DPDP Compliance
Our commitment as a Data Processor to safeguard employee data and support your compliance under India's Digital Personal Data Protection Act, 2023.
Cosmify HRM is fully committed to complying with the Digital Personal Data Protection (DPDP) Act, 2023. This page outlines our role as a trusted Data Processor and the comprehensive safeguards we provide to help your organization (the Data Fiduciary) maintain 100% compliance.
1. Our Role under DPDP Act
Under the DPDP Act, your organization acts as the Data Fiduciary, determining the purpose and means of processing employee personal data. Cosmify HRM acts strictly as the Data Processor, processing employee records, attendance, payroll, and identity documents solely on your behalf and per your configured workflows.
2. Data Processing Agreements (DPA)
We provide formal Data Processing Agreements as a standard part of our customer contracts. This legally guarantees that Cosmify HRM:
- Processes employee data solely to deliver authorized HR, attendance, and payroll services.
- Never sells, monetizes, or shares employee data with unauthorized third parties.
- Enforces strict confidentiality and security protocols across all staff with system access.
3. Data Principal Rights (Employees)
The DPDP Act gives employees (Data Principals) enforceable statutory rights. Cosmify HRM provides automated self-service and administrative capabilities to fulfill these rights seamlessly:
Right to Access
Employees view all personal, attendance, and salary data anytime via web and mobile ESS.
Right to Correction
Automated correction requests for profile, bank, and tax details with HR approval audit trails.
Right to Erasure
Configurable retention policies and secure data purge upon employee exit, aligned with tax statutes.
4. Technical & Organizational Safeguards
As mandated by the DPDP Act, we enforce bank-grade technical and organizational security controls:
- 256-bit AES Encryption: All employee database records and file attachments are encrypted at rest.
- TLS 1.3 in Transit: All communications between browsers, mobile devices, and servers are encrypted.
- Granular Role-Based Access (RBAC): Managers and HR staff can only access data authorized by company policy.
- Independent Audits: Regular third-party Vulnerability Assessment and Penetration Testing (VAPT).
5. Data Localization within India
To guarantee strict compliance with Indian data sovereignty requirements, all customer employee databases, backups, and file storage are hosted exclusively in Tier-4 data centers physically located within India (AWS Mumbai Region).
Need an Enterprise Signed DPA?
Our legal and security teams can provide a countersigned Data Processing Agreement for your records.