Three Jobs a Contract Repository Does Better Than a Data Room: M&A Diligence, Procurement and Compliance
How a managed contract repository changes M&A due diligence, procurement and compliance for Indian companies, with a diligence clause scorecard and the Indian rules that make it necessary.
A contract repository is usually sold as a way to find documents faster. Its real value shows up in three situations where the question is not "where is the contract" but "what do all our contracts say": when a company is being bought or raising money, when procurement is trying to control spend, and when a regulation changes and every affected agreement has to be found. This article looks at each through an Indian lens and ends with a diligence scorecard you can use before an investor asks for one. Position as of October 2026.
Job 1: M&A and investment due diligence
Every diligence request list asks the same contract questions: which agreements have change-of-control clauses, which are exclusive, which have uncapped liabilities, which customers can terminate for convenience, and which vendors hold personal data. In a data room of PDFs, answering them means reading. In a repository with clause-level metadata, it means filtering.
Indian specifics worth building into the review:
- Change of control and assignment. Indian commercial contracts frequently require counterparty consent for assignment and sometimes for a change in shareholding above a threshold. Missing one in a share sale can hand a key customer a termination right.
- Listed-company disclosure. For a listed buyer or seller, SEBI's Listing Obligations and Disclosure Requirements Regulations require disclosure of material events, and amendments since 2023 extend to certain agreements that bind the listed entity even when it is not a party. Diligence has to surface those agreements early.
- Section 27 exposure. Non-compete covenants in acquired contracts that run beyond their term are generally void under section 27 of the Indian Contract Act, 1872, except in the sale-of-goodwill context the section itself recognises. A buyer paying for a "locked-in" customer base should check what is actually enforceable.
- Personal data. From 13 May 2027, sections 3-17 of the DPDP Act, 2023 apply in full. A target that has been sharing customer data with processors without a "valid contract" (section 8(2)) carries a liability the buyer inherits.
Job 2: Procurement at scale
Procurement's problem is leakage: spend outside negotiated contracts, expired agreements still being paid against, and supplier terms nobody reviewed. A repository linked to purchase orders gives three controls:
- Contract-before-PO. No purchase order against an expired or missing agreement.
- Rate and term checks. Price, payment term and renewal date stored as data and compared against invoices.
- MSE compliance. Suppliers registered as micro or small enterprises must be paid within the agreed period not exceeding 45 days of acceptance (section 15, MSMED Act, 2006); since Assessment Year 2024-25, missing the deadline defers the buyer's income-tax deduction to the year of payment (section 43B(h), Income-tax Act, 1961). Procurement needs the MSE flag at contract stage, not at audit.
- GST exposure. Under the second proviso to section 16(2) of the CGST Act, 2017, input tax credit on a supply must be reversed if the supplier is not paid within 180 days of the invoice. Long credit periods negotiated by procurement carry a tax cost that the repository can flag.
Job 3: Regulatory change and re-papering
When a regulator changes the rules, the question is always the same: which of our contracts are affected and how fast can we fix them? Two live examples:
- RBI outsourcing. The RBI's Managing Risks in Outsourcing Directions of 28 November 2025 list the terms an outsourcing agreement must contain, including audit and inspection rights, incident reporting, data storage in India where applicable, subcontracting consent and exit arrangements. A bank or NBFC with 400 vendor agreements needs to know which 60 are outsourcing arrangements and which of those lack the required clauses.
- DPDP processor terms. Rule 6 of the DPDP Rules, 2025 requires "appropriate provision in the contract" with each Data Processor on security safeguards; rule 7 requires breach reporting to the Data Protection Board within 72 hours. A clause library with an approved processing clause, and a repository that shows which contracts lack it, turns re-papering into a bulk addendum exercise.
The diligence clause scorecard
Run this across the full repository before an investor or buyer does. Score each contract 0 (absent), 1 (present but non-standard) or 2 (standard).
| Clause | What to check |
|---|---|
| Assignment / change of control | Consent required? Threshold? |
| Termination for convenience | Which party, notice period |
| Exclusivity / non-compete | Term-bound? Section 27 risk if post-term |
| Limitation of liability | Cap, carve-outs |
| Indemnity | Scope, regulatory penalties covered? |
| Data processing | Purpose, safeguards, breach reporting, erasure (DPDP s. 8) |
| Payment terms | Days; MSE flag; 180-day GST rule |
| Governing law and forum | Indian law? Arbitration seat? |
| Renewal / expiry | Auto-renewal, notice window |
| Stamping | Duly stamped? Certificate on file? |
Contracts scoring below 12 of 20 go on the fix list; the list itself becomes a diligence exhibit that shows the company knows its own paper.
Where Legatio fits. A repository with clause tagging, bulk addendum workflows and e-signature, which is what Legatio provides, is the mechanism for all three jobs. The legal obligations above are the reason to do them.
Position stated as of October 2026. General information for business readers; diligence in a live transaction should be run with counsel.