Skip to content
ByteKnot Labs

Privacy

DPDP compliance policy

How ByteKnot Labs complies with India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025: for our own website and products, and for the systems we build and run for clients.

Last reviewed

Where the law stands

  • The Digital Personal Data Protection Act was enacted in August 2023, and the Digital Personal Data Protection Rules were notified on 13 November 2025.
  • The provisions on the Data Protection Board apply now, the consent manager rules apply from 13 November 2026, and most obligations, including notice, consent, security safeguards, breach intimation, retention and data principal rights, apply from 13 May 2027.
  • This website already meets the notice, consent and withdrawal requirements, and we are bringing the rest of our practices in line ahead of 13 May 2027.

Our two roles

  • Data Fiduciary: For the personal data we decide to collect, such as enquiries to this website, our analytics and our own products. Each product has its own notice.
  • Data Processor: When we build or run systems for a client. The client is the Data Fiduciary and decides the purposes; we process personal data only on their documented instructions, under a contract.

As a Data Fiduciary

  • Notice first. An itemised, plain-language notice before or when we collect personal data, covering the data, the purpose and how to withdraw consent, use your rights and complain to the Board. For this website that is our privacy notice. It is in English, and we provide it in any language listed in the Eighth Schedule to the Constitution of India on request.
  • A lawful basis for everything. Analytics runs only with consent given by a clear affirmative action: no pre-ticked boxes, and nothing bundled in that the purpose does not need. Data you give us voluntarily for a specific purpose, such as an enquiry, is used only for that purpose (section 7(a)).
  • Withdrawal as easy as consent. Analytics choices sits in the footer of every page, and withdrawing stops the processing it covered.
  • Only what the purpose needs. Analytics runs without session recordings, click maps, advertising features or Google signals, and we never identify visitors in it.
  • Accurate data. We keep personal data accurate and complete where it is used to make a decision about you, and correct it when asked.
  • Erasure when the purpose ends. We erase personal data once its purpose is served or consent is withdrawn, unless a law requires us to keep it, and we keep the records the DPDP Rules require for the periods they set.
  • Your rights, answered. Access, correction, completion, updating and erasure, grievance redressal and nomination. Requests go to [email protected]; we confirm who is asking, act on the request, and answer grievances within 30 days, inside the 90-day maximum the Rules allow.
  • Children. This website is not directed at children under 18. We do not knowingly process a child's personal data without verifiable parental consent, and we do not track, behaviourally monitor or target advertising at children.

Security safeguards

Reasonable security safeguards of the kind rule 6 of the DPDP Rules describes:

  • Encryption in transit (HTTPS) and at rest with our providers.
  • Least-privilege access, granted to named people and revocable at any time.
  • Secrets such as API keys kept out of code, in managed storage.
  • Visibility of access through provider logs and monitoring.
  • Security and confidentiality terms in our contracts with processors.

If a personal data breach happens

  • We contain it and work out its nature, extent, timing, location and likely impact.
  • We inform affected Data Principals without delay, in plain language: what happened, the likely consequences, what we are doing about it, what they can do, and how to reach us.
  • We inform the Data Protection Board of India without delay, and send a detailed report within 72 hours of becoming aware of the breach, as rule 7 requires.

Processors and transfers outside India

  • We use processors only under contracts that oblige them to protect personal data and to process it on our instructions. Today these are Vercel (hosting), Google Firebase (enquiry storage), Google Analytics (analytics, with consent) and our email service provider.
  • Some processors handle data outside India, including in the United States. Section 16 of the Act permits this except to countries the Government of India restricts; we will follow any restriction or condition the Government sets, and we keep a record of where data goes.

As a Data Processor for clients

  • We process client personal data only under a written contract and on the client's documented instructions, inside the client's own cloud accounts wherever possible.
  • We apply the same security safeguards to the systems we build and run, and document them for the client's records.
  • We tell the client without delay if we become aware of a personal data breach, with what they need to inform Data Principals and the Board.
  • We help clients answer access, correction and erasure requests, and can build the workflows for them into their systems.
  • We use sub-processors, including AI model providers, only with the client's written approval.
  • When an engagement ends, we return or delete the client's personal data as the contract sets out, and our access is revoked.
  • We sign a data processing agreement or an NDA on request.

Building DPDP-ready systems

  • Systems we build for clients can include the pieces the Act asks for: notices in English and Eighth Schedule languages, consent capture and withdrawal, records of consent, data principal request workflows, retention and erasure jobs, audit logs and breach alerts.
  • Whether a system meets your obligations is still a question for you and your legal advisers.

Significant Data Fiduciaries

  • We are not a Significant Data Fiduciary. If the Government ever notifies us as one, we will appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic Data Protection Impact Assessments, as section 10 of the Act requires.

Contact and review

  • Questions, requests and complaints: [email protected], read by the person responsible for data protection at ByteKnot Labs.
  • We review this policy at least once a year, and whenever the Act, the Rules or the way we process personal data changes.

This policy describes how we work; it is not legal advice. For what we collect on this website, see the privacy notice. Questions: [email protected].

Privacy notice