AMLEGALS
Implementation

From First Engagement to
Board-Ready in 24 Weeks

Four phases. A structured timeline. A defensible legal artefact at every stage. This is not an open-ended consulting engagement. It is a defined implementation with clear deliverables and measurable outcomes.

Weeks 1–5
Weeks 6–12
Weeks 13–20
Weeks 21–24

Before building anything, the organisation needs to know exactly where it stands — not approximately, but precisely. This phase establishes the factual baseline.

Deliverables

  • Detailed data flow mapping across every business unit, vendor, and processor
  • Statutory obligation inventory — every DPDPA provision mapped to your specific operations
  • Consent landscape audit — current state of consent capture, evidence, and withdrawal mechanisms
  • Cross-border transfer exposure analysis under Section 16
  • Children’s data processing assessment under Section 9
  • Current-state Inviolum Pulse Score (VPS) baseline measurement
  • Stakeholder interviews across legal, IT, HR, marketing, and leadership functions
  • Third-party and sub-processor data sharing inventory

Key Artefact

Exposure Assessment Report — a Board-presentable document that becomes your compliance baseline.

In Practice

This phase is thorough by design. Most organisations discover that what they believed was compliant is actually a collection of assumptions held together by a privacy policy and a cookie banner that were never properly configured. The Exposure Assessment maps, measures, and presents the factual position without assumptions.

Frequently Asked Questions

Begin the Process

The first conversation is confidential. No templates. No generic proposals. A practitioner’s assessment of exactly where your organisation stands.

Request Assessment
the Inviolum implementation process: legal reference

What is the legal framework for data protection in India?

India's framework is the Digital Personal Data Protection Act, 2023 (Presidential assent 11 August 2023; 44 sections) read with the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025 (G.S.R. 846(E)) with 23 Rules and 7 Schedules.

Is a Data Fiduciary responsible for its vendors under DPDPA?

Yes. Section 8(1) makes the Data Fiduciary responsible for compliance in respect of processing undertaken by it or on its behalf by a Data Processor. Section 8(2) requires a Data Fiduciary to engage a Data Processor under a valid contract. Detailed contractual clause architecture is an implementation best practice guided by Section 8(2).

What security safeguards does DPDPA require?

Section 8(5) requires reasonable security safeguards to prevent personal data breach. Rule 6 specifies minimum measures including encryption, obfuscation, masking or virtual tokens, access control, visibility over access through logs and monitoring, measures for continued processing after compromise, and retention of logs for one year unless otherwise required by law.

Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to the Inviolum implementation process?

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).