Terms & conditions

These terms govern access to and use of the website at https://dpdpvault.com and the DPDP Vault platform, operated by DPDP Vault (“we”, “us”, “our”). By accessing the Site or using the Platform you agree to be bound by them.

1. Definitions

• “Platform” means the DPDP Vault software, in any deployment model.
• “Customer” means the organisation that has contracted for the Platform.
• “User” means an individual authorised by a Customer to use the Platform.
• “Customer Data” means data a Customer or its Users load into or generate in the Platform.
• “the Act” means the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
• “Data Fiduciary”, “Data Processor”, “Data Principal” carry the meanings given in section 2 of the Act.

2. Eligibility and account responsibility

Users represent that they are legally competent to enter into binding agreements and are authorised by the Customer to act on its behalf. Customers are responsible for credential confidentiality and for all activity conducted through their accounts, including access they delegate to others.

Access granted by a Customer to another person is derivative and revocable. Termination of the originating account revokes it automatically.

3. The services

The Platform assesses an organisation’s posture against the Act, executes tests against controls that are testable, and produces evidence packs. It is a compliance tooling product.

4. Roles under the DPDP Act

For Customer Data, the Customer is the Data Fiduciary and we are a Data Processor. We process Customer Data only on the Customer’s documented instruction and for no independent purpose of our own.

We do not, and will not without a separate written agreement:

• use Customer Data to train or improve models;
• aggregate Customer Data across customers for benchmarking or research;
• disclose Customer Data to any third party except a sub-processor engaged under section 8(2) or where a law in force in India requires it.

For personal data we collect about visitors, prospects and Users in our own right, we are the Data Fiduciary. Our privacy policy governs that processing.

5. Your obligations as a Data Fiduciary

Section 8(1) makes a Data Fiduciary responsible for compliance irrespective of any agreement to the contrary, including for processing carried out on its behalf by a processor. Nothing in these terms transfers that responsibility, and no vendor can accept it.

The Customer warrants that it:

• has a lawful basis for the personal data it loads into the Platform;
• has given the notices the Act requires to the relevant Data Principals;
• will issue erasure, correction and access instructions promptly enough for us to act within its own statutory timelines;
• will not load personal data that is not necessary for the assessment it is running.

6. Our obligations as a Data Processor

Under the contract required by section 8(2), we will:

• process Customer Data only on documented instruction;
• maintain security safeguards mapped clause by clause to Rule 6, set out in the security schedule to the agreement;
• bind every sub-processor to equivalent obligations and give notice before adding one;
• assist the Customer in responding to Data Principal requests within its timelines;
• erase Customer Data on instruction, including from replicas, caches, indices and backups within the stated backup-expiry window, and certify that we have;
• make available the records the Customer needs to evidence its own compliance;
• submit to audit on the terms set out in the agreement.

7. Personal data breaches and escalation

Where we operate the Platform, we will usually become aware of an incident before the Customer does. We escalate within the period stated in the agreement, expressed in hours from our own awareness and sized so that the Customer’s 72-hour obligation under Rule 7 and its 6-hour CERT-In obligation both remain achievable.

The duty to intimate the Data Protection Board and affected Data Principals under section 8(6) is the Customer’s. We provide the incident record, scope of affected data, and affected-individual list needed to discharge it.

8. Deployment models

The Platform is offered on-premise operated by the Customer, on-premise operated by us, or as a managed service hosted in India. The model selected changes our role, what crosses the boundary and who detects an incident first - it does not change the Customer’s status as Data Fiduciary. See deployment models; the applicable model and its terms are recorded in the order form.

Where the Customer operates an on-premise deployment with telemetry disabled, we ordinarily process no personal data of the Customer and take on no role under the Act in respect of it.

9. Communications and consent

We send transactional and service communications necessary to provide the Platform - security notices, incident notifications, billing and service changes. These are part of the service and continue for its duration.

Marketing communications are sent only where separate consent has been given by a clear affirmative action. Consent to marketing is never a condition of using the Site or the Platform, and it can be withdrawn in a single step by replying to any such message or writing to hello@dpdpvault.in.

10. Fees and taxes

Fees, billing frequency and term are set out in the order form. All fees are exclusive of GST and other applicable taxes unless stated otherwise. Fees for a subscription period already commenced are non-refundable except where these terms or the order form expressly provide otherwise.

11. Content, confidentiality and IP

The Customer retains all rights in Customer Data and grants us only the limited licence needed to provide the Platform. We retain all rights in the Platform, the control library, the sector packs, the test suites and all associated materials.

Assessment outputs generated for a Customer belong to that Customer. Each party will keep the other’s confidential information confidential and use it only for the purposes of the agreement.

12. No guarantee of compliance outcomes

Use of the Platform does not guarantee any outcome, including compliance with the Act, a favourable audit, or a particular determination by the Data Protection Board. A passing test evidences the behaviour tested at the time it ran, in the environment it ran against - it is not a certification and it is not a defence.

Statutory references in the Platform reflect the Act and Rules as at the date stated. Central Government notifications under section 16 and the Rules change over time and must be re-verified each assessment cycle.

13. Limitation of liability

The Platform is provided on an “as is” and “as available” basis save as expressly warranted in the agreement. To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for loss of profits, business or goodwill.

Each party’s aggregate liability is capped at the fees paid or payable in the twelve months preceding the claim, except that this cap does not apply to a party’s indemnity obligations, breach of confidentiality, infringement of the other’s intellectual property, or liability that cannot be limited by law.

14. Indemnity

The Customer will indemnify us against claims arising from Customer Data loaded without a lawful basis, from use of the Platform in breach of these terms, and from the acts of persons to whom the Customer has delegated access. We will indemnify the Customer against claims that the Platform infringes a third party’s intellectual property rights.

15. Suspension and termination

We may suspend access where there is a material security risk, non-payment after notice, or use that breaches these terms or applicable law. We will give notice before suspending unless an immediate security risk makes that impossible.

Either party may terminate for material breach not remedied within 30 days of written notice. Sections on confidentiality, IP, indemnity, liability and data erasure survive termination.

16. Data return and erasure on exit

On termination the Customer may export its data and its evidence packs for 30 days. After that period we erase Customer Data from active systems within 30 days and from backups on their ordinary expiry cycle, and we certify erasure on request.

Where we hold logs or evidence a Customer needs to discharge its own obligations, those records are exported to the Customer before erasure rather than deleted with everything else.

17. Force majeure

Neither party is liable for failure or delay caused by events beyond its reasonable control, including acts of God, war, riot, pandemic, or governmental action. This does not excuse an obligation to pay, nor the breach-escalation duty in section 7 to the extent performance remains possible.

18. Governing law and disputes

These terms are governed by the laws of India. Disputes will be resolved by arbitration under the Arbitration and Conciliation Act, 1996, seated at Chennai, Tamil Nadu, conducted in English before a sole arbitrator.

Nothing here limits a Data Principal’s statutory right to complain to the Data Protection Board of India. Under section 6(2) of the Act, any term purporting to waive a right under the Act is invalid to that extent, and we do not ask anyone to agree to one.

19. Assignment

Neither party may assign these terms without the other’s written consent, except to an affiliate or successor in a merger or sale of substantially all assets, and provided the assignee assumes the data-protection obligations in full. We will give the Customer notice of any such assignment.

20. Changes to these terms

We may update these terms. Material changes take effect 30 days after we notify the Customer, and a Customer who does not accept a material change may terminate before it takes effect without penalty for the unexpired term. Continued use is not treated as acceptance of a change we did not notify.

21. General

These terms together with the order form and its schedules form the entire agreement. If a provision is held invalid the remainder continues in effect. Failure to enforce a provision is not a waiver of it. Headings are for reference only.

Questions: hello@dpdpvault.in. Privacy matters: hello@dpdpvault.in.

Version 22 August 2026 · See also our privacy policy.