DPDP Compliance — VirasatVault™ | DPDP Act 2023 Aligned

Section 01

What is the DPDP Act, 2023?

The Digital Personal Data Protection Act, 2023 ("DPDP Act") is India's landmark privacy law. It establishes how organisations ("Data Fiduciaries") may collect and process the personal data of Indian residents ("Data Principals"), and creates enforceable rights backed by the Data Protection Board of India.

VirasatVault^™ processes some of the most sensitive personal information a family can share — assets, identity documents, nominees, and final wishes. We treat DPDP alignment as a baseline, not a milestone.

Section 02

How VirasatVault Complies

Lawful Basis

Every data point is collected under an explicit, itemised consent you grant during onboarding.

Consent Management

A dashboard lets you review, modify, or withdraw consent for each processing purpose.

Data Minimisation

We only collect what is necessary to deliver wealth-continuity services to your family.

Encryption

AES-256 at rest, TLS 1.3 in transit, with rotating server-side keys held in a managed vault.

Access Control

Row-level security and MFA ensure only you and people you authorise can see your Vault.

Incident Response

A 72-hour breach notification commitment with documented runbooks and audit logs.

Purpose Limitation

Your data is never used for advertising, profiling, or sale to third parties.

Records of Processing

Immutable audit logs record every administrative action affecting your data.

Section 04

Your Rights as a Data Principal

Right to Access — request a complete summary of personal data held about you
Right to Correction — request rectification of inaccurate or incomplete data
Right to Erasure — request deletion when data is no longer necessary
Right to Withdraw Consent — at any time, with no penalty
Right to Grievance Redressal — escalate to our Data Protection Officer
Right to Nominate — appoint someone to exercise these rights on your behalf in case of incapacity or death

Section 05

How We Protect Your Family Legacy

Encrypt

AES-256 envelope encryption applied before data touches storage.

Isolate

Row-level security ensures one Vault cannot see another.

Audit

Every privileged action is logged immutably for compliance review.

Authenticate

Multi-factor authentication and OTP-secured trigger workflows.

Backup

Daily encrypted backups stored within Indian data centres.

Respond

Documented 72-hour incident response and breach notification.

Section 06

Secure Infrastructure

Hosting on ISO 27001 and SOC 2 audited cloud regions located within India
Hardware security modules for cryptographic key management
Continuous vulnerability scanning and dependency monitoring
Network isolation between application, database, and audit layers
Annual third-party security review

Section 07

Retention & Erasure

Personal data is retained only as long as your subscription remains active or as required by Indian tax and accounting law. On verified deletion request, active-system data is purged within 30 days and backup copies within 90 days.

Section 08

Contact for Privacy Requests

Data Protection Officer
VirasatVault^™, Hyderabad, India
Email: hello@virasatvault.com
Subject line: "DPDP Request — [Access / Correction / Erasure / Withdraw Consent]"

Questions about this document? Email hello@virasatvault.com or write to VirasatVault^™, Hyderabad, India.