Friensysfriensys

Legal

DPDPA Compliance

Last updated: 1 January 2025

What is the DPDPA?

The Digital Personal Data Protection Act, 2023 (DPDPA) is India's comprehensive data protection legislation. It governs how organisations collect, process, store, and share personal data of individuals within India. Schools using ERP systems process significant amounts of personal data — student records, parent contact details, staff information, and financial data — making DPDPA compliance essential.

Friensys' Role Under DPDPA

Under DPDPA, Friensys operates as a Data Processor — we process personal data on behalf of schools (Data Fiduciaries). Schools remain responsible for obtaining valid consent from data principals (students, parents, staff) before uploading personal data to our platform.

Our DPDPA Commitments

1. Purpose Limitation

We process personal data only for the purposes specified in the Data Processing Agreement with each school — never for our own marketing or third-party monetisation.

2. Data Minimisation

Our platform collects only data fields necessary for the school's administrative functions. Optional fields are clearly marked. We regularly audit data collection to remove unnecessary fields.

3. Storage Limitation

Personal data is retained only as long as necessary:

  • Active student and staff data: duration of school's subscription
  • Financial records: 7 years (Indian tax law requirement)
  • Deleted records: 30 days after deletion request, then purged

4. Security Measures

  • AES-256 encryption at rest, TLS 1.3 in transit
  • Role-based access controls — staff see only what their role requires
  • Audit logs for all data access and modifications
  • Regular penetration testing and vulnerability scans

5. Data Principal Rights Support

We provide tools for schools to fulfil data principal rights:

  • Access requests: Export individual student or staff records on demand
  • Correction: Edit any data field with audit trail
  • Erasure: Delete records with cascade across all modules
  • Grievance: In-platform grievance submission workflow

6. Breach Notification

In the event of a personal data breach, Friensys will notify the affected school within 72 hours of discovery, including the nature of the breach, data affected, and remediation steps.

7. Sub-processor Management

All sub-processors (cloud hosting, email services) are bound by data processing agreements equivalent to or stricter than our commitments to schools.

School Responsibilities

As Data Fiduciaries, schools using Friensys are responsible for:

  • Displaying a clear privacy notice to parents and staff before collecting data
  • Obtaining valid consent (or identifying a valid lawful basis) for processing
  • Appointing a Data Protection Officer if required under DPDPA rules
  • Responding to data principal rights requests within the statutory timeframe
  • Notifying the Data Protection Board if a breach is reported by Friensys

Data Processing Agreement

All Friensys customers are covered by our standard Data Processing Agreement (DPA), which is available on request. The DPA covers:

  • Categories of data processed
  • Processing purposes and legal basis
  • Sub-processor list and controls
  • Data subject rights procedures
  • Breach notification timeline
  • Cross-border transfer safeguards

To receive the DPA or request a custom DPA review, email legal@friensys.com.

Contact for DPDPA Queries

Data Protection Officer
Friensys Info Labs
Greater Noida West, Uttar Pradesh – 201306
Email: privacy@friensys.com
Response time: 5 business days