Anocloud
Let’s Talk

Most DPDP failures are not legal failures. They are architectural ones.

Lawyers and cloud engineers on the same engagement — reading your architecture, your IAM policies and your retention rules, and turning the law into changes your team can ship.

DPDP · India6 months to enforcement
DPDP readiness assessment · fixed price, fixed scope
Book the assessment₹50,000per entity · 7 days · 4.5 hours of yours
Or check yourself free, in ten minutes6 months to enforcement
The window

More than half of it is already spent.

The eighteen-month window, to scale · 64% spent
14 November 2025

The Board was established

The Data Protection Board of India was operationalised and the Rules were notified. Substantive obligations were not yet enforceable, but the Board could receive complaints and prepare its inquiry machinery.

13 November 2026

Consent Managers go live

Registration opens for consent intermediaries — India-domiciled, with a prescribed net worth and a seven-year audit retention. From here the runway to full enforcement is six months.

14 May 2027

Substantive provisions live

Notice and consent, Data Principal rights, breach notification, processor agreements, SDF obligations and cross-border restrictions all become enforceable. The Board can issue penalties from this date.

Why this practice exists

Three of the eight domains cannot be closed on paper. A policy does not satisfy a rights request, a retention rule, or an erasure that has to reach a payroll processor.

How the work is staged

Assess, diagnose, design, implement.

Each step subsumes the one before it
Assess

Readiness assessment

Where everyone starts
₹50,000 per entityFixed price, fixed scope
Duration
Five to seven working days
Your time
About three hours in total, across four or five people
Depth
Positions as declared — policies, contracts, described processes. Not yet traced through systems.
  • A scored report across all eight domains
  • A sequenced ninety-day plan with an owner against each item
  • A sixty-minute readout to your team

A scored position, and a plan you own whether or not you continue with us.

Credited in full ↓
Diagnose

Diagnostics & governance

Includes 01
Sized on scopeFee note within two working days
Duration
Four to six weeks
Your time
Five to six hours of workbook, plus two or three working sessions
Depth
Positions as evidenced — traced through contracts, notices, access grants and one live request.
  • The processing register
  • The assessment report
  • A costed remediation plan
  • The compliance log structure

An evidenced position, with every finding costed and sequenced.

Credited in full ↓
Design

Consultation & design

Includes 01 · 02
Sized on scopeFee note within two working days
Duration
Six to ten weeks, overlapping the previous step
Your time
Decision sessions with the owners of each population
Depth
Every open decision taken and recorded — lawful basis per population, retention schedule, notice text.
  • A decision record
  • A design pack your team or ours can build from
  • Drafted policy, notices, retention schedule and processor clauses

A defined build scope, with owners and the evidence each control must produce.

Credited in full ↓
Implement

Complete implementation

Includes 01 · 02 · 03
Sized on scopeFee note within two working days
Duration
Three to six months
Your time
Your engineers alongside ours, or your existing partners under our specification
Depth
Controls demonstrably operating rather than described.
  • Operating controls
  • The evidence trail behind each one
  • A year of compliance log structure

Controls that have produced evidence of operation.

Nothing is repeated between steps, and what you paid for the last one is credited against the next. Starting small costs time, not money.

The first step, in detail

Seven days. Four and a half hours of yours.

Not four and a half each — four and a half in total
What it costs your team

4.5 hours across four or five people, against roughly 56 working hours in the week the engagement runs. Not four and a half each — four and a half in total.

Before you spend anything

Find out roughly where you stand, in ten minutes.

An AI-assisted self-assessment that walks the same eight domains we score in the paid engagement. It will not produce a defensible position — only an assessment does that — but it will tell you which domains are worth worrying about first, and it costs nothing.

Start the self-assessmentRead the DPDP briefing
Three ways to find out

Including the one that does not involve us.

Alternative

Do it yourself

~80 hours of senior time
  • The same person writes the policy and audits it
  • No external benchmark
  • No view of the stack
Recommended

The readiness assessment

₹50,000 · four to seven days
  • Counsel and engineers on the same call
  • Scored, sequenced and actionable
  • No ongoing commitment
Alternative

A tier-one law firm

₹3–6 lakh · six to twelve weeks
  • Policy-led rather than stack-led
  • Slow procurement and SOWs
  • A high floor for a narrow scope
Where this is not the answer

We work alongside law firms, not instead of them.

An opinion on a statute, or representation before the Board, is a law firm’s work and we will say so. Ours is the half that follows.

The assessment takes positions as declared. Tracing them through your systems is the next step — and we would rather you knew which one you were buying.

Nikhil KumarPartner — Legal & ComplianceDPDP operationalisation and Virtual GC engagements. LL.M, Azim Premji.
Neeraj OjhaStrategic Compliance PartnerSeven years in corporate compliance, POSH and regulatory advisory.
Next step

Twenty minutes, no slides.

Tell us which entity holds the most people’s data and we will tell you what the first engagement would cover. If the answer is that you should do the free things first, we will say that instead.