DPDP Act 2023 notes

Which side of the relationship we are on

You are the data fiduciary. Chronolipi is a data processor acting on your documented purpose, under a written agreement that limits our processing to storage, indexing, retrieval and export for you. Where someone asks us directly about a record inside your workspace, we route the request to you rather than deciding — and we tell you it arrived.

Consent records

Every document can carry a purpose tag, a consent reference and a collection date as first-class fields, visible in search filters and exported with the record. The point is boring and important: a consent decision made in 2019 is only defensible in 2027 if it is attached to the file rather than in a register nobody opens.

Purpose limitation and minimisation

Per-field encryption and redaction at capture let you keep the fact of verification without keeping the identifier. Templates ship with the sensitive fields already flagged, so a document class marked 'loan file' asks about ID-number handling at scan time instead of at audit time.

Reading is minimised by design: OCR runs in the user's browser, so the processor never sees a readable page unless a user chooses server reading for a specific document. That choice is asked per document, explains who will see the page, and is logged with the engine used and the page count — never the content.

Retention clocks and erasure

Each record carries an expiry derived from purpose. A saved search of 'expired in 2026' produces the list, a single action deletes blob, metadata, embeddings and OCR artefacts, and the deletion receipt — including the retained SHA-256 of what was destroyed — is your evidence. Erasure by subject request is one query for a name.

Breach duties

If your ciphertext is exposed, we notify you in writing within 24 hours of confirmation with the affected hash list, and support your fiduciary-side notice to the Board with the log extracts you need. Our own failure to notify on that clock is a contractual breach, not a good-faith effort.

Cross-border transfer

Storage, processing and support access remain in India. Enterprise workspaces pin the region contractually; a change requires your written instruction. If the government notifies a restricted-country list affecting your sub-processor, you hear from us within 5 business days.

What you still owe yourself

A processor does not write your privacy notice, take valid consent, or decide that a record class may be destroyed. The three artefacts you should have before a DPDP conversation go anywhere near a scanner: a record inventory, a retention schedule with named owners, and one grievance contact published where people can find it.