Privacy, security & compliance advisory
We help growing companies understand what the DPDP Act, customer security reviews and standards such as ISO 27001 actually ask of them — and then work alongside their teams to put the right controls in place.
Based in Gurgaon. We work mainly with SaaS, IT services and e-commerce businesses across India, and with overseas companies that process data here.
| Ref | Risk | Owner | Rating | Due |
|---|---|---|---|---|
| R-04 | Sign-up notice does not list each purpose of processing | Product | 30 Jun | |
| R-07 | No data processing agreement with two analytics vendors | Legal | 15 Jul | |
| R-11 | Support staff can access admin console without MFA | Engineering | 31 Jul | |
| R-15 | Application logs kept for 60 days; policy requires 180 | DevOps | 31 Aug | |
| R-18 | Leavers' accounts disabled manually, sometimes late | IT | 30 Sep |
Rated on likelihood and impact. Showing 5 of 31 entries.
Frameworks we work with
Most clients come to us with one specific need — a customer questionnaire, a new regulation, an upcoming audit. We keep the scope to what that need requires.
Find out where personal data sits in your business, what the DPDP Act requires of you as a Data Fiduciary, and which gaps matter most. Then fix them: notices, consent, rights requests, vendor contracts and breach handling.
DPDP complianceAuthorised testing of your websites, APIs, mobile apps and cloud accounts. Findings are written for the engineers who will fix them, with evidence, severity and clear remediation steps — followed by a retest.
Security testingPrepare for ISO 27001 certification or a SOC 2 examination, meet CERT-In obligations, and answer enterprise security questionnaires with confidence. We build the policies, risk process and evidence your auditor will ask for.
ISO 27001 & SOC 2 readinessExtracts from the kind of documents we hand over. Names and details are invented for illustration — client work is never shared.
Finding WEB-03
The endpoint GET /api/v1/invoices/{id} checks that the user is logged in but not that the invoice belongs to their account. Changing the ID returned invoices for other customers, including names, billing addresses and GST numbers.
Any registered user could collect other customers' billing data. This is personal data under the DPDP Act and would likely need to be treated as a breach.
/receipts and /credit-notes, which share the pattern.The same six stages whether the work is a two-week security test or a six-month certification project. You always know what stage we're at and what comes next.
We agree in writing what's covered, what isn't, who's involved and when. For testing, this includes formal authorisation.
Interviews, document review, data mapping and technical testing — whatever the scope calls for.
Findings are ranked by real business impact, not just severity scores, so your team knows where to start.
We can stay on to draft policies, redesign processes and support engineers, or hand over to your team.
We retest fixes and check that new processes are actually being followed before calling anything closed.
Optional periodic reviews to keep controls, evidence and documentation current as your business changes.
Mostly technology-led businesses that handle customer data and sell to larger organisations. The risks differ by sector, so the work does too.
Tenant isolation, sub-processor management and the security questionnaires that slow enterprise deals.
SaaSClient audits, project data segregation and access control across shared delivery teams.
IT servicesCheckout security, marketing trackers, customer records and keeping card data out of scope.
E-commerceProportionate controls that satisfy early customers and investors without slowing the team down.
StartupsAPI security, financial data handling and incident reporting, working with specialists where regulation demands.
FintechSensitive health records, access hierarchies and the vendors that sit around clinical systems.
HealthcareReports are written for the people who have to act on them. Legal and technical detail is there when needed, not as padding.
You'll know what's included, what it costs and what you'll receive before any work begins.
We don't resell compliance software or take referral fees, so recommendations are based only on what you need.
Work is covered by an NDA. Findings and credentials are shared through access-controlled channels and deleted at the end of the engagement.
Practical material for teams doing this work themselves. Regulatory guides are dated and reviewed when official guidance changes.
Data inventory, notices, consent, rights requests, retention, vendors and breach handling — grouped by owner so you can split the work.
What each involves, what you get at the end, and how to decide which one your customer or auditor is actually asking for.
Certification versus attestation, what different buyers expect, and the effort involved in each.
If you process digital personal data in India, or process it elsewhere in connection with offering goods or services to people in India, it very likely does. Whether you act as a Data Fiduciary or a Data Processor — and for which activities — is one of the first things a gap assessment establishes.
No. An organisation that helps build your management system can't also certify it — that would be a conflict of interest. We prepare you for the audit; an accredited certification body or CPA firm carries it out.
Testing is planned to avoid that. We agree test windows, rate limits and emergency contacts beforehand, and use a staging environment where one is available. Anything with a real risk of disruption is discussed with you before it's attempted.
It depends on scope. A focused web application test or DPDP gap assessment for a small company usually takes a few weeks from kick-off to report. Certification readiness typically runs over several months. We'll give you a timeline with the proposal.
A short call and some basic facts: what's driving the work, the applications or systems involved, rough headcount, and the cloud platforms you use. Please don't send passwords, keys or real customer data at this stage.
A short description is enough to start. We'll come back to you to arrange a call.