A Firm That Does Not Hold Its Own Systems Cannot Plan a Move.

You have decided to get a second opinion on your shop. The agency that built it has looked after it for six years, its quotes keep rising, and small changes take a month.

A second agency is willing to quote. It asks for two things: the code, and any document that says what the shop does. You have neither.

The same week, a customer writes to customer service. What do you hold about me, and please delete it. Your team does not know where the shop keeps a customer’s details. The answer, once again, is to ask the agency.

What We Found

We looked at three things: what the public record shows about firms whose code is held by an agency or a former owner, what the government’s summary of India’s data protection rules says, and one survey on how firms see the technology they run on.

The government’s summary gives a time for answering a person’s request about their data. The government’s summary of the Digital Personal Data Protection Rules, 2025 says they were notified “on 14 November 2025” and “introduce an eighteen-month period for phased compliance”. It says: “Every Data Fiduciary must issue a separate consent notice that is clear and easy to understand.” And Data Fiduciaries “are required to address all requests related to access, correction, updating or erasure within a maximum of ninety days”.

Many firms say the technology they run on holds them back. In one vendor-sponsored survey of a few hundred leaders at mid-size US and UK manufacturers, retailers and wholesalers, about seven in ten agreed that outdated technology is holding them back. That is about old technology in general, not about agencies or former owners.

We found no public case of an agency withholding code from a retailer. We looked, and we do not suggest it is common. Most agencies hold the code because they wrote it and nobody asked for a copy.

What a Firm Cannot Do With Systems It Does Not Hold

Holding the code is usually discussed as a contract matter. Our reading is that it decides what the business can plan.

A move. A firm cannot plan leaving a system it cannot describe. No second supplier can price the work without the code or a written record of what the shop does, so there is one quote, and no way to tell whether it is fair.

A customer’s request. Our reading, and only that: where customer records sit in systems another party built and runs, the firm learns what it holds about a customer by asking that party. A request to see, correct or erase personal data then waits on someone else’s queue. Whether the rules apply to your firm, and what they require of it, is for you and your advisers.

A fair price. Every change is quoted by the one party that knows the shop.

This is our reading of the evidence. It is not a measured market figure, and we do not put a rupee value on it here. That figure has to come from your own business.

Four Ways to Get Your Own Systems Onto Paper, Weighed

Option	When it fits	What it risks
Keep paying the current holder and change nothing	The relationship works, prices are fair, and no move is planned	Nothing is learnt. Every question and every quote still goes to one party, and the firm’s position weakens with each change
Rebuild from what the shop shows on screen	The shop is small and plain, with few rules behind the screens	What happens behind the screens, in overnight jobs and pricing rules, is missed and found by customers after the switch
Ask the holder for a handover of the code	The holder is willing, and the contract is clear	It is the firm’s own step, sometimes with a lawyer. A copy of the code on its own still says nothing in plain words about what the shop does
Arrange read-only access to the code, then have an assessment write the specification the firm holds	The firm wants to plan a move, compare quotes or answer for its own systems	It costs money before anything moves, and it needs the code first. The holder’s help is part of the price

Where You Are Now, and Where You Should Be

Before the next year with the current holder is agreed, we would set a benchmark for the decision itself.

Measure	Typical starting point	Where it should be	How it is checked
Who holds the code	The agency or former owner; never asked	A copy, or read-only access, arranged by the firm before the assessment	Confirmed before the assessment begins
A written record of what the systems do	None; it lives in the holder’s heads	A specification the firm holds	The specification
Where customer details are kept	Known only to the holder	Written down, system by system	The specification
The cost of staying	The holder’s fee alone	The fee, the waiting and the workarounds, in one place	The cost comparison
Quotes for change	One supplier, one number	Any supplier can price from the same written record, subject to the firm’s own contract with its present supplier	The quotes set beside the specification
The size of one commitment	Everything at once, or nothing	One module, with the freedom to pause after any accepted module	The staged plan

The starting points above are what we expect to find. In an engagement they are replaced by your own position, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a retailer.

How We Work With You

1. We listen: a free Reliability Review. A first conversation about your systems, who holds them, and the questions you cannot answer without asking. You leave with a short written note of what we found. You can start with a conversation about the system; we ask for read-only code access only when the assessment begins.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
3. We read the system and propose: the Legacy System Specification Assessment. Here the system is the applications your business built or had built, wherever they are held. It produces a written specification of what it does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage. You get the options and our recommendation.
4. If you approve, we build. We replace a system one module at a time while the old one keeps running. Here that means the firm’s own applications, rebuilt module by module in accounts the firm opens in its own name. We never do a single cutover. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module.
5. We review against the benchmark. Before work starts we set the benchmark. After each module we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.

What you need to bring: a budget for the assessment; the code, or read-only access to it, arranged by your firm with whoever holds it before the assessment begins; people who use the shop every day to confirm what it does; and the current holder keeping the systems running while the work goes on.

What we do not do: we do not obtain your code from an agency or a former owner, we do not negotiate on your behalf, and we do not tell you what your contract means; those are for you and, where needed, a lawyer. We do not recover accounts or domains. We do not manage passwords, review access or remove a leaver’s access. We do not host, secure or monitor systems, and we do not install, move or choose a packaged shop platform or a packaged ERP product. PHP is a language we read, not one we build in. Meeting the data protection rules, or any other rule, is your own work: we do not offer a compliance service, and we do not say what any rule requires of a particular firm. We have no published case of this work for a retailer.

What changes for the business:

Role	What they gain
CEO	Parting from an agency becomes a business decision, because the firm can describe its own shop.
CTO or CIO	A specification the firm holds, written from the code and confirmed by the firm’s own people.
CFO	Quotes can be compared, because another supplier can price from the record, subject to the firm’s own contract with its present supplier.
CISO	The firm can say what its systems do with customer details without asking the agency.
COO	Questions about how the shop behaves are answered in-house.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
The government’s summary of India’s data protection rules, published on 17 November 2025, says Data Fiduciaries “are required to address all requests related to access, correction, updating or erasure within a maximum of ninety days”.	Our assessment writes down what a firm’s systems do, including where they keep customer details. Meeting the rules is the firm’s own work, and we do not say what they require of it.
In one vendor-sponsored survey, about seven in ten leaders agreed that outdated technology is holding them back.	We write a specification the firm holds, so a move can be planned and priced by any supplier, subject to the firm’s own contract with its present supplier. Getting the code from its holder is the firm’s own step.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. Getting the code is your step; writing down what it does, in a specification you hold, is ours.

Book a free Reliability Review →

Get a fixed quote →

See the Legacy System Specification Assessment →