How the Forum handles personal data, stated in the terms the Digital Personal Data Protection Act, 2023 requires of any Data Fiduciary.
The website itself collects nothing, no cookies, no analytics, no tracking, no forms that transmit. The only personal data the Forum holds is what a person deliberately sends it in correspondence, and it is used solely to reply to that correspondence.
This notice is issued by DPDPA Forum, a Section 8 non-profit company incorporated under the Companies Act, 2013, CIN U85499MH2026NPL470552. For the purposes of the Digital Personal Data Protection Act, 2023 ("the Act"), the Forum is a Data Fiduciary in respect of the personal data described in clause 3.
The Forum is not a regulator, not a government body, and not affiliated with the Government of India. It publishes standards and interpretation guidance; it exercises no statutory power over any person. Nothing in this notice is a statement of law.
This website is built to collect nothing. Specifically, it:
Web fonts are requested from Google Fonts, which receives the requesting IP address as a technical necessity of delivery. No other third party is contacted by any page on this site.
The Forum holds personal data only where a person sends it. In each case the data is provided by the Data Principal directly and voluntarily.
Name, professional email, organisation and role, and the free-text statement of how the person wishes to participate. Sent by messaging or written correspondence at the person's initiative.
Name, organisation, designation, contact details, and any accessibility or dietary requirement a delegate chooses to disclose for the purpose of attending a chapter.
Name and affiliation of the commenter, together with the comment. Where the Forum publishes a record of comments received, it publishes the name and affiliation as attribution unless the commenter asks in writing that the comment be recorded anonymously.
The hosting provider records IP address, timestamp, requested path and user agent for each request, for availability and abuse prevention. The Forum does not read these logs for any other purpose and does not join them to any other record.
The Forum does not seek, and asks that correspondents do not send, personal data beyond what a matter requires, in particular financial account details, government identifiers, or health information.
Personal data is processed only for the specified purpose for which it was given, as required by Section 5 and Section 6 of the Act:
Personal data is never used for advertising, profiling, automated decision-making, or any purpose other than those listed. It is never sold, rented, or licensed. The Forum does not send marketing communications.
Under Section 8(7) of the Act, personal data is erased once the purpose for which it was collected is no longer being served. The Forum's periods are:
The Forum discloses personal data only in these circumstances:
Where a processor stores data outside India, that is permitted under Section 16 of the Act subject to any restriction the Central Government notifies. The Forum maintains a current list of its processors and will supply it on request under clause 12.
Under Section 8(5) of the Act the Forum takes reasonable security safeguards to prevent a personal data breach. These are: encryption in transit for the whole website and all correspondence channels; access to correspondence restricted to the officers whose function requires it; no use of shared credentials; and collection minimisation as a matter of design, which is why this site carries no forms that transmit.
In the event of a personal data breach the Forum will give intimation to the Data Protection Board of India and to each affected Data Principal, in the form and manner Section 8(6) requires.
A person whose personal data the Forum holds may exercise the following rights. The Forum charges nothing and asks for no identity document beyond what is needed to be satisfied the request comes from the right person.
A summary of the personal data held, the processing undertaken, and the identity of any other fiduciary or processor with whom it has been shared.
Erasure is given effect unless retention is required for a specified purpose or by a law in force, for example an attributed comment already published as part of a consultation record.
Withdrawal is as easy as giving consent was: one message to the address in clause 12, with no reason required. Processing stops within a reasonable time of withdrawal.
A readily available means of registering a grievance, described in clause 9.
A Data Principal may nominate another person to exercise these rights in the event of death or incapacity.
The Act also places duties on the Data Principal under Section 15, including that a request be genuine and not frivolous.
A grievance about the Forum's handling of personal data may be registered through the contact channel in clause 12, marked Grievance, personal data. The Forum acknowledges within 7 days and responds substantively within 30 days of receipt.
If the response is unsatisfactory, or the period lapses without one, the Data Principal may complain to the Data Protection Board of India under Section 13(3) of the Act. Exhausting the Forum's own process first is a precondition to that complaint.
Grievances about the Forum's standards work, the substance of a published framework, or the conduct of a working group, follow a separate route set out on the Governance page and are not handled under this clause.
The Forum's work is directed at professionals and institutions. It does not knowingly collect the personal data of a child, and it neither undertakes tracking or behavioural monitoring of children nor directs advertising at them, conduct Section 9(3) of the Act prohibits in any case.
Where a Forum programme is delivered to students below eighteen, verifiable consent of the parent or lawful guardian is obtained before any personal data is processed, as Section 9(1) requires. If a child's personal data has reached the Forum without such consent, notice under clause 12 will cause it to be erased.
This notice is versioned. A change that widens the purposes of processing, adds a category of personal data, or lengthens a retention period takes effect no earlier than 30 days after the new version is published, and is announced on this page. Superseded versions remain retrievable so that a person can see what was in force when their data was given.
Requests under clause 8, grievances under clause 9, and any question about this notice should be addressed to the officer responsible for data protection at the Forum, through either channel below.
DPDPA Forum, at the registered office recorded against CIN U85499MH2026NPL470552 on the register of the Ministry of Corporate Affairs.
Data Protection Board of India, under Section 13(3) of the Act, after the Forum's own process is exhausted.
Read with the Terms of use, which govern the use of this website and of the standards published on it.