Scale · Cloud services
Cloud security and compliance, with DPDP in the design.
Cloud security and compliance for Indian enterprises on Microsoft Azure that answer to DPDP, a regulator or a parent company. NetScale reviews the tenant, hardens it, sets up the compliance framework for DPDP and data residency, and plans disaster recovery. Security is designed into the landing zone, and every configuration is handed over as yours.
- Last updated
What it is
Cloud Security
Cloud security and compliance means hardening the cloud estate, setting its compliance framework for DPDP and data residency, and planning disaster recovery for cloud workloads.
Hardening closes what the tenant leaves open: admin access, exposed services, readable storage and weak encryption settings. The compliance framework keeps the controls DPDP and your regulator expect, with their evidence, inside the tenant.
Disaster recovery planning sets how fast each workload must come back, and from where, and writes it down before it is needed.
The DPDP programme across the whole estate sits under DPDP readiness.
Zero trust across the estate sits under Security architecture and GRC.
Data residency on-premises sits under Data centre and colocation.
Restores tested on a schedule sit under Remote infrastructure management (RIM).
What it covers
- Cloud security hardening
- Compliance framework setup
- DPDP & data residency
- Disaster recovery planning
In this line: Cloud services
Sound familiar?
- 01
The region was chosen for price. DPDP now asks about compliance. Would that choice survive an audit?
Our answer: DPDP and data residency
- 02
Admin access to the tenant was granted during the migration. Who still has it?
Our answer: Cloud security hardening
- 03
Disaster recovery was planned for the data centre. What is the plan for the cloud?
Our answer: Disaster recovery planning
- 04
A storage account was opened to share files quickly. Who can read it today?
What we do.
Cloud security hardening, compliance framework setup covering DPDP and data residency, and disaster recovery planning.
- 01
Cloud security hardening
Admin and user access, internet-facing services, storage permissions, encryption settings and logging in the tenant, checked against a written baseline and fixed in phases.
- 02
Compliance framework setup
Policies, controls and evidence for DPDP and sector rules, configured in the tenant, mapped to ISO 27001 where it applies and kept current between audits.
- 03
DPDP and data residency
Regions, backups and log stores placed where your regulator, parent company or customers require, with the choice and its reason written into the design.
- 04
Disaster recovery planning
Recovery objectives for each cloud workload, the region it recovers to and the runbook that brings it back, written down and tested before go-live.
How an engagement runs.
One request path, user to cloud data, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
India specifics and cost.
India specifics
- Data residency
The DPDP Act lets the government restrict transfers to notified countries; it does not require all personal data to stay in India. The RBI’s direction of 6 April 2018 requires payment system data to be stored only in India. Legal interpretation stays with your counsel.
Source: RBI direction on storage of payment system data, 6 April 2018 (external site)
- DPDP
From 13 May 2027, the DPDP Rules require security safeguards including encryption, access control, logging and data backups, with logs kept for one year. We configure them in the landing zone. Legal interpretation stays with your counsel.
Source: Digital Personal Data Protection Rules, 2025 (external site)
- CERT-In
Under the Directions of 28 April 2022, cloud logs are kept within India for a rolling 180 days, with clocks synchronised to NIC or NPL. Reportable incidents go to CERT-In within 6 hours of being noticed.
What drives the cost
- 01
Subscription and tenant count, and how they are organised.
- 02
Workload count, and how many hold personal data.
- 03
Recovery objectives: how fast each workload must come back, and from where.
- 04
Monitoring scope and the support window, agreed in writing.
The technology we run for this.
Cloud platform and identity
Next-generation firewalls and cloud security
Firewalls and secure networking
Our own information security and privacy management systems, run under both standards.
Certifications and technologyQuestions buyers ask about this.
Related services
Does DPDP require our cloud data to stay in India?
Not in every case. The DPDP Act lets the government restrict transfers to notified countries rather than requiring all data to stay in India. Sector rules, such as the RBI’s on payment data, can require residency. Where residency is needed, we design for Microsoft Azure’s India regions. Legal interpretation stays with your counsel.
Which Azure region should an Indian company choose?
An India region where personal data, backups and logs need to stay resident, chosen among Microsoft Azure’s India regions for latency and redundancy. Where residency is not required, the choice weighs cost and latency instead. Either way, the decision is made with your counsel and written into the design.
What does cloud security hardening cover?
The tenant’s configuration: who has admin and user access, which services face the internet, who can read each storage account, how data is encrypted and what is logged. Each is checked against a written baseline. Each gap is fixed in a phase, and its evidence is kept.
What should a cloud disaster recovery plan include?
Recovery objectives for each workload: how much data it can lose and how fast it must come back. Then where it recovers to, the runbook that brings it back, who decides to invoke it and when it is tested. Ours is written down and handed over as yours.
Is the cloud provider responsible for securing our data?
Partly. The provider secures the platform; you are responsible for how your tenant is configured: identity, access, network exposure, encryption settings and backups. That shared responsibility is where cloud gaps usually sit, and it is what the cloud security review checks, in writing.
Book a cloud security review.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
What we put in writing
- The written findings are yours whether we ever work together or not.
- Each phase is fixed-scope and signed off separately.
- You can stop at any phase boundary.
- Runbooks, configurations and credentials are yours.