DPDP Privacy Notice

The framework

The DPDP Act, 2023 and the DPDP Rules, 2025 establish obligations for organisations that determine the purpose and means of processing digital personal data (Data Fiduciaries), and rights for individuals (Data Principals). The final Rules were notified in November 2025 with a phased commencement schedule.

Commencement dates

• 13 November 2025: Rules 1, 2 and 17–21 commenced on Gazette publication.
• 13 November 2026: Rule 4 (Consent Manager registration-related provision) scheduled to commence one year after publication.
• 13 May 2027: Rules 3, 5–16, 22 and 23 scheduled to commence eighteen months after publication.
• Applicable provisions, amendments, notifications and exemptions are confirmed with counsel before any requirement is treated as operative or non-operative.

Principles we follow

• Lawful basis and transparency — a clear purpose and notice for each processing activity.
• Purpose limitation — information used only for the stated purposes or another legally permitted purpose.
• Data minimisation — only the information reasonably required.
• Accuracy — reasonable steps to keep personal data accurate and complete.
• Storage limitation — retained only as long as needed or as required by law.
• Security safeguards — reasonable technical and organisational controls.
• Accountability — documented responsibilities, vendors, requests, incidents and decisions.

Notice and consent on this website

• A concise notice is shown at or before collection on every form.
• Optional marketing communications use a separate, unticked choice and are never bundled with your enquiry.
• Cookie categories beyond strictly necessary stay off until you choose to enable them.
• You can withdraw consent at any time through Cookie Preferences in the footer or by submitting a request on our Grievance Redressal page.

Your rights

• Information about the processing of your personal data.
• Correction, completion, updating and erasure where applicable.
• Withdrawal of consent where consent is the basis.
• Grievance redressal, and nomination of another individual where the Act provides for this.
• Where records must be retained under securities, KYC/AML, tax or other laws, erasure rights may be limited to the extent permitted by law.

Third-party services

When this website links to a broker, registrar, bank, exchange, UPI app, KYC vendor or account-opening portal, you leave RKFS-controlled systems. That entity may be an independent Data Fiduciary with its own privacy notice.

Important

• Displaying this notice or a cookie banner does not by itself make a website DPDP compliant. RKFS's data map, consent records, retention schedule, request workflow and incident-response process are subject to legal and compliance review.
• This document is a drafting template. It must be aligned with the actual data map, consent flows, retention schedule, vendor contracts, regulated-entity obligations and final legal advice before being published.