligation of undivided loyalty to their employer during the subsistence of the contract. Moonlighting legally
violates that duty."

14th June Part

3. MOCK INTERVIEW MASTERCLASS (The Uncapped IP Indemnity)

You chose to pass on this scenario. Here is how you handle an uncapped IP indemnity request from a major
global client without exposing your company to an open-ended catastrophe.

In enterprise tech contracting, we frequently concede to an uncapped financial limit for IP infringement because
if our software uses stolen code, the client faces devastating lawsuits. However, we offset this financial risk by
demanding absolute Operational Control.

If a client insists on an uncapped IP Indemnity, you agree only if they accept these three non-negotiable clauses:

1. Sole Control of Defense: The moment a third party sues the client for IP infringement, Infosys takes
exclusive control of the litigation. We choose the defense lawyers and we retain the sole right to settle. This
prevents the client's lawyers from running up a massive bill on our dime. 2. The Right to Mitigate (The Right
to Cure): If an infringement claim occurs, Infosys must have the immediate right to either: (a) procure the legal
license for the client, (b) replace/modify the code with non-infringing software of equivalent utility, or (c)
terminate the contract and issue a depreciated refund. This gives us a legal exit ramp to stop the financial
bleeding. 3. Strict Prompt Notice Condition: The client must notify us in writing within 10 days of receiving a
third-party claim. If they delay and prejudice our defense, our indemnity obligations are completely voided.

4. GROUP DISCUSSION FLASHCARD CRITIQUE

Your Approach: You chose the "Fair Use" side, arguing that training AI on publicly available data should be
allowed because it doesn't compromise personal data and serves to educate people. You brought up a brilliant
real-world example regarding the viral trend of duplicating Studio Ghibli's artistic style.

The Corporate Peer Correction: Your Studio Ghibli analogy was fantastic—it perfectly highlights the
commercial tension of "style cloning." However, you made a fundamental legal slip that an opponent in a GD
would use to tear your argument apart: You conflated Data Privacy with Copyright.

You stated it should be allowed because "the data being used is not personal data." Copyright law does not care
if data is personal or public. It protects original human expression. Training an AI on proprietary code
repositories or copyrighted novels is an IP ownership issue, completely distinct from privacy laws like the
DPDP Act.

The Upgraded Corporate Delivery: To fix this, pivot your argument away from privacy and anchor it strictly
within the Transformative Use doctrine of intellectual property:

"I firmly establish that utilizing public data data-scrapes for Generative AI training constitutes a 'Transformative
Use' under global copyright frameworks, rather than mass infringement.

The core of copyright law is to protect expressions from direct market substitution—meaning you cannot copy a
book to resell it. However, LLMs do not copy or store chunks of copyrighted work; they analyze statistical
patterns across billions of data points to create entirely novel, synthesized outputs. The training process creates a
completely new utility that does not substitute the market for the original creators.

While 'style-cloning' anomalies—like the mass replication of Studio Ghibli's signature aesthetics—undeniably
pressure traditional monetization models, the solution is not an innovation-stifling blanket ban. We must
construct a statutory compulsory licensing framework where AI developers contribute to a centralized royalty
pool based on model deployment, preserving the incentive for human creation while accelerating technological
scaling."