DPDP and GDPR Compliance

India’s data protection law is changing in phases, and a reviewer needs to know which rules bind whom on which date.

The DPDP Act applies to processing of digital personal data in India, and to processing outside India connected with offering goods or services to people in India (section 3). It reaches us both ways. The exemption in section 17(1)(d), for processing in India of data of people outside India under a contract with a foreign person, is for persons based in India, and we do not rely on it.

The GDPR applies only if you hold personal data of people in the European Union in SorviAI; its own section covers that.

Everything else on this page follows from a single distinction, and getting it the wrong way round is the most common error a vendor makes about their own position.

A worked example, because the abstraction is slippery. A manufacturer in Pune uses SorviAI Finance and stores its own customers’ names, addresses and payment histories. It decides what that data is for, so it is the Data Fiduciary. We hold and process it for the manufacturer, so we are its processor. We may not decide to use it for a purpose of our own: doing so would make us a Data Fiduciary of data nobody authorised us to use.

The same manufacturer records its staff’s attendance in Worklink. That makes it the Data Fiduciary of its employees’ attendance data too, with the duties Indian employment law attaches to it, which the Worklink section sets out.

Until 13 May 2027, under the SPDI Rules, the same split holds in substance: you collect the information from the people concerned and answer to them for it, and we process it for you under contract.

From 13 May 2027 a Data Fiduciary may use a processor only under a valid contract (DPDP Act, section 8(2)), and the DPDP Rules expect that contract to provide for reasonable security safeguards. Ours is already in place.

It covers the subject matter and duration of the processing, its nature and purpose, the categories of data and of people, processing only on your instructions, confidentiality obligations on our staff, the security measures we apply, the conditions under which we engage a sub-processor, our help with the rights of the people in your data and with complaints, breach notification, erasure or return of your data at the end, and your audit rights.

Its security annex turns every security statement on this page and on our Security page into a contractual commitment. An overstated measure in that annex would be a breach of contract as well as an inaccuracy, which is why the security section below states the gaps next to the controls.

It does not name our sub-processors in its own text. That list changes when a vendor changes, and a list inside the agreement would mean re-executing the agreement each time; it is referenced by address instead, which is the next section.

A sub-processor is any third party that can touch your personal data: hosting, email delivery, error tracking, support tooling, payment providers.

• The list is published, not supplied on request. It lives on our Compliance page, with the vendor, what they do, what they can reach and where they hold it.
• Our own suppliers are listed apart from yours. Our sub-processors are DigitalOcean (hosting: the application, the database and uploaded files, all in London), Cloudflare (network delivery and protection, supplied through DigitalOcean), Twilio SendGrid (email, United States), Stripe (our own billing), Sentry (error monitoring and session replay, in its EU region in Frankfurt, Germany), GeoNames (time-zone lookup from a postal code, Switzerland), Google Fonts (font delivery on the app), Google Docs Viewer (previews of Office attachments, which receives a signed, time-limited link to the file), jsDelivr with unpkg as fallback (delivery of the PDF preview component, flag and emoji images and the animation runtime) and Microsoft 365 (our support mailbox, which receives whatever you send us in a support request).
• Integrations you switch on are yours to direct. UPS, FedEx, DHL, Microsoft 365 for TeamEmail and your own Stripe account are integrations you direct, not our sub-processors. Online invoice payment through the Customer Portal uses Stripe Connect: the money goes to your own connected Stripe account, but SorviAI creates that account and makes the charges with its own Stripe platform key, and the payer’s email address and invoice number are sent to Stripe.
• No AI provider. SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with where it processes data.
• You are told before a new one starts, not after. We announce a change on the published list and email workspace account owners at least 30 days in advance, and you can object under the Data Processing Agreement. There is no separate subscription for these notices.
• Each must be bound by terms no weaker than ours. We stay responsible to you for each of them.

Your data is not kept in India. The application, the database and uploaded files are hosted in London, error reports are processed in Germany, several suppliers are US companies, and some of our team work from India.

Logs that CERT-In may ask for also stay in London, which CERT-In’s FAQs allow if they are produced to it within a reasonable time; our CERT-In Incident Reporting and Log Retention Policy explains.

From 13 May 2027, the people whose data you hold (Data Principals) can ask you for a summary of their data and how it is used, for correction, completion, updating and erasure, and can nominate someone to act for them on death or incapacity (DPDP Act, sections 11 to 14). A request comes to you, not to us; our obligation is to give you what you need to answer it. The table states what the product does today.

Where a request needs us, our turnaround is 10 working days. The DPDP Rules give you at most 90 days to respond, and the SPDI Rules one month for a grievance today, so ours is set well inside both.

A request that spans several modules needs our engineering team today, because nothing in the product assembles one person’s data across modules. That matters to you more than the format does: a request you cannot fulfil without emailing your supplier is a request with our queue in the middle of it.

Children

From 13 May 2027, processing the data of anyone under 18 needs verifiable consent from a parent or guardian (DPDP Act, section 9). SorviAI has no feature for collecting it. If you hold children’s data, for example as a school or coaching centre, you need your own process.

Worklink records working time and holds employee records. That engages Indian employment law as well as data protection law. You are the Data Fiduciary; we are your processor. Under the DPDP Act an employer may process employee data for employment purposes without asking for consent (section 7(i)), but the security and other duties still apply. This section sets out what employers ask us about most, what Worklink does today, and where it falls short.

What Worklink records. For each working day: the check-in and check-out times and the hours, breaks and overtime calculated from them; late arrival and early departure, in minutes, with any reason the employee gave; how the check-in was made (web app, header, administrator, automatic, personal link or kiosk tablet with a code or login) and which kiosk tablet; and the IP address of the check-in and of the check-out. The IP address is recorded every time, and there is no setting to switch it off. Worklink does not record location coordinates, photographs or biometrics at check-in. It also marks employees absent automatically each day, and can clock people out automatically if you switch that on (off by default).

Employee profiles can also hold personal details, home addresses, identification numbers, bank account details and annual pay, dependants with their dates of birth, education and career history, performance reviews, assets, training, exit interviews, uploaded documents, and leave records, including sick leave with the free-text reason each request requires. The visitor desk can record a visitor’s ID type and number.

An employee who wants to see or correct their attendance record should ask their employer, who is the Data Fiduciary. We help the employer answer.

Employee data in Worklink: what to check

The DPDP Act asks for an impact assessment and an independent audit only of a Significant Data Fiduciary (section 10). From 13 May 2027 the DPDP Rules also expect a Data Fiduciary, and so its processors, to keep logs and the personal data involved for at least one year to investigate breaches, unless another law says otherwise (rule 6).

From 13 May 2027, a Data Fiduciary must tell the Data Protection Board of India and each person affected of a personal data breach without delay, and give the Board a detailed report within 72 hours (DPDP Rules 2025, rule 7). Our duty is to tell you early enough that you can meet that.

• Our commitment: without undue delay, and in any case within 48 hours of confirming an incident affecting your data.
• What you would be told: what happened, which categories of your data were involved, when it occurred and when we detected it, what we have done, and what you need to do.
• Who we would tell: the workspace administrators on record, and any additional contact you have given us for this purpose.
• CERT-In: we report the cyber incidents CERT-In lists within 6 hours of noticing them, whether or not personal data is involved. You have the same duty for incidents in your own systems.

Where we are ourselves the Data Fiduciary (our own sign-up, marketing, newsletter and careers data), we will notify the Board and the people affected as rule 7 requires from 13 May 2027.

The same commitment appears on our Security page, and the two are not allowed to differ. If you find that they do, the shorter one binds and we have a documentation failure to fix.

The SPDI Rules ask for reasonable security practices now, and from 13 May 2027 section 8(5) of the DPDP Act and rule 6 of the DPDP Rules ask for reasonable security safeguards. Ours are described in full on the Security page rather than summarised twice and allowed to drift apart. These are the ones reviewers ask about first, with the limits we know about. We are not certified to ISO/IEC 27001.

• Tenant isolation. Each customer is provisioned with a dedicated PostgreSQL schema, so your records are not co-mingled in shared tables.
• Access control. Permissions are role-based and scoped per application, and administrative rights are tiered rather than binary.
• Authentication. Each user can switch on two-factor authentication with recovery codes. Administrators cannot yet require it, it is not offered to Portal users, and there are no hardware keys or single sign-on.
• Audit logging. An audit log is written into your own schema, isolated on the same boundary as your data, and read-only through every interface. The audit log screen has no export; the Activity Log report exports user actions across Finance and Inventory. Coverage is incomplete: Repairs logs deletions only, most settings areas and several modules write nothing, and some sign-in routes write no entry. It is not tamper-evident (no hash chain, signature or write-once storage), and an entry is not written in the same transaction as the change it describes, so a failed write loses the entry rather than the change. Entries are kept for the life of the workspace.
• Staff access. Our support staff open a workspace as one of your users only for support, abuse or legal reasons, with a senior engineer’s approval. The start of that session is recorded in the same transaction as the access, and a banner shows in your interface; the actions taken during the session are not separately logged. Our director and one or two senior engineers can also connect to production databases directly. That access is reviewed every quarter, and those connections leave no audit record.
• Encryption. In transit, with TLS, with these exceptions: connections to the cache (which holds sessions) and the real-time Channels layer use TLS without verifying certificates (only the task broker verifies), the GeoNames lookup uses plain HTTP, and the public storefront reaches the backend over plain HTTP on the private network. At rest, DigitalOcean encrypts the database volumes (LUKS, AES-XTS with a 512-bit key) and the database backups (AES-256), and states that files in its object storage are encrypted at rest.

This is the section a vendor is most tempted to write loosely, and the one where a loose sentence causes the most damage. It concerns what happens when someone asks you to erase their data and that data sits inside your accounts.

An accounting system should be built so that booked records are immutable. Invoices, journal entries and ledgers are not meant to be editable after the fact, and Indian law requires them to be kept for years: books of account for eight years (Companies Act 2013, section 128) and GST records for 72 months from the due date of the annual return (CGST Act 2017, section 36). An issued tax invoice is corrected by a credit or debit note, not by editing it. The DPDP Act lets you keep personal data where another law requires it.

SorviAI does not yet meet that standard in full. A posted invoice can be permanently deleted from Trash, sent and partly paid invoices can be edited in place, lines and totals included, and the audit log is not tamper-evident.

So an erasure request can collide with a retention obligation, and both are legal requirements pointing in opposite directions. The resolution is not to pick one: it is to establish which data carries a retention obligation, to separate personal data from the transactional record, and to pseudonymise rather than delete where retention is mandatory.

Our retention periods for your data

These are the periods for the data we hold as your processor. Our Privacy Policy carries the full table, including the data we hold as Data Fiduciary.

We would rather show you an unanswered question than a promise the platform cannot perform. Promising erasure that a retention rule forbids is a commitment breached routinely, quietly, and in writing.

If you hold personal data of people in the European Union in SorviAI, for example your customers or suppliers there, the GDPR (Regulation (EU) 2016/679) can apply to that data as well, and you are its controller and we are your processor.

• The agreement. The Data Processing Agreement carries the terms article 28 of the GDPR requires, for that data only.
• Transfers. Data from the European Union reaches London under the European Commission’s adequacy decision for the United Kingdom. Sentry processes error reports in Frankfurt. Our US suppliers rely on the EU-US Data Privacy Framework for the data their certification covers; the agreement sets out the detail, including the gap for HR data reached from the United States by our hosting provider.
• Our team in India. They are employees of SORVI AI LTD, so their access is not a transfer to another organisation.
• Complaints. People in the European Union can complain to their data protection authority; the European Data Protection Board lists them at edpb.europa.eu.

• Complaints to us. A complaint about personal data we handle goes to our Grievance Officer, Deepak Gupta, at [email protected] or through the form on our contact page. It is acknowledged within 24 hours and answered within one month (SPDI Rules 2011, rule 5(9)). A complaint about data in a customer’s workspace goes to that customer first, and we help it answer.
• The Data Protection Board of India. From 13 May 2027, a person who has used the Data Fiduciary’s grievance route and is not satisfied can complain to the Board (DPDP Act, section 13(3)). The Board was established on 13 November 2025 and takes complaints online.
• Automated decisions. SorviAI makes no decisions based solely on automated processing with legal or similarly significant effect. Worklink marks employees absent automatically each day, and can clock people out automatically if you switch that on; these are records you review and correct.

For a signed copy of the Data Processing Agreement, a request that needs our help, or a question this page does not answer. One address reaches us wherever you are. This page is in English, and we answer in English.

Data Protection Officer

The DPDP Act requires a Data Protection Officer, based in India, only of a Significant Data Fiduciary, which the Government notifies by the volume and sensitivity of the data it handles and the risks involved (section 10). We have not been notified as one. Our Grievance Officer answers questions and complaints about personal data, and our director is responsible for data protection. If we are ever notified, we will appoint an officer and name them here.

This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

The words on this page that carry a specific legal meaning, in plain language.