Skip to content

Data Protection and DPDP

Applies to: All subscriptions

Purpose

Set out what personal data a Complifly deployment holds, where the customer's obligations under India's Digital Personal Data Protection Act fall, and what the Data Privacy module provides for organisations that must evidence compliance.

Audience

Data protection officers, compliance and legal teams, security reviewers, and administrators configuring the privacy module.

Prerequisites

This page describes what the software does. It is not legal advice. The customer's obligations under the Act are determined by their circumstances and their legal advisers, not by this portal.

Reference

What personal data is present

Complifly is primarily a business-to-business compliance system, so most of what it holds is corporate rather than personal. Personal data nonetheless appears in several places:

Category Examples Source
Platform users Name, email, role, activity history Created by the customer's administrators
Counterparty contacts Names and contact details on party records Master data supplied by the customer
Identity numbers Permanent account numbers and similar identifiers, where verification is used Verification workflows
Transport details Driver and vehicle information on e-Way Bills Operational data
Audit records Who did what, when Generated by use

Sole proprietors are a case worth noting: a business counterparty may also be a natural person, so a party record that looks corporate can contain personal data.

Technical measures already in place

Measure Detail
Tenant isolation Enforced in the database. See Multi-Tenancy and Row-Level Security
Access control Role-based, with separate GSTIN-level access
Field encryption Sensitive identity numbers are encrypted at rest. The key must be backed up separately from the database
Encryption in transit TLS externally; encrypted database connections internally
Attribution Audit trail identifies the actor for each action
Signed, expiring download links Generated files are not permanently accessible

The Data Privacy module

Licensed separately. Where enabled it provides:

Capability What it does
Notices and versions Author privacy notices, version them, publish a specific version
Purposes Declare the purposes for which data is processed, and activate or retire them
Consent capture and withdrawal Record consent against a purpose and notice version, and record withdrawal
Consent checking Query whether a valid consent exists before processing
Grievances Record and resolve complaints from data principals
Evidence packs Generate a printable evidence set for a point in time
Audit ledger A tamper-evident record of privacy-relevant actions
Connectors and webhooks Propagate consent state to downstream systems, with delivery logs
Reporting Consent status and notice-version reports

The most operationally significant of these is notice versioning: consent is recorded against a specific version of a specific notice, so it remains meaningful after the notice changes. A consent record that does not name what was consented to is difficult to defend.

Where obligations sit

Obligation Typically sits with Note
Deciding purposes and lawful basis The customer Complifly processes on the customer's instruction
Issuing notices The customer, using the module —
Responding to data principal requests The customer Complifly provides the tooling
Retention limits The customer, within statutory constraints Compliance evidence has its own retention obligation that may exceed a data-minimisation preference
Security measures Shared Customer configuration, Complifly platform
Breach notification Per the agreement between the parties Confirm the process before it is needed

Verify: The processing terms between the customer and Complifly, and the roles each party takes under the Act, are contractual. Confirm them; do not infer them from this page. Recorded as assumption D5 in the Assumptions Register.

Retention is a genuine tension

Compliance evidence — IRNs, signed responses, payloads — must be retained for a statutory period. That obligation can sit uncomfortably with data-minimisation instincts. The rule to apply: statutory retention wins over a preference to delete, and any deletion policy must be checked against it before implementation.

Verify: The retention period Complifly applies to compliance evidence, and its statutory basis, are not stated in this portal. Recorded as assumption C2 in the Assumptions Register.

Validation

Where the Data Privacy module is in use:

Check Method Pass condition
A notice is published Open the published notice Present, with a version identifier
Purposes are declared Review the purpose list Each purpose is meaningful and active or deliberately retired
Consent is captured against a version Record a test consent and inspect it It names the notice version and the purpose
Withdrawal works Withdraw the test consent Recorded, with a timestamp
Consent checking works Query consent for a principal Returns the correct state
Grievance flow works Raise and resolve a test grievance Recorded end to end
Evidence pack generates Generate one Produces a printable, complete artefact
Audit ledger records actions Perform a privacy action and inspect the ledger Entry present
Downstream propagation works Test a connector or webhook Delivered, and logged
Field encryption works Inspect a stored identity number directly in the database Not readable in clear text
Encryption key recoverable independently Confirm its backup location Recoverable without the database backup

Troubleshooting

Symptom Cause Action
Consent records do not identify what was consented to Consent captured without a notice version Re-capture against a published version. Consent that does not name the notice is hard to defend
Withdrawal not reflected downstream Connector or webhook failing Check the delivery logs and re-test the connector
Evidence pack incomplete Notices or purposes not fully configured Complete the configuration before generating
Identity numbers unreadable after a restore Encryption key not restored with the data Restore the original key. Nothing else recovers them
A deletion request conflicts with retention Statutory retention applies to compliance evidence Statutory retention wins. Record the decision and the basis
Privacy module absent Not licensed, or not enabled for the GSTIN See Modules and Licensing
Unclear who is responsible for a breach notification Processing terms not settled Settle them before an incident, not during one
Personal data found in application logs Verbose logging enabled during diagnosis Reduce the level and purge the affected logs