Frequently Asked Questions

We provide privacy and cybersecurity compliance services, including gap assessments, audits, and advisory work that help organizations identify where their data practices and security controls fall short of applicable regulations, and how to close that gap.

A gap assessment is a structured review of your current data handling, security controls, and documentation against a target regulation or framework. We identify specific gaps, rank them by risk, and provide a remediation roadmap your team can act on.

Our core focus is the Digital Personal Data Protection Act, 2023 (DPDPA) for organizations operating in India. Depending on your needs, we can also assess against other widely recognized frameworks.

We work with organizations of varying size and sector that process personal data and need defensible privacy and security compliance — from early-stage companies preparing for their first audit to larger organizations running periodic reviews.

Our regulatory grounding is in Indian law (DPDPA), but we work with organizations that process the personal data of individuals in India, regardless of where the organization itself is headquartered.

Compliance failures usually happen at the seam between technical implementation and legal interpretation — a control that's technically built but doesn't satisfy the regulation, or a policy that's legally sound but unenforceable in your systems. Our team reviews every engagement through both lenses before it reaches you.

Engagements are staffed with a mix of our machine learning engineers (from IIT and NIT) and lawyers (from NLU), depending on the scope of work. You'll have a named point of contact for the duration of the engagement.

Most firms hand you either a legal opinion or a technical audit — rarely both, reconciled. We build the technical and legal review into one process, so the deliverable you get is something both your engineering and legal teams can act on without translation.

Reach out through our contact details below with a brief description of your organization and what you're looking to assess. We'll schedule an initial scoping call to understand your needs before proposing an engagement plan.

Most engagements follow four stages: scoping and document collection, technical and legal review, a findings and gap report, and a remediation walkthrough. Larger engagements may include implementation support after the report stage.

Timelines depend on the size and complexity of your organization's data footprint. A focused gap assessment can typically be completed within a few weeks; broader audits or multi-system reviews take longer.

Typically, access to relevant policy documents, a description of your data flows and systems, and a point of contact who can coordinate stakeholder interviews on your end.

Yes. Most of our engagements are scoped to the specific regulatory exposure and systems involved, rather than sold as fixed packages.

Pricing depends on the scope of the engagement — the number of systems, data flows, and stakeholders involved, and whether the work is a one-time assessment or an ongoing engagement.

Yes, engagements are confirmed against a deposit or upfront fee, which reserves dedicated analyst time for your project.

[Insert accepted payment methods — e.g. bank transfer, UPI, card payment]

[Confirm GST registration status and invoicing process before publishing]

We don't offer outright cancellations once an engagement is confirmed, since that reserves dedicated analyst time on your behalf. Instead, we offer rescheduling — see below.

Yes. You can reschedule a confirmed session, assessment start date, or milestone, provided you give us sufficient written notice. Full conditions are set out in our Refunds and Cancellation Policy.

[Insert your confirmed notice period, e.g. 5 business days — must match your published Refunds and Cancellation Policy]

A missed session without the required notice may be treated as a completed engagement and billed in full, per our Refunds and Cancellation Policy.

No. Fees paid for confirmed engagements, including deposits and milestone payments, are non-refundable. We offer rescheduling instead — see the Cancellations & Rescheduling section above.

No, deposits confirm and reserve your engagement slot and are non-refundable once paid, regardless of whether work has formally begun.

If we're unable to deliver as agreed due to our own scheduling failure or inability to perform, you can choose between a free reschedule or a refund for the portion of work not delivered. Full details are in our Refunds and Cancellation Policy.

[Describe what your site actually collects — e.g. contact form submissions, analytics data — and confirm against your published Privacy Policy before going live]

[Confirm whether your site uses cookies (analytics, session, marketing) and link to your Cookie Policy with the actual categories used]

Documents and data shared during an engagement are handled under confidentiality terms agreed at the start of the engagement, and are used only for the purposes of that engagement.

Yes. As a Data Principal under the DPDPA, you can request access, correction, or erasure of your personal data by submitting our Grievance Redressal Form.

[Link to your published Privacy Policy and Cookie Policy pages once available]

The Digital Personal Data Protection Act, 2023 is India's primary law governing how organizations collect, process, and store the personal data of individuals in India. It sets out obligations for organizations (Data Fiduciaries) and rights for individuals (Data Principals).

Yes, with respect to the personal data we collect through this website and during client engagements, we act as a Data Fiduciary under the DPDPA.

Under the DPDPA, you have rights to access information about your personal data, request correction or erasure, withdraw consent, and raise grievances regarding how your data is processed.

You can submit a grievance using our Grievance Redressal Form. We acknowledge and aim to resolve grievances within 90 days, per Rule 14 of the DPDP Rules, 2025.

Yes. If you don't receive a response within the prescribed timeline, or are unsatisfied with our resolution, you can escalate to the Data Protection Board of India under Section 13(3) of the DPDPA.

[State your actual IP/content reuse policy in your Terms & Conditions, and reflect it here]

[Define usage rights over deliverables — e.g. for internal use only, not for resale — in your engagement agreement and reflect it here]

[Insert your governing law and jurisdiction — should match your Terms & Conditions and Refunds & Cancellation Policy]

[Link to your published Terms & Conditions page once available]