01Requirement by requirement
How each obligation in DPDP and the GDPR maps to what we do.
| Requirement | DPDP | GDPR | What we do |
|---|---|---|---|
| Lawful basis and consent | s.6 · Rule 3 | Art. 6, 7 | Consent from every wearer, recorded per clip, free and specific, with withdrawal as easy as giving it. |
| Notice | s.5 · Rule 3 | Art. 13, 14 | A standalone, itemised notice in English or the wearer's chosen Indian language, covering data, purposes, withdrawal, rights and how to complain. |
| Purpose limitation and minimisation | s.6(1), s.8(7) | Art. 5(1)(b)(c) | We capture only the task area and the sensor streams a project needs. Faces are blurred on the device. |
| Accuracy | s.8(3) | Art. 5(1)(d) | Clip metadata and consent records are checked in QA before delivery. Corrections flow to every affected delivery. |
| Security safeguards | s.8(5) · Rule 6 | Art. 32 | Encryption on the headset, in transit and at rest; role-based access; access logs kept for at least a year; backups; device inventory. |
| Breach notification | s.8(6) · Rule 7 | Art. 33, 34 | Affected people informed without delay; the Data Protection Board of India and, where relevant, EU supervisory authorities notified within 72 hours. |
| Processors | s.8(2) | Art. 28 | Written contracts with every service provider that touches personal data, requiring equivalent safeguards. |
| Retention and erasure | s.8(7) · Rule 8 | Art. 5(1)(e), 17 | Data kept only while consent and the licence purpose last; erased on withdrawal, with deletion instructions passed to clients. |
| Rights of individuals | s.11 to 14 · Rule 14 | Art. 15 to 22 | Published request process and identifiers; responses within 90 days (DPDP) and one month (GDPR). |
| Children | s.9 · Rule 10 | Art. 8 | No participants under 18; no recording where children are present; accidental captures blurred and removed. |
| Cross-border transfers | s.16 · Rule 15 | Chapter V, Art. 46 | No transfers to countries India restricts; Standard Contractual Clauses for data received from the EU or EEA. |
| Contact point | s.8(9) · Rule 9 | Art. 27, 37 | A named Grievance Officer, published on our site and in every participant notice. |
| Accountability | s.8(1) | Art. 5(2), 30, 35 | Records of processing, and an impact assessment before each new capture programme. |
02At capture
- Direct agreements. We contract with each wearer ourselves, never through an employer's or site owner's sign-off.
- Consent per clip. Every clip is tied to a consent record that the wearer and the client can both verify.
- Withdrawal that works. A wearer can withdraw any clip at any time; it leaves future deliveries and clients are instructed to delete it.
- On-device face blurring. Bystander faces are blurred on the headset while recording, before footage leaves the device.
- Pseudonymous from the start. Clips carry a contributor ID. Names, phone numbers and payment details stay in a separate, restricted system.
03What you get as a client
Procurement and legal teams usually ask the same questions. We answer them before the first delivery.
- A consent audit trail for every clip in your delivery.
- A data processing agreement and, for EU clients, Standard Contractual Clauses.
- Clear licence terms: the data is for researching and training AI systems; no re-identification, facial recognition, biometric identification, surveillance or assessment of individual workers.
- A takedown protocol: when a wearer withdraws a clip, you receive a deletion notice identifying it.
- Breach cooperation: we tell you promptly if an incident affects data you hold, so you can meet your own obligations.
04Cross-border delivery
DPDP allows personal data to be transferred outside India except to countries the Government of India restricts by notification. We check for restrictions before every delivery. India does not hold an EU adequacy decision, so where personal data comes to us from the EU or EEA we use the European Commission's Standard Contractual Clauses, backed by a transfer risk assessment.
05The DPDP timeline
The DPDP Rules were notified in November 2025 and come into force in phases. We already operate to the full set of obligations, so nothing about our process has to change as each phase begins.
| Date | What comes into force |
|---|---|
| 13–14 November 2025 | Definitions and the Data Protection Board of India |
| November 2026 | Registration and duties of Consent Managers |
| May 2027 | The core duties: notice, consent, security, breach reporting, retention, children's data and individuals' rights |
06Documents on request
- Data processing agreement
- Standard Contractual Clauses and transfer risk assessment
- A sample participant notice and consent record
- Security overview
- Current list of service providers
Email business@billionhours.ai with the subject "Compliance pack" and tell us which you need.
07Compliance contact
Grievance Officer, Billion Hours AI Pvt Ltd: business@billionhours.ai
For how we handle personal data in detail, read our privacy policy.