Data Principal Notice
Your rights under India's Digital Personal Data Protection Act, 2023 — explained clearly.
Who is the Data Fiduciary?
Under the DPDP Act, the entity that determines the purpose and means of processing your personal data is called the Data Fiduciary. For this website and any personal data collected through it, the Data Fiduciary is:
Dibyam Prabhat
Proprietor, Indic Shield Technologies (sole proprietorship)
Innov8, Prestige Tech Platina, 11th Floor, 32/2, 34/1
Kadabisanahalli, Bengaluru, Karnataka, India – 560087
Contact: dibyam@indicshield.ai | +91 78297 64838
GSTIN: 29BIMPP5462N1ZB | Udyam: UDYAM-KR-03-0699368
What Personal Data We Process
Personal data means any information that can identify you, directly or indirectly. We process the following categories:
- Contact information: Name, email address, phone number (when you contact us)
- Professional information: Company name, job role (if provided in a business enquiry)
- Communication content: The text of messages you send us
- Technical data: IP address and browser information, logged automatically by our hosting infrastructure
We do not process sensitive personal data (as defined in the SPDI Rules 2011) unless specifically required for a service engagement and with your explicit consent.
Purpose of Processing
We process your personal data for the following purposes:
- To respond to enquiries and provide information about our services
- To deliver cybersecurity and compliance services under an engagement agreement
- To send security advisories and insights — only if you have subscribed and consented
- To maintain server logs as legally required under CERT-In Directions, 2022
- To detect and prevent fraud, abuse or security incidents on our website
Your Rights as a Data Principal
The DPDP Act 2023 gives you, as a Data Principal (the person whose data we process), the following rights. These rights are enforceable once the Data Protection Board of India is constituted and operational.
Right to Access
Request a summary of what personal data we hold about you and how it is being processed, including categories of data, processing purposes, and parties with whom it is shared.
Right to Correction
Request correction of inaccurate, incomplete or outdated personal data that we hold about you.
Right to Erasure
Request deletion of your personal data when it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations (e.g. 180-day server log retention under CERT-In).
Right to Grievance Redressal
Lodge a complaint with our designated Grievance Officer. If unresolved within 30 days, escalate to the Data Protection Board of India once it is constituted.
Right to Nominate
Nominate another individual to exercise your data rights in the event of your death or incapacity, as provided under Section 14 of the DPDP Act.
Right to Withdraw Consent
Withdraw consent for processing at any time, where processing is based solely on consent (e.g. newsletter subscription). Withdrawal does not affect the lawfulness of processing before withdrawal.
How to Exercise Your Rights
To exercise any of the rights listed above, submit a written request to our Grievance Officer:
Dibyam Prabhat
dibyam@indicshield.ai
+91 78297 64838
Please include your name, contact details, and a description of the right you wish to exercise. We will acknowledge your request within 7 days and resolve it within 30 days of receipt. For complex requests, we may request a reasonable extension and will notify you.
We may need to verify your identity before acting on a request to protect against unauthorised access to your data.
Consent and Withdrawal
Where our processing is based on your consent (for example, newsletter subscription), you may withdraw consent at any time by:
- Clicking the "Unsubscribe" link in any newsletter email
- Emailing dibyam@indicshield.ai with "Withdraw consent" in the subject line
Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. Processing that is based on legal obligation (such as server log retention) cannot be stopped through consent withdrawal.
Compliance and Penalties
We take compliance with the DPDP Act 2023 seriously. The Act carries significant penalties for non-compliance by Data Fiduciaries:
Per instance of non-compliance, as determined by the Data Protection Board of India. We are committed to compliant data practices and proactive compliance.
Our target for full compliance with the DPDP Rules, 2025 is 13 May 2027, the deadline set by the Ministry of Electronics and Information Technology (MeitY). We are actively building compliant systems and practices ahead of that date.
Statutory Framework
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- DPDP Rules, 2025 (notified by MeitY)
- IT Act, 2000 and SPDI Rules, 2011 (remain in effect until superseded)
- CERT-In Directions, 2022 (6-hour incident reporting; 180-day log retention)
Full Privacy Policy
This notice is a summary of your key rights under the DPDP Act. For complete information on how we collect, use, share and retain your personal data, please read our Privacy Policy.