DPDP Compliance

RayHRM Technologies Pvt. Ltd. is fully committed to complying with the Digital Personal Data Protection (DPDP) Act, 2023. This page outlines our role as a Data Processor and how we help you (the Data Fiduciary) maintain compliance.

1. Our Role

Under the DPDP Act, your organization acts as the Data Fiduciary, determining the purpose and means of processing employee personal data. RayHRM acts as the Data Processor, processing this data strictly on your behalf and according to your instructions through our platform.

2. Data Processing Agreements (DPA)

We provide standard Data Processing Agreements as part of our enterprise contracts. This legally binds RayHRM to only process employee data for the explicit purpose of providing our HR software services (payroll, attendance, etc.) and explicitly prohibits any secondary use or sale of this data.

3. Data Principal Rights (Employees)

The DPDP Act grants certain rights to Data Principals (your employees). The RayHRM platform provides built-in tools to help you fulfill these requests:

• Right to Access: Employees can view all their personal data directly via the RayHRM Employee Self-Service (ESS) portal.
• Right to Correction: Workflows allow employees to request corrections to their data, which HR admins can approve.
• Right to Erasure: When an employee leaves, HR admins can trigger a "Data Retention & Purge" workflow to securely delete data in accordance with your company's retention policies and statutory requirements.

4. Security Safeguards

As required by the DPDP Act, we implement reasonable security safeguards to prevent personal data breaches:

• End-to-end 256-bit AES encryption for data at rest.
• TLS 1.3 encryption for all data in transit.
• Strict Role-Based Access Control (RBAC) ensuring your HR admins only see what they are authorized to see.
• Regular third-party VAPT (Vulnerability Assessment and Penetration Testing) audits.

5. Data Localization

To ensure compliance and maximum performance, all RayHRM data for Indian customers is stored exclusively on servers physically located within India (AWS Mumbai Region). No employee data is transferred or mirrored outside the territory of India.