OPSDelivery model · security · data
How the workmoves, and is kept safe.
Every request follows the same line: intake, validation, processing, review, delivery. Every engagement follows the same phases. And every control is written down, so it can be checked.
§ 01Request pipeline
Five stages.
No shortcuts.
Each stage has an entry rule, checks and an exit rule. An item that fails a check goes back with a reason.
- [intake]REQ-0417 received · channel: secure upload · owner assigned
- [validation]rules v12 · format ok · totals ok · 2 exceptions queued
- [processing]script run complete · exceptions resolved with reasons
- [review]checker: output ties to input · checklist signed
- [delivery]released · run log attached · 0 open items
- 01 / 05intake
Intake
A request or file arrives through one door: a ticket, a secure upload or a scheduled pull. It gets a reference and an owner.
- Reference assigned
- Owner set
- Due date from calendar
- 02 / 05validation
Validation
Format, completeness and totals are checked against written rules. Anything that fails goes back with a reason, not a guess.
- Format and fields
- Control totals
- Master-data match
- 03 / 05processing
Processing
The work itself: scripted where the steps repeat, by a trained operator where judgement is needed.
- Scripted steps logged
- Operator notes
- Exceptions resolved
- 04 / 05review
Review
A second person checks the output against the input and the checklist. Maker and checker are never the same person.
- Maker ≠ checker
- Output ties to input
- Checklist signed
- 05 / 05delivery
Delivery
The output is released through the agreed channel with its run log. Open items are listed, not hidden.
- Agreed channel
- Run log attached
- Open items listed
§ 02Engagement phases
From walkthrough
to steady state.
A written scope before any build. A parallel run before any switch. A review after every cycle.
- P1
Discovery
Walk through the process with the people who run it. Note inputs, outputs, systems, deadlines and pain points.
- P2
Written scope
What is done, what stays with you, the checks at each stage, turnaround and the data involved.
- P3
Build and transition
Rules, scripts, checklists and access set up in a test environment, then walked through with your team.
- P4
Parallel run
One cycle run alongside your current process. Results are reconciled before anything switches over.
- P5
Steady state
The monthly calendar runs. Exceptions go to owners. The run log is kept.
- P6
Review
A regular review of what was done, what failed, and what should change next.
§ 03Operating models
Where the work runs
is your choice.
In your systems
Work runs inside your accounting, payroll or HR software through named accounts you create and can revoke. Data stays where it is.
Fits: Where systems of record are already in place and access can be granted per person.
You keep · Your environment, your access control, your backups
In a dedicated environment
Working data is moved to an environment set up for the engagement, processed there, and returned through the agreed channel.
Fits: Suits migration, digitisation and heavy data processing.
You keep · Approval of what is transferred, retention period, deletion confirmation
Hybrid
Automation and checks run in a dedicated environment; postings and approvals happen in your systems.
Fits: Common for workflow automation and MIS.
You keep · Final postings and approvals in your systems
§ 04Who does what
Clear lines of
responsibility.
Decisions, approvals and anything that moves money stay with you. Preparation, checks and records sit with the team.
| Activity | Client | A.K. Outsourcing Services |
|---|---|---|
| Define the process and rules | Approves | Drafts and documents |
| Provide inputs on the calendar | Responsible | Chases and logs |
| Validation and exceptions | Decides each exception | Runs checks, raises exceptions |
| Processing | — | Responsible |
| Second-person review | — | Responsible (checker ≠ maker) |
| Postings, payments, filings | Responsible and approves | Prepares files on instruction |
| Access to systems | Grants and revokes | Uses named accounts only |
| Personal data decisions (purpose, retention) | Data fiduciary: decides | Data processor: acts on instructions |
| Breach notice to the Board and people | Responsible (fiduciary) | Tells the client without delay, with facts |
§ 05Security controls
Eight controls,
written down.
Controls are only useful if they can be shown. Each one below is intended to leave evidence: an access list, a log, a signed checklist, a deletion confirmation.
Intended practice · to be confirmed
No third-party security certification is claimed on this website.
Access by name and role
Named accounts only, no shared log-ins. Access granted per engagement and removed when a person moves off it.
Strong sign-in
Multi-factor authentication on systems holding client data, wherever the system supports it.
Encryption
Data encrypted in transit and at rest. Files are exchanged through secure channels, not open email attachments.
Logs you can read
Access and run logs kept, reviewed and retained for at least one year, in line with the DPDP Rules, 2025.
Separation of duties
Maker and checker are different people. Test and live environments are separate. Client data is kept apart by engagement.
Least data
Only the fields a task needs. Masked or tokenised identifiers where the task allows it.
Retention and erasure
Data kept for the agreed purpose and period, then deleted, with a written confirmation of deletion.
Incident response
A written runbook: contain, assess, tell the client without delay so it can meet its own notice duties, then fix the cause.
§ 06DPDP obligations
What the law asks,
and who carries it.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, as they stand on 25 September 2026. General information, not legal advice.
Roles
The client that decides the purpose and means of processing is the data fiduciary. A.K. Outsourcing Services, processing on its behalf, acts as a data processor.
Employment data
Employers may process personal data for employment purposes without consent. Other purposes need a lawful basis of their own.
Responsibility
The fiduciary remains responsible for processing done on its behalf, which is why the processor's controls must be visible to it.
Contract
A processor may be engaged only under a valid contract. Every engagement is intended to have one before data moves.
Safeguards
Reasonable security safeguards to prevent a personal data breach, including for processing by the processor.
Breach
The fiduciary intimates the Board and affected people. The Board gets a detailed report within 72 hours of the fiduciary becoming aware. The processor's job is to tell the client at once, with facts.
Erasure
Data is erased when the purpose is served, unless the law requires it to be kept. The fiduciary must cause its processor to erase it too.
Minimum safeguards
Encryption, obfuscation or masking; access control; logs and monitoring; backups; logs and data kept for one year for investigation; a contract binding the processor.
Location
Transfer outside India is allowed except to countries the Government restricts by notification. Sector rules can be stricter; the intended default is to keep working data in India.
TimelineCommencement under Rule 1
| When | What applies | Status on 25 Sep 2026 |
|---|---|---|
| November 2025 (publication) | Rules 1, 2 and 17 to 21: definitions, the Data Protection Board and its procedure | In force |
| November 2026 (one year) | Rule 4: registration and duties of consent managers | Upcoming |
| May 2027 (eighteen months) | Rules 3, 5 to 16, 22 and 23: notices, security safeguards, breach intimation, retention and erasure, rights of Data Principals, and the rest of the operational duties | Upcoming |
A proposal reported in early 2026 to shorten the eighteen-month window had not been notified as at 25 September 2026. Penalties under the Act's Schedule reach ₹250 crore for failing to take reasonable security safeguards.
FAQQuestions
Questions on delivery
and data.
Q01Who is responsible for the data under the DPDP Act?
The client, as data fiduciary. A.K. Outsourcing Services acts as a data processor under a written contract and follows the client's instructions.
Q02When do the DPDP Rules apply?
The Rules were published in November 2025. Most operational duties commence eighteen months after publication, in May 2027. The Board and procedural rules are already in force.
Q03Is the company certified to a security standard?
No third-party security certification is claimed on this website. The controls described are intended practice and are being confirmed.
NextEnquiry