Regulation · India DPDP Act 2023
Personal data stays in India. Our role is written down.
India’s Digital Personal Data Protection Act, 2023, read for AI agents that change records: our role in each deployment, residency, erasure, and who to contact.
The Digital Personal Data Protection Act, 2023 applies when AI agents process digital personal data in India. In hosted deployments the customer is the Data Fiduciary and elan1 is its Data Processor under a data processing agreement, with data kept in the Mumbai region. Grievances, legal notices and legal action under the Act are handled by Hariharan.
elan1 does not certify you or itself against India DPDP Act 2023.
01What it asks
Lawful basis, safeguards, erasure and rights.
The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India. The DPDP Rules, 2025 phase obligations in.
- Lawful basisA lawful basis (consent or a listed legitimate use) and notice.
- AccuracyAccuracy where data drives a decision about the person.
- SecurityReasonable security safeguards, and breach notice to the Data Protection Board and affected people.
- ErasureErasure when the purpose is served or consent is withdrawn, unless law requires retention.
- RightsRights to access, correction, erasure, grievance redressal and nomination.
- Significant fiduciariesExtra duties for significant data fiduciaries.
- PhasingThe DPDP Rules, 2025 phase obligations in; check the notified dates.
Source: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), and the Digital Personal Data Protection Rules, 2025, as notified. Check the notified dates in force.
02How elan1 helps
Where elan1 acts, and the evidence it leaves.
Three places where a governed action helps: how each write is secured, what stays out of evidence, and how an erasure is done.
| What the Act asks | elan1 mechanism | Evidence |
|---|---|---|
| Security safeguards | Residency domain “in” (AWS ap-south-1, Mumbai); one database and one signing key per domain; one writer with a 10-minute single-use credential; no model in the allow path | Record per write |
| Personal data out of evidence | The record holds a hash of the payload (F14), not the payload | F14 |
| Erasure requests | Erasure is itself a governed write: checked, approved where your rules say, recorded | Record of the erasure |
“Enforced” applies only in Mode A, where elan1 holds the write credential. In Mode B every write intent is evaluated and recorded; we call that attested advisory, never blocked.
03Not covered
What elan1 helps with, and what it does not.
Stated at equal weight, so nobody reads a gap as a feature.
Helps you produce evidence for
- Security safeguards on every governed write, inside one Indian residency domain
- Keeping personal data out of evidence: a payload hash, never the payload
- Erasure done as a governed write: requested, checked and recorded
Does not cover
- Consent collection or management
- Your notices and lawful basis
- DPO and impact assessments
- Your breach process
- Children’s data
- Transfer decisions
We do not claim that the append-only chain on its own meets the right to erasure. Whether a payload hash is personal data in your context is for your counsel.
04Regulation mapper
Clause by clause, to the rung that acts.
Select a row to see which rung of the Right Path it maps to. Switch frameworks to compare; nothing here is a certification.
DPDP Act 2023: Security safeguards (s. 8(5)) maps to rung 7 ACT.
| Requirement | elan1 control | Evidence produced | Not covered | Enforced at action time? |
|---|---|---|---|---|
| Rung 7 ACT: one writer with a 10-minute single-use credential; residency domain "in" (AWS ap-south-1, Mumbai); no model in the allow path | Record per write | Safeguards in your own systems | Mode A enforced; Mode B recorded | |
| Rung 8 PROOF: the record holds a hash of the payload (F14), not the payload | F14 | Personal data inside your system of record | Recorded at the action, both modes | |
| Erasure is itself a governed write: checked, approved where your rules say, recorded | Record of the erasure | Whether a payload hash in an append-only chain is personal data in your context | Recorded; legal effect for your counsel | |
| None | None | Consent collection or management; your notices | No. Outside elan1 | |
| None | None | Your breach process and notices | No. Outside elan1 | |
| None | None | DPO, impact assessments and audits | No. Outside elan1 |
Where this is weak: Mode B records the write; it cannot stop it. “Enforced” applies only in Mode A, where elan1 holds the write credential.
Clause references summarise the official text. Not legal advice. elan1 holds no certificate against any framework. Source: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023); Digital Personal Data Protection Rules, 2025.
Read the full page: DPDP Act 2023: what it asks and how elan1 helps
05Worked example
One rule, its clauses, and the record it writes.
An erasure request, handled as a governed write. The record proves the request was checked and done, without holding the personal data it removed.
1 · The rule, in the declaration
# decl_customer_erasure · v2 (illustrative)
write_type: customer.erase
pre_gates: [G3_PERMISSIONS]
check: no_legal_hold
and purpose_served_or_consent_withdrawn
approver: role:privacy_officer
approver_not_requester: true
record: always # payload hashed, never storedA customer's erasure request is checked for a legal hold, approved by the privacy officer, carried out by one writer, and recorded. The record holds a hash of the payload, not the data.
2 · The clauses it serves
- s. 8(7); s. 12Erasure when the purpose is served or consent is withdrawn, unless law requires retention.
- s. 8(5)Reasonable security safeguards on the change itself.
- s. 13Grievance redressal: you can show what was done, and when.
3 · The proof record it writes
- F05customer.erase
- F06decl_customer_erasure
- F072
- F09usr_specimen_privacy
- F10human
- F12cust_specimen_8841
- F14sha256:7d02…c5a9
- F162027-09-03T15:20:11+05:30
Illustrative specimen. Not customer data.
06Our role under the Act
Processor for your data. Fiduciary for ours.
For hosted deployments, a data processing agreement sets out what we process, on whose instructions, and for how long.
- Hosted deployments: Data ProcessorFor personal data in customers' systems that elan1 processes on the customer's instructions through elan1 Govern, Work, Decide and Run (hosted deployments), the customer is the Data Fiduciary and ELAN1 AGENTIC TECHNOLOGIES PRIVATE LIMITED acts as its Data Processor, under a data processing agreement.
- Our own purposes: Data FiduciaryFor personal data elan1 collects for its own purposes (website visitors, contact and design-partner forms, account administration, billing, our own staff and marketing), elan1 is the Data Fiduciary.
- Customer-operated deployments: Neither, except support accessIn customer-VPC, on-premises and sovereign deployments that the customer operates, elan1 does not process the personal data and is neither, except for any support access the customer grants, where it acts as Processor.
- Legal matters and DPDP action: HariharanLegal notices and any legal action under the DPDP Act, 2023, including correspondence with the Data Protection Board of India, are handled by Hariharan (hariharan@elan1.ai), who is also our grievance officer.
Erasure and an append-only chain. Evidence rows are never updated or deleted; that is what makes the chain tamper-evident. The record holds a hash of the payload (F14), never the payload, and an erasure request is itself a governed write: checked, approved where your rules say, and recorded. Whether a payload hash or a record identifier is personal data in your context is for your counsel; we do not claim the chain on its own meets the right to erasure.
07What an auditor sees
One record, each field mapped to its clause.
For a write touching personal data: who acted, under which rules and when, without the personal data in the record. For an erasure: a record that it was requested, checked and done.
- F01tenant_id
- tnt_specimen_01
- F02seq
- 1042
- F03prev_digest
- sha256:9f3c…e41a
- F04write_id
- wr_specimen_7c2
- F05write_type
- journal_entry.post
- F06declaration_id
- decl_month_end_close
- F07declaration_version
- 7
- F08policy_version
- 2027.06.1
- F09actor_id
- usr_specimen_approver
- F10actor_kind
- human
- F11autonomy_level
- A2
- F12record_id
- je_specimen_5531
- F13record_version
- 2
- F14payload_hash
- sha256:51b0…7d9a
- F15lexicon_hash
- sha256:e2c4…0b16
- F16recorded_at
- 2027-07-14T10:42:07+05:30
Illustrative specimen. Not customer data.
Field notes · select a note to mark its fields
08FAQ
India DPDP Act 2023: questions we are asked.
Yes, when an agent processes digital personal data in India, or outside India in connection with offering goods or services to people in India. The Act regulates the processing, not the technology: the Data Fiduciary that decides why and how the data is processed stays responsible, whether a person or an agent does the work. elan1 records each governed action an agent takes on that data.
In India, in one residency domain, “in”: AWS ap-south-1, Mumbai. Each domain has one database and one signing key.
It holds a hash of the payload (F14), not the payload itself. It also names who acted (F09) and the record changed (F12); whether those are personal data in your context is for your counsel.
Erasure is itself a governed write: checked, approved where your rules say, and recorded. The personal data leaves your system of record; the chain keeps a hash and the record that the erasure was done. We do not claim the chain on its own meets the right to erasure.
It depends on whose data it is and who runs the deployment. For personal data in customers' systems that elan1 processes on the customer's instructions through elan1 Govern, Work, Decide and Run (hosted deployments), the customer is the Data Fiduciary and ELAN1 AGENTIC TECHNOLOGIES PRIVATE LIMITED acts as its Data Processor, under a data processing agreement. For personal data elan1 collects for its own purposes (website visitors, contact and design-partner forms, account administration, billing, our own staff and marketing), elan1 is the Data Fiduciary. In customer-VPC, on-premises and sovereign deployments that the customer operates, elan1 does not process the personal data and is neither, except for any support access the customer grants, where it acts as Processor.
Our grievance officer, Hariharan, at hariharan@elan1.ai. We acknowledge and resolve a grievance within one week. If you are not satisfied, you may escalate to the Data Protection Board of India.
Legal notices and any legal action under the DPDP Act, 2023, including correspondence with the Data Protection Board of India, are handled by Hariharan (hariharan@elan1.ai), who is also our grievance officer.
No. Consent collection and management, your notices and your lawful basis stay with you.
Your breach process and notices stay yours. How elan1 handles its own security is set out on the Security page under Trust & evidence.
Last reviewed
Reviewed against the official text. Not legal advice; your counsel decides how the law applies to you.
| Date | Change |
|---|---|
| 6 Oct 2026 | First version. Mapped security, evidence and erasure to elan1 mechanisms. |
| 10 Oct 2026 | Our role under the Act set out per deployment: Data Processor for customers' personal data in hosted deployments, Data Fiduciary for our own purposes, neither in customer-operated deployments except support access. Erasure stance and grievance contact added. |
// NEXT STEP
Find out where you stand, in five minutes.
Twelve questions. A plain result. Nothing is stored or sent, and no email is needed.