DPDP Statement

01 Overview

The DPDP Act, 2023 governs the processing of digital personal data in India. RPACPC has built its platform around the Act’s principles: lawful purpose, consent, data minimisation, accuracy, storage limitation, and accountability.

02 Our role: fiduciary vs processor

Understanding roles is central to DPDP compliance:

For our own website and account relationships, RPACPC acts as a data fiduciary.

03Consent & notice

Where consent is the basis for processing, it must be free, specific, informed, unconditional, and unambiguous. Our APIs are designed to let fiduciaries capture and pass a consent reference, and our audit trail records the basis and timestamp of each verification.

04Processing principles

• Purpose limitation — data is processed only for the verification purpose requested.
• Data minimisation — we request and return only the fields needed.
• Accuracy — verifications run against authoritative, live sources.
• Storage limitation — data is retained only as long as necessary or legally required.

05Data principal rights

The DPDP Act provides individuals with rights including access to information, correction and erasure, grievance redressal, and nomination. As a processor, RPACPC supports fiduciaries in honouring these requests; individuals should ordinarily approach the relevant fiduciary (our customer) first.

06Security safeguards

We implement reasonable security safeguards — encryption, access control, monitoring, and breach-response procedures — to protect personal data, consistent with our Security practices.

07Breach notification

In the event of a personal data breach, we follow defined incident-response procedures and support affected fiduciaries in meeting their notification obligations to the Data Protection Board and affected data principals.

08Data localisation & transfers

We process and store personal data in line with applicable Indian requirements and any restrictions on cross-border transfer set by the Government. Sub-processors are bound by equivalent data-protection obligations.

09Grievance redressal

You may raise a grievance regarding personal data handling with our designated contact below. We aim to acknowledge and address grievances within the timelines expected under the Act.