5. DATA SECURITY AND BREACH NOTIFICATION
5.1. Our Security Measures: We implement robust technical and organizational measures to protect your data in compliance with Rule 6 of the DPDP Rules, 2025. These include, at a minimum:
5.1.1. Data Security Measures: Industry-standard encryption (TLS 1.2+ for data in transit and AES-256 for sensitive data at rest), obfuscation, masking, or the use of virtual tokens mapped to personal data where appropriate.
5.1.2. Access Controls: Strict role-based access control (RBAC) systems to regulate access to computer resources used by us or our Data Processors, granted on a need-to-know and least-privilege basis.
5.1.3. Visibility and Monitoring: Comprehensive logging, real-time monitoring, and periodic review mechanisms to enable detection, investigation, and remediation of unauthorized access. Logs are retained for a minimum period of one year as required by law.
5.1.4. Business Continuity: Reasonable measures for continued processing in the event of data compromise, including regular data backups and disaster recovery protocols.
5.1.5. Contractual Safeguards: Appropriate provisions in all contracts with Data Processors requiring them to maintain equivalent security safeguards.
5.1.6. Organizational Measures: Regular security audits, employee training, and documented policies to ensure effective observance of all security safeguards.
5.2. Personal Data Breach Response: In the unfortunate event of a personal data breach (unauthorized access, disclosure, loss, etc.) that is likely to result in harm to you, we are committed to complying with Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, 2025.
5.2.1. Notification to Affected Data Principals: Upon becoming aware of any personal data breach, we will, without delay, intimate each affected Data Principal through their user account or registered communication mode, providing:
5.2.1.1. a description of the breach, including its nature, extent, and timing of occurrence;
5.2.1.2. the consequences relevant to you that are likely to arise from the breach;
5.2.1.3. the measures implemented and being implemented by us to mitigate risk;
5.2.1.4. the safety measures you may take to protect your interests; and
5.2.1.5. the business contact information of the person authorized to respond to your queries.
5.2.2. Notification to the Data Protection Board of India: We will also intimate the Data Protection Board of India:
5.2.2.1. without delay, a description of the breach, including its nature, extent, timing and location of occurrence, and the likely impact; and
5.2.2.2. within seventy-two (72) hours of becoming aware of the breach (or such longer period as the Board may allow), the following:
5.2.2.2.1. updated and detailed information regarding the breach;
5.2.2.2.2. broad facts related to the events, circumstances, and reasons leading to the breach;
5.2.2.2.3. measures implemented or proposed to mitigate risk;
5.2.2.2.4. any findings regarding the person who caused the breach;
5.2.2.2.5. remedial measures taken to prevent recurrence; and
5.2.2.2.6. a report regarding the intimations given to affected Data Principals.