Cipher & Co. is a data-protection and technology practice for companies that ship software. We turn the DPDP Act, GDPR and your contract stack into something your engineers and your board can both live with.
// counsel to data-heavy, regulated teams
One team for the whole lifecycle — from the notice a user sees, to the DPA your vendor signs, to the 2am call when something leaks. No hand-offs, no translation layer between "legal" and "engineering."
Get audit-ready under the Digital Personal Data Protection Act, 2023 and GDPR — without freezing your roadmap. We design the programme, not just the paperwork.
When it goes wrong, you get counsel on the phone in the first hour — coordinating forensics, the regulator and your comms while the clock runs.
The paper that moves your product — MSAs, DPAs, cloud and processor terms — drafted to be signed, not stuck in a six-week redline war.
Ship models without shipping liability. We build the policy scaffolding around training data, deployment and the vendor AI clauses hiding in your stack.
// principle 001
Under the DPDP Act, consent is the contract. We make sure yours reads that way in court, in code and to a user.
A data breach is a legal event on a deadline. The DPDP Act expects notification to the Data Protection Board of India and to affected principals — and every hour of silence is a decision. A retainer means the plan already exists before the incident does.
Your team isolates the incident; you dial the retained line.
Privilege is set up, the response is scoped, roles are assigned.
What data, whose, how much — evidence preserved for the regulator.
Filings and user comms go out — accurate, on time, defensible.
Root-cause fixes, an evidence pack and a closure report you can stand behind.
// embedded with your team
Most privacy advice arrives as a PDF and dies in a Notion page. Ours ships with the product. We sit with your engineers, understand the data before we opine on it, and leave you with policies your team will actually follow.
A data-flow and risk audit of what you collect, where it lives and who touches it — the honest inventory that everything else depends on.
Notices, consent flows, DPAs and internal policies — drafted for your stack, not lifted from a template pack.
Retained counsel on call: the breach hotline, regulator liaison and the contract redlines that come up every week.
Residency Road · Bengaluru 560025
We are a small, deliberately senior team. No pyramid, no juniors learning on your matter. Founded by lawyers who spent years in-house at Bengaluru product companies, Cipher & Co. exists because privacy and technology law stopped being a side-desk and became the whole business.
Founding Partner · Data Protection & Privacy
15+ years at the Bengaluru bar advising fintech and health platforms on the DPDP Act, GDPR and cross-border data. Leads compliance and regulator engagement.
Partner · Technology Transactions & AI
Former in-house counsel to a Bengaluru SaaS company. Runs the contracts and AI-governance practice — from DPAs to model-deployment policy.
Counsel · Cybersecurity & Breach Response
Leads the incident practice and the 24×7 hotline, coordinating forensics, notification and post-breach remediation under pressure.
Tell us what you're building and where the data goes. We'll tell you, plainly, what the DPDP Act and your contracts actually require — and where you're already fine.
