DPDP Compliance & Privacy Controls

We treat privacy as a product requirement, not a document added after launch. Each production engagement should identify the personal data involved, why it is required, the lawful basis for processing, who may access it, where it travels, how long it remains, and how a Data Principal can exercise applicable rights.

The Act and Rules follow a phased commencement schedule. Valueye and each customer should review the obligations and effective dates applicable to the specific deployment rather than relying on a generic compliance statement. This page describes our engineering position and is not legal advice or a certification.

The organisation deciding why and how personal data is processed will ordinarily act as the Data Fiduciary. When Valueye processes personal data only on that organisation’s documented instructions, Valueye may act as a Data Processor. Valueye may separately act as a Data Fiduciary for its own business contacts, personnel, website operations, and legal obligations.

• 01
  Customer responsibilities

  • Determine lawful purposes and the applicable ground for processing.
  • Approve notices, consent language, retention periods, user roles, and rights procedures.
  • Ensure uploaded data was collected lawfully and that instructions remain within the agreed purpose.
  • Operate the configured controls, review access, and respond to Data Principal requests and regulatory obligations.
• 02
  Valueye responsibilities

  • Process customer data within documented instructions and the agreed service scope.
  • Engineer and maintain the privacy and security controls specified for the deployment.
  • Restrict personnel and system access according to role and operational need.
  • Support evidence, incident coordination, deletion, export, and rights workflows as contractually agreed.

Where processing relies on consent, Valueye systems are designed to present or support a clear notice before the consent request. The notice should identify the personal data involved, the specific purpose, the service or use enabled, available rights, and the route for questions or grievances.

• 01Consent should be free, specific, informed, unconditional, unambiguous, and expressed through clear affirmative action.
• 02Consent records can capture the notice version, purpose, time, channel, and choice required for an auditable history.
• 03Withdrawal should be as accessible as giving consent, and downstream processing should respond according to the applicable legal and retention requirements.
• 04Separate purposes should not be bundled into one unclear choice, and optional processing should not be presented as mandatory.
• 05The Act also recognises specified legitimate uses. Where another lawful ground applies, the customer remains responsible for documenting and approving that ground instead of presenting a misleading consent request.

The precise control set is confirmed for each product and deployment. Depending on the system, Valueye can configure or engineer the following capabilities:

• 01Purpose-specific notices and consent capture with versioned evidence.
• 02Field-level data minimisation so workflows request only information necessary for the approved purpose.
• 03Role-based access, least-privilege permissions, authentication controls, and privileged-action review.
• 04Correction, completion, update, export, erasure, and grievance-management workflows.
• 05Configurable retention periods, deletion queues, legal-hold handling, and disposal evidence.
• 06Activity history for access, material changes, consent events, administrative actions, and integrations.
• 07Environment separation, encryption options, backup controls, and secure secrets handling.
• 08Integration and processor inventories showing where approved personal data is exchanged.

Subject to the Act, Rules, exemptions, verification, and the relevant processing context, a Data Principal may have rights relating to information about processing, correction, completion, updating, erasure, grievance redressal, and nomination.

Valueye can provide product workflows and administrative tools to help the responsible Data Fiduciary receive, authenticate, route, fulfil, document, and close requests. The customer determines the final response and whether data must be retained for a lawful reason.

Valueye applies risk-appropriate technical and organisational safeguards based on the system architecture, sensitivity, threat model, service scope, and customer requirements. No software can promise zero risk; dependable protection requires maintained controls and coordinated operations.

• 01Access control, environment isolation, secrets management, logging, monitoring, backup, and recovery controls selected for the deployment.
• 02Secure development review and remediation processes appropriate to the product and release risk.
• 03Documented incident triage, containment, evidence preservation, recovery, and customer escalation paths.
• 04Contractual coordination so the responsible Data Fiduciary can assess and complete applicable breach notifications within required timelines.
• 05Processor and vendor review proportionate to the information and capability made available to that provider.

A deployment intended to process personal data of children or persons with lawful guardians requires specific product and legal review. Where applicable, the responsible organisation must establish verifiable consent and ensure the processing does not involve prohibited tracking, behavioural monitoring, targeted advertising, or activity likely to cause a detrimental effect, subject to applicable exemptions and rules.

Cloud hosts, communications providers, payment providers, identity services, analytics selected by a customer, model providers, and other integrations may process data as approved subprocessors or independent entities. Their role, data access, location, retention, security terms, and transfer restrictions should be assessed before activation.

Deployment architecture and data location are engagement-specific. Cross-border processing is evaluated against applicable Central Government restrictions, sector requirements, customer policy, and contractual commitments.

• 01Map personal data, purposes, lawful grounds, roles, recipients, locations, and retention.
• 02Approve each notice, consent journey, withdrawal route, and grievance contact.
• 03Test role permissions, exports, correction, erasure, deletion, logging, and recovery workflows.
• 04Review vendors, integrations, model providers, and contractual data-processing terms.
• 05Document incident ownership, escalation contacts, and notification decision paths.
• 06Reassess the deployment after material feature, purpose, data, vendor, or regulatory changes.

For privacy engineering, deployment controls, or a customer data-processing review, contact hello@valueye.in. Requests concerning a customer-controlled deployment should ordinarily be directed first to that customer as the responsible organisation.