DPO role, done for you.
The DPDP Act requires a named DPO for Significant Data Fiduciaries. We give you one on a monthly retainer, with the same training and accountability as a full-time hire.
Pillar 01 · Compliance & Risk · Powered by dcomply The regulatory back-office
The regulatory back-office
that scales with you.
DPDP, SOC 2, ISO 27001, VAPT, POSH, CERT-In, RBI and SEBI compliance — delivered by named CAs, CSs and DPOs on the dcomply platform. Fixed monthly retainers, not surprise invoices.
₹250 CrMax DPDP penalty
6 hrsCERT-In reporting SLA
60–80%Cost reduction vs in-house
Named DPOOn every account
The Digital Personal Data Protection Act 2023 made India one of the most consequential privacy jurisdictions in the world. Penalties go up to ₹250 crore per violation. The compliance window closes in May 2027. Most Indian businesses — including businesses that think they are not touching personal data — fall under scope the moment they take an email address or a phone number.
Enterprise buyers, meanwhile, are refusing to sign without SOC 2 Type II or ISO 27001. Banks demand DPDP certificates before releasing credit lines. RBI and SEBI are tightening master directions every quarter. The CERT-In 6-hour breach-reporting window is not a suggestion.
Running this in-house means a Chief Compliance Officer, a Data Protection Officer, two or three analysts, a security engineer, auditor fees and a lot of overtime. For most companies under ₹500 crore in revenue, that is three to five times what the problem is worth.
Cosmoura runs compliance as a retainer. A named lead — CA, CS or DPO depending on the framework — owns your account. Our in-house SaaS platform dcomply.in automates evidence collection, policy versioning and buyer-questionnaire response. Our sister concern Decipher Consultancy Services builds the AI tooling that handles the repetitive bits. You get regulator-grade compliance without a regulator-grade cost base.
DPDP deadline: The Act is in force. Rules are being notified in phases. Significant Data Fiduciary classification is coming. Prepare now; retrofit later costs 4–6× more.
What we handle
Eight services. One compliance partner.
DPDP is where most clients start. Add SOC 2, ISO 27001 and sector-specific packs as your buyers and regulators demand them.
Featured · Deadline May 2027
DPDP Readiness
Done-for-you Digital Personal Data Protection Act compliance in 15–30 days. Gap assessment, personal-data mapping, consent architecture, vendor review and DPAs, policies, employee training. Live on dcomply platform for ongoing rights-request handling.
- 12-point gap audit against DPDP Act 2023
- Personal-data map + record of processing activities
- Consent flow design (web, app, in-person)
- Vendor DPA negotiation + sub-processor register
DPDP-ready in 30 days · board sign-off ready Discuss →
Ongoing
Virtual DPO Service
A named Data Protection Officer on retainer. Rights-request handling (access, correction, deletion), breach response within statutory windows, monthly compliance reporting, regulator liaison. The DPO role, without the full-time hire.
- Named DPO with 5+ years privacy experience
- Rights-request SLA: 72h acknowledgement
- Breach response + CERT-In coordination
- Monthly privacy posture report to board
DPO coverage without a full-time hire Discuss →
Audit-ready
SOC 2 Readiness
SOC 2 Type I and Type II preparation. Policy drafting (TSC-aligned), evidence collection via dcomply, control mapping, auditor coordination. We take you from zero to audit-ready in 90 days, then run the Type II observation window with you.
- Type I in 60–75 days, Type II in +90 days
- 64 TSC-mapped policies drafted + reviewed
- Evidence collection automated via dcomply
- Big-4 and boutique auditor coordination
Clean audit report · enterprise sales unlocked Discuss →
Certification
ISO 27001 / 27701
ISMS build-out, Statement of Applicability, risk register, internal audit, management review, and certification body coordination. ISO 27701 (privacy extension) layered on top where DPDP + GDPR scope demands it.
- ISMS scoping + boundary definition
- Risk register + treatment plan + SoA
- Internal audit + management review cycle
- Certification body liaison (BSI, DNV, TÜV)
ISO 27001 certified · common-controls layered Discuss →
Security
VAPT & Pen Testing
Web, mobile, infrastructure and API penetration testing by CERT-In empanelled partners. OWASP + CIS benchmarked. Fix-verify cycles included. Report in the format your buyer or regulator actually wants.
- Web app + mobile + API + infra VAPT
- CERT-In empanelled testing partners
- Fix-verify cycles until clean report
- Reports for ISO / SOC 2 / RBI / buyer-ask
Clean VAPT · 30 days end to end Discuss →
Industry-regulated
RBI / SEBI / IRDAI Packs
Sector-specific compliance for NBFCs, PA-PGs, PPIs, Account Aggregators, AMCs, brokers and insurers. Master directions mapped to controls. Monthly / quarterly returns filed. Scrutiny and inspection response support.
- Master direction mapping (category-specific)
- Monthly / quarterly return filing
- Inspection + scrutiny response support
- Category-change applications (PA to PA-PG, etc.)
Regulator-grade compliance · zero drift Discuss →
Workplace
POSH & Labour Law
Internal Complaints Committee setup, external member appointment, mandatory POSH training (English + Hindi + regional), annual report filing. Shops & Establishment, Factories Act, and state-specific labour returns.
- ICC constitution + external member panel
- Annual POSH training (3 modes available)
- Annual report to district officer
- State labour returns + S&E compliance
POSH + labour compliant · zero notice risk Discuss →
Incident
CERT-In Reporting
Breach notification setup within 6-hour statutory window. Log retention policy (180 days), incident response playbooks, tabletop exercises, VAPT scheduling. On-call coordination when something actually fires.
- 6-hour breach reporting workflow setup
- 180-day log retention architecture
- Incident response playbook library
- Quarterly tabletop exercises + on-call support
Breach-ready · 6-hour window hit, every time Discuss →
How we deliver
Twelve weeks to audit-ready.
The schedule compresses for DPDP-only engagements (4–6 weeks) and extends for multi-framework engagements (16–20 weeks).
01
Discovery + gap audit
Week 1
We walk your current state against the framework you need to comply with — DPDP Act, SOC 2, ISO 27001, or sector-specific regulation. Interviews with engineering, HR, finance, legal and vendor management. Written gap report with risk-prioritised action list.
- Interviews with 6–10 stakeholders
- Document + policy review
- Written gap report with heat map
02
Scope, plan, policies
Week 2–4
Scope statement locked. 12-week deliverable calendar signed off. Policy library drafted (DPDP: ~15 policies; SOC 2: ~40 policies; ISO 27001: ~45 policies + SoA). Risk register populated. Control-to-evidence mapping started.
- 12-week deliverable calendar
- Full policy library drafted
- Risk register + treatment plan
03
Implementation + evidence
Week 4–12
Controls implemented across engineering, HR, vendor and infrastructure. Evidence collected into dcomply platform (automated where possible). Employee training rolled out. Vendor DPAs renegotiated. Breach response tabletop run.
- Control implementation (weekly cadence)
- Evidence automation via dcomply
- Employee + vendor + infra sign-offs
04
Audit + ongoing retainer
Week 12+
External auditor engaged (for SOC 2 / ISO 27001) or regulator coordination (for DPDP / sector-specific). After certification, retainer continues at a reduced rate — rights-request handling, continuous monitoring, annual re-certification prep.
- Auditor / regulator coordination
- Ongoing Virtual DPO service
- Annual recertification prep built in
How we compare
In-house. Traditional consultant. Cosmoura.
Honest comparison on cost, speed, coverage and the parts most consultants quietly skip.
| In-house team | Traditional consultant | Cosmoura retainer | |
|---|---|---|---|
| DPO role | ₹25–40L/yr full-time hire | Not offered | Named DPO on monthly retainer |
| Multi-framework (SOC 2 + ISO + DPDP) | 18+ months typical | Sequential — 24 months | Parallel tracks — 6–9 months |
| Evidence collection | Manual spreadsheets | Shared drive upload | Automated via dcomply platform |
| Breach response SLA | Depends on team | Business hours only | 6-hour window, on-call 24×7 |
| Buyer questionnaire response | 2–3 days per questionnaire | Case-by-case | Answer library · 24h turnaround |
| Cost (SOC 2 + ISO + DPDP) | ₹60L+/yr fully loaded | ₹35–50L one-time + hourly | Scoped engagement + annual retainer |
| Regulator liaison | Legal team handles | Added fee | Included — DPO is your face |
Why Cosmoura
Three structural advantages, not three promises.
Common controls, mapped once.
SOC 2, ISO 27001 and DPDP share roughly 60% of their controls. We map them once and run three parallel audit tracks. Cuts your total compliance effort by ~40%.
Platform, not just paperwork.
Evidence collection runs on dcomply.in — our in-house compliance platform. Automated collection, auditor-ready exports, buyer questionnaire answer library. You do not maintain a spreadsheet.
What's included
Everything you get in the retainer.
Named compliance lead on your account (CA / CS / DPO)
Monthly compliance calendar with reminders and deliverables
Access to dcomply platform for your team (self-serve + dashboards)
Quarterly review call with action list and risk register
Document templates — policies, DPAs, SOPs, consent forms
Audit coordination with external auditors and regulators
Dedicated email thread with your named leads
48-hour SLA on day-to-day questions during business hours
Industry packs
Compliance, tuned to your sector.
Manufacturing
DPDP + factory + labour + CCTV + biometric consent
Schools & Edtech
DPDP children's data + POSH + CBSE compliance + fee-app review
Healthcare
DPDP patient data + HIPAA-adjacent + lab vendor DPAs + CDSCO
FinTech & NBFC
RBI master directions + SOC 2 + ISO 27001 + CERT-In + DPDP
D2C & E-commerce
DPDP + consumer protection + shipping vendor DPAs + returns
SaaS & IT Services
SOC 2 + ISO 27001 + DPDP + GDPR + buyer questionnaires
FAQ
Questions compliance teams ask us.
01 How is Cosmoura different from a traditional compliance consultant? +
Our back-office runs on Decipher AI and the dcomply platform. That means we deliver the same quality a traditional CA/CS firm does, at 3–4× the throughput and 60–80% lower cost per deliverable. You still get senior human signoffs on everything.
02 Can you handle multiple frameworks at once (SOC 2 + ISO 27001 + DPDP)? +
Yes — this is the most common engagement. We map overlapping controls once and run parallel audit tracks, which cuts your overall effort by roughly 40% versus sequential projects. Typical multi-framework engagement runs 6–9 months end to end.
03 Do you provide the auditor, or just the readiness work? +
We prepare you fully and coordinate with external auditors / regulators of your choice. For SOC 2 and ISO 27001 we have preferred audit partners we can introduce; for RBI/SEBI/CERT-In we work with your appointed authorities.
04 What happens after the initial engagement? +
Most clients move onto a monthly retainer covering Virtual DPO work and ongoing compliance management. This handles rights requests, policy updates when regulations change, quarterly reviews and audit renewals.
05 Do you work with businesses outside Delhi NCR? +
Yes — our delivery is fully online across India. On-site training and workshops are available in NCR, Mumbai, Bangalore and Hyderabad on request.
06 Is this legal advice? +
No. We provide compliance implementation and documentation services. For specific legal disputes or interpretations, consult your appointed legal counsel.
07 What is a Significant Data Fiduciary (SDF) under DPDP? +
An SDF is a data processor classified by the Data Protection Board as significant based on volume, sensitivity, risk and critical infrastructure impact. SDFs must appoint a DPO (not a Virtual DPO), conduct annual data protection impact assessments, and submit to annual audits. We prepare clients ahead of SDF notification.
08 Can you handle breach response if something actually happens? +
Yes. We maintain an on-call rota, run quarterly tabletop exercises, and coordinate CERT-In reporting within the 6-hour statutory window. Breach retainer is included in Growth tier and above.
New here? Start with Business Setup
Starting a business? Get everything you need to go live.
Company registration, GST, trademark and the first 90 days of compliance — handled by the same team that would run your retainer afterwards.
Deadline is 2027
Start your DPDP + SOC 2 journey.
Audit-ready in 12 weeks.
Share your requirement using the contact form. Our support team reads every message, benchmarks your current posture against DPDP, SOC 2 and your sector regulator, and replies by email within one working day with a sequenced plan. A call is scheduled only if your matter needs one — we don't cold-call.