DPDP Act readiness: a practical checklist for IT and engineering teams
What India's Digital Personal Data Protection Act and the DPDP Rules 2025 mean for systems, logs, consent and breach response, with a phased checklist.
Cybersecurity you can test, measure and prove
We assess your exposure, harden identities, endpoints, networks and cloud, and monitor for threats, with 24x7 cover available by agreement, so security works as a measurable program rather than a pile of tools.
What you can expect
- A risk-ranked remediation plan
- Retest evidence for every fixed finding
- Documented incident response playbooks
- Security reporting your board can read
Overview
Security testing, zero trust, identity, detection and response, and compliance programs you can measure.
We start with what an attacker would see: internet-facing assets, weak identities, unpatched systems and gaps in logging. Findings are ranked by business risk, fixed in order and retested, so progress is visible to leadership.
Where regulation applies, such as the DPDP Act, GDPR or CERT-In directions, we map controls to obligations and keep the evidence ready for audits.
Our team works from Pune. We can work onsite in and around the city, and remotely for organizations across India and abroad.
Capabilities
What our cybersecurity team does
- 01
Assessment and testing
Know where you are exposed before someone else finds out.
- VAPT for web, API, mobile, network and cloud
- Breach and attack simulation
- Attack surface management
- Security ratings and third-party risk
- 02
Zero trust and identity
Verify every user, device and request.
- Zero trust maturity assessment and roadmap
- Identity and access management
- Single sign-on and multi-factor authentication
- Privileged access management
- 03
Detection and response
See threats early and act on them quickly.
- SIEM and SOAR design, tuning and operations
- Security monitoring, with 24x7 cover by agreement
- Digital forensics and incident response
- Threat intelligence
- 04
Endpoint, email and device security
Protection where people actually work.
- EDR and XDR deployment
- Email security and phishing defense
- Mobile device management
- Patch and vulnerability management
- 05
Cloud and application security
Security built into platforms and pipelines.
- Cloud security posture management
- DevSecOps and code scanning
- Secrets management
- Container and Kubernetes security
- 06
Governance, risk and compliance
Policies and evidence that satisfy customers and auditors.
- ISO/IEC 27001 and SOC 2 readiness
- DPDP Act and GDPR programs
- CERT-In incident reporting readiness
- Policies, risk registers and internal audits
Approach
How the work runs, step by step
Each step ends with something you can review, so decisions are made on evidence rather than status updates.
Step 01
Assess
Exposure review, control gaps and threat model.
You get Risk-ranked findings
Step 02
Prioritize
Remediation plan tied to business impact.
You get Roadmap with owners
Step 03
Harden
Fixes to identity, endpoints, network and cloud.
You get Retest evidence
Step 04
Monitor
Logging, detection rules and continuous monitoring.
You get Alert playbooks
Step 05
Respond
Containment, investigation and recovery.
You get Incident reports
Step 06
Improve
Lessons learned, drills and quarterly reviews.
You get Security scorecard
Platforms and tools
Technology we work with
Names are trademarks of their respective owners, used only to describe technologies our teams use. No partnership or endorsement is implied. See the main platforms we work with.
- Microsoft Sentinel
- Microsoft Defender
- Microsoft Security Copilot
- Splunk
- CrowdStrike
- SentinelOne
- Palo Alto Networks
- Fortinet
- Okta
- Microsoft Entra ID
- CyberArk
- Wazuh
- Burp Suite
- Nessus
- Qualys
Industries
Where this work matters most
- Banking, Financial Services & InsuranceDigital journeys, core integration, risk analytics and security for BFSI.
- Healthcare & Life SciencesPatient and clinician apps, interoperability, clinical data and secure cloud.
- Public SectorCitizen services, case management, analytics and secure infrastructure.
- Manufacturing & IndustrialConnected plants, ERP and MES integration, supply chain and quality analytics.
- Energy & UtilitiesAsset monitoring, smart metering data, field operations and OT security.
Questions
Cybersecurity: frequently asked questions
How often should we run a penetration test?
At least once a year and after significant changes, such as a new application, a major release or an infrastructure move. Critical internet-facing systems benefit from more frequent testing.
Can you help us meet CERT-In reporting requirements?
Yes. We help you set up log retention, clock synchronization and an incident response process so that you can report incidents within the six-hour window set by CERT-In.
What does a zero trust program involve?
Verifying every user, device and request, limiting access to what each role needs, and monitoring continuously. We start with a maturity assessment and build a phased roadmap across identity, devices, applications, data and network.
Do you offer managed detection and response?
Yes. We can operate your SIEM and SOAR, triage alerts (around the clock where agreed) and escalate confirmed incidents to your team with clear next steps.
Often combined with
Related services
- 07NetworkingEnterprise LAN, WAN, SD-WAN, Wi-Fi and network security, designed, deployed and monitored.
- 03Cloud ServicesCloud migration, modernization, DevOps and FinOps across AWS, Microsoft Azure and Google Cloud.
- 09Managed IT ServicesService desk, monitoring, patching and application support under clear service levels.
Further reading
Talk to our cybersecurity team.
Tell us about your systems, timelines and constraints. We will come back with questions, options and a suggested first step.