Data Privacy Notice & Data Breach SOP
Effective Date: September 2026 • Scope: All Clients, Employers & Individual Members
This notice governs personal and financial data processed by EPF Compliance Consultant (corporatecompliance.in) in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
Legal Roles: Data Fiduciary & Data Principal
EPF Compliance Consultant
Operating under the trade platform corporatecompliance.in, we determine the purpose and means of processing personal data solely for providing lawful EPFO statutory consultancy, grievance filings, and compliance audit services.
You (The Client / Member / Employer)
The individual or authorized establishment representative whose personal data (such as UAN, mobile number, passbook, or establishment filings) is provided for analysis and grievance resolution.
Categories of Personal Data Collected
Under the principle of Data Minimization (Section 6 & Section 8), we only request data strictly required for solving your EPFO case:
🪪 Identity & Contact Details
Full legal name, father's/spouse's name, date of birth, mobile phone number, and verified email address.
🔢 Statutory Identifiers
12-digit Universal Account Number (UAN), Member ID, Establishment Code, and EPFO Regional Office jurisdiction.
📊 Passbooks & Financial Records
EPFO Member Passbook PDFs, wage breakups, service history (DOJ/DOE), pension contributions, and Form 19/10C/31 claim history.
📋 Remediation Artefacts
Joint Declaration forms, employer attestation letters, EPFO rejection slips, and EPFiGMS grievance tokens.
Section 6 Compliance: Explicit Consent Mechanism
Consent under the DPDP Act must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action.
How Consent is Recorded on Our Platform:
- Unchecked Checkboxes: All consent checkboxes on registration and case checkout forms are presented explicitly unchecked. No pre-ticked consent is allowed.
- Cryptographic Audit Trail: Every consent acceptance logs the exact UTC timestamp (dpdp_consent_at) and client IP address (dpdp_consent_ip) in our secure relational database.
- Right to Withdraw: You maintain the unconditional right to withdraw consent at any time by raising a deletion ticket or emailing our Grievance Redressal Officer.
Section 8(7) Purpose Limitation & 30-Day Auto-Purge Scheduler
Under the Purpose Limitation mandate, personal data must not be retained after the specified purpose is fulfilled.
Case status transitions to Resolved or Closed upon grievance settlement.
A strict 30-day post-resolution grace buffer permits final member verification and invoice generation.
On Day 31, our console scheduler automatically deletes passbooks and nullifies sensitive database columns.
Note: The user's basic login account remains active for historical case billing and summary records, but all sensitive identity credentials, passbooks, and financial attachments are permanently expunged.
Section 8(6) Standard Operating Procedure: Personal Data Breach & 72-Hour SLA
In adherence to Section 8(6) of the DPDP Act 2023, EPF Compliance Consultant enforces a strict, documented incident response SOP in the event of any unauthorized data compromise.
Binding 72-Hour Notification SLA
In the event of a confirmed personal data breach affecting confidentiality or integrity, our incident response team commits to notifying both the Data Protection Board of India (DPBI) and each affected Data Principal without undue delay and strictly within 72 hours of detection.
Instant isolation of affected services & revocation of compromised tokens.
Forensic analysis of affected records, extent of exposure, and severity evaluation.
Transmission of incident report to DPBI and direct email/SMS dispatch to affected principals.
System hardening, cryptographic key rotation, and forensic closure documentation.
Rights of Data Principals (Sections 11 to 14)
Right to Information & Access (Sec. 11)
You may request a copy or summary of all personal data held about you and the processing activities undertaken.
Right to Correction & Erasure (Sec. 12)
You may request immediate correction of inaccurate data or permanent deletion of your profile and case history.
Right of Grievance Redressal (Sec. 13)
You may register formal complaints regarding data processing practices with our appointed Grievance Officer.
Right to Nominate (Sec. 14)
You have the statutory right to nominate any individual to exercise your data rights in event of incapacity or demise.
Appointed Grievance Redressal Officer (Section 8(9))
For inquiries, consent withdrawals, or data rights requests, contact our designated officer:
Officer: Statutory Compliance & Data Protection Desk
Entity: EPF Compliance Consultant
Dedicated Email: compliancepvt.alerts@gmail.com
Helpline: +91 98555 76034
Response Turnaround: Acknowledgment within 24 hours • Formal resolution within 7 business days.