Legal
DPDP Act 2023 Compliance
Version 1.0 · Effective 21 June 2024
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's primary legislation governing the collection, processing, storage, and transfer of personal data. It establishes rights for individuals (“Data Principals”) and obligations for organisations that process personal data (“Data Fiduciaries”).
Sahayogi One Private Limited is a Data Fiduciary under the DPDP Act. This page explains how we implement the Act's requirements across our products and services — and what it means in practice for every person whose data we process.
1. Who This Applies To
The DPDP Act applies to the processing of digital personal data — information relating to an identifiable individual, in digital form.
Sahayogi One Private Limited processes personal data in the following roles:
As a Data Fiduciary — for the personal data of:
- Individuals who use Sahayogi products (BoSS, Tax Sahayogi, My Sahayogi, Sahayogi AI, Studio Sahayogi, Chat with Sahayogi)
- Clients of Office Sahayogi consulting engagements
- Visitors to sahayogi.in
- Job applicants and candidates
- Anyone who contacts us via email, phone, or any other channel
As a Data Processor — for the personal data of:
- Employees, customers, vendors, and other third parties whose data our clients enter into BoSS or other Sahayogi products. In this case, the client organisation is the Data Fiduciary, and Sahayogi processes data on their instruction.
2. Our Obligations as Data Fiduciary
Under the DPDP Act, Sahayogi One Private Limited, as a Data Fiduciary, is obligated to:
2.1 Process Data Only for Specified Purposes
We collect and process personal data only for the specific purposes described in our Privacy Policy (/legal/privacy-policy). We do not repurpose personal data for uses that are incompatible with the original purpose without obtaining fresh consent.
2.2 Obtain Valid Consent
We obtain consent from Data Principals before processing personal data, where consent is the applicable basis for processing. Our consent mechanism:
- Is presented in clear, plain language in English (and will be available in Hindi once the Hindi version of sahayogi.in is available)
- Is specific — each purpose is consented to separately
- Is freely given — not bundled with acceptance of terms as a condition of service where consent is not necessary for the service
- Can be withdrawn at any time, without affecting the lawfulness of processing before withdrawal
2.3 Maintain Data Accuracy
We take reasonable steps to maintain the accuracy and completeness of personal data we hold. Users can update their information at any time through their account settings or by writing to us.
2.4 Implement Security Safeguards
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Details are in our Security Policy (/legal/security-policy).
2.5 Notify Data Breaches
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act and applicable rules.
2.6 Erase Data When No Longer Needed
We erase personal data when it is no longer required for the purpose for which it was collected, when consent is withdrawn (where applicable), or when the retention period described in our Privacy Policy has elapsed — unless continued retention is required by law.
2.7 Grievance Redressal
We maintain a grievance mechanism through which Data Principals can raise concerns about the processing of their personal data. Our Grievance Officer contact is in Section 6 of this page.
3. Your Rights as a Data Principal
The DPDP Act gives you the following rights over your personal data processed by Sahayogi One Private Limited:
Right to Information About Processing (Section 11)
You have the right to know:
- What personal data we hold about you
- The purposes for which it is being processed
- The identities of any Data Processors or third parties to whom it has been disclosed
How to exercise: Email info@sahayogi.in with subject “DPDP Right — Information Request”.
Right to Correction and Erasure (Section 12)
You have the right to:
- Correct inaccurate or misleading personal data we hold about you
- Complete incomplete personal data
- Update personal data that is out of date
- Erase personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent (subject to legal retention requirements)
How to exercise: Email info@sahayogi.in with subject “DPDP Right — Correction/Erasure Request”. Describe what data needs to be corrected, completed, or erased.
Note on erasure limits: We are legally required to retain certain categories of data for defined periods (for example, financial records for 8 years under the Income Tax Act). Erasure requests for data within a mandatory retention period will be noted but deferred until the retention period expires.
Right to Grievance Redressal (Section 13)
You have the right to have any grievance about the processing of your personal data addressed by us promptly. If you are dissatisfied with our response, you may escalate to the Data Protection Board of India once it is constituted.
How to exercise: Email info@sahayogi.in with subject “DPDP Grievance — [Description]”. We aim to acknowledge all grievances within 72 hours and resolve them within 30 days.
Right to Nominate (Section 14)
You may nominate another individual to exercise your DPDP rights on your behalf in the event of your death or incapacity. To register a nominee, write to info@sahayogi.in.
Right to Withdraw Consent (Section 7)
Where we process your personal data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.
How to exercise: Email info@sahayogi.in with subject “Consent Withdrawal — [Description of data/purpose]”. We will process your withdrawal within [timeframe to be updated once DPDP rules are notified].
4. Consent Architecture at Sahayogi
We manage consent through three channels depending on where data is collected:
4.1 Website and Product Sign-Up Consent (sahayogi.in and product platforms)
When you register for a Sahayogi product or submit a contact form on sahayogi.in, you are presented with a clear description of what data is collected and why. Consent for non-essential processing (marketing communications, analytics) is sought separately and is not a condition of accessing the product.
4.2 Cookie Consent
Cookie consent is managed through the cookie consent banner described in our Cookie Policy (/legal/cookie-policy). Strictly necessary cookies do not require consent. All other cookie categories require explicit opt-in.
4.3 Office Sahayogi Client Engagement Consent
Clients engaging Office Sahayogi consulting services sign an engagement letter that includes data processing terms aligned with the DPDP Act. Where Sahayogi processes personal data of the client's employees, customers, or vendors as a Data Processor, the engagement letter documents the processing instructions and the client's role as Data Fiduciary for that data.
5. Data Localisation and Cross-Border Transfers
The DPDP Act governs the transfer of personal data outside India. Sahayogi's position on data localisation:
- Preference for Indian infrastructure: Sahayogi stores personal data on cloud infrastructure located in India wherever technically and commercially feasible.
- International transfers: Where data is processed by international service providers (such as cloud platforms, analytics tools, or communication services), we ensure appropriate safeguards are in place consistent with the DPDP Act's requirements for cross-border transfers. We will update our practices in line with government notifications on permitted cross-border transfer arrangements as they are issued.
- Sahayogi Cloud clients: Data stored by clients via Sahayogi Cloud (Tally on Cloud, Busy on Cloud, VPS, Dedicated Servers) is stored on infrastructure as specified in the relevant service agreement. Clients are responsible for ensuring their own DPDP Act compliance as Data Fiduciaries for their business data.
6. Children’s Personal Data
The DPDP Act requires verifiable parental consent before processing personal data of children (individuals under 18). Sahayogi products are not directed at children. We do not knowingly process children's personal data without verifiable parental consent.
If you believe your child's personal data has been collected by Sahayogi without appropriate consent, write to info@sahayogi.in immediately and we will delete the relevant data.
7. Data Breach Response
In the event of a personal data breach affecting data for which Sahayogi is Data Fiduciary, we will:
- Contain the breach and assess its scope
- Notify the Data Protection Board of India as required by the DPDP Act
- Notify affected Data Principals with information about what data was involved, what we have done, and what they can do to protect themselves
- Document the breach and our response in our internal security records
We maintain an incident response protocol aligned with these obligations. See our Security Policy (/legal/security-policy) for further details.
8. Significant Data Fiduciary Obligations
The DPDP Act identifies a category of “Significant Data Fiduciaries” (SDFs) subject to additional obligations, including Data Protection Impact Assessments, data audits, and appointment of a Data Protection Officer. The Government of India has not yet notified the criteria for SDF classification.
Sahayogi One Private Limited is not currently classified as a Significant Data Fiduciary. If and when we are so classified, we will implement the additional obligations required and update this page accordingly.
9. Our Commitment as Data Processor
Where Sahayogi processes personal data on behalf of client organisations (for example, employee data in BoSS), we operate as a Data Processor under instruction from the client (who is the Data Fiduciary). In this role, we:
- Process personal data only on the documented instructions of the client
- Do not use the data for any purpose beyond providing the contracted service
- Maintain appropriate security measures for the data we process
- Assist the client in meeting their own DPDP Act obligations (for example, by supporting data access requests from their employees)
- Delete or return the data at the end of the engagement, as agreed
Clients using BoSS or other Sahayogi products to process personal data of their employees, customers, or vendors are responsible for their own compliance with the DPDP Act as Data Fiduciaries for that data.
10. Grievance Officer and Contact
For all DPDP Act-related requests, queries, and complaints:
Grievance Officer
Sahayogi One Private Limited
Unit No. 918, 9th Floor, Tower 4, Assotech Business Cresterra,
Sector-135, Noida – 201304, Uttar Pradesh, India
Email: info@sahayogi.in
Subject line format: “DPDP [Right/Grievance/Query] — [Brief description]”
Phone: +91 9255096300
Response commitment: Acknowledgement within 72 hours. Resolution within 30 days.
If you are dissatisfied with our response to a grievance, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act, 2023.
11. Policy Updates
The DPDP Act is a recent law and its implementing rules and notifications are being issued progressively. We will update our compliance practices — and this page — as new rules, notifications, and guidance are issued by the Government of India and the Data Protection Board.
We will notify registered users of material changes to our DPDP Act compliance practices by email, with at least [14] days notice before changes take effect.
Sahayogi One Private Limited | CIN: U62010UP2024PTC205006 · DPDP Act Version 1.0