Who is responsible for what
| Data | Who decides how it is used (Data Fiduciary) | Our role |
|---|---|---|
| Your employees, customers, suppliers and borrowers, in your MyRecords system | Your business | Data Processor when your system is on MyRecords Cloud, or when our support team works on it. On your own server with no access by us, we process none of it |
| People who contact us through this website, and our own clients’ contacts | We do | See the privacy notice |
As a processor, we use your data only on your instructions: to run, back up, update and support your system. We do not sell it, use it for marketing, or use it to train AI models.
DPDP tools in MyRecords (live)
The Administration home has a Personal data (DPDP Act) card, built from your system’s own data. From there you can:
- name the person who answers questions about personal data, and the person who is told first about a breach;
- keep your privacy notice;
- keep consent records, with one-click withdrawal that also stops bulk e-mail to that person;
- set how long sign-in and activity logs are kept;
- handle erase requests: the person confirms by e-mail, and an administrator approves or holds the request;
- send someone their data as a file.
Safeguards that support the Act
- PAN, Aadhaar, passport and bank account numbers encrypted with AES-256-GCM, shown masked, with each reveal logged.
- Access by role, checked on the server for every request.
- A tamper-evident audit trail of changes and of who opened sensitive records.
- Encrypted daily backups, with a tested restore.
Details are on the security and backups pages.
Where data is processed
- MyRecords Cloud: in the region you choose: India, the US, Europe, the UK, Singapore, Sydney, the UAE, Saudi Arabia or South Africa. Indian clients are hosted in India; EU and UK clients are hosted in the EU or UK, with a data-processing agreement.
- Your own server: wherever your server is.
- AI Assistant: questions, and the records needed to answer them, go to the AI provider set up for your system. It can use Vertex AI in Google Cloud’s Mumbai region, so the processing endpoint is in India. With “Hide personal details from the AI provider” (on by default), phone numbers, e-mail addresses, PAN and Aadhaar are masked before text is sent.
- Providers you connect with your own account (WhatsApp Business, SMS, a GST Suvidha Provider, a payment gateway) receive only what each connection needs, under their own terms.
If there is a breach
If we find a breach that affects personal data in your system, we tell you without delay: what happened, which data, and what we are doing about it. That gives you what you need to inform the Data Protection Board of India and the people affected.
Timing of the law
The Digital Personal Data Protection Rules, 2025 bring most duties into force in stages, with the main ones due in 2027. The tools above are in the product now, so you can set them up early.
This page explains how MyRecords supports the law. It is not legal advice.
Source
- The Digital Personal Data Protection Act, 2023, Gazette of India.