DPDP Act 2023 — Implementation & Compliance Manual

This manual sets out how VERALIS EVIDENCE PRESS PRIVATE LIMITED (“VERALIS”, “we”) meets its obligations under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) as a Data Fiduciary. It is the operational counterpart to the public-facing Privacy Policy and DPDP Act Compliance page and is intended for staff, contractors, and our technology developer.

• Data Fiduciary accountability: VERALIS is accountable for compliance regardless of any processing carried out by a Data Processor on its behalf.
• Grievance Officer: VERALIS designates a Grievance Officer, contactable at admin@veralispress.com, responsible for receiving Data Principal requests and grievances, coordinating responses within statutory timelines, and maintaining the registers in this manual.
• Developer / platform team: responsible for implementing consent capture, rights-fulfilment tooling, security controls, logging, and erasure workflows described here.
• Significant Data Fiduciary CONFIRM: if VERALIS is later notified as a Significant Data Fiduciary, additional duties apply — appointing a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments. Status to be reviewed annually.

VERALIS processes personal data only on a lawful basis under the DPDP Act — either the Data Principal’s consent or a recognised “legitimate use.” The basis for each activity is recorded in the Record of Processing Activities (Section 5).

• Consent — obtained for marketing communications, non-essential cookies/analytics, and any processing not covered by a legitimate use.
• Legitimate use — voluntary provision of data by the Data Principal for a specified purpose, compliance with legal obligations, and security/fraud prevention, as permitted by the Act.
• Contractual necessity — core publishing services (account, submission, peer review, APC) provided to fulfil the service the Data Principal has requested.

Maintained and reviewed at each review cycle. Columns: purpose, data categories, Data Principals, lawful basis, processors, and retention (detailed in Section 11).

Before or at the point of collection, VERALIS provides a notice, in clear and plain language, stating the personal data to be collected, the purpose, how the Data Principal may exercise their rights, and how to complain to the Data Protection Board. Where consent was obtained before commencement of the Act for existing users, an updated notice is provided as soon as reasonably practicable.

Implementation: the notice is surfaced at sign-up, at manuscript submission, at payment, and via a persistent link to the Privacy Policy and DPDP Compliance page. A record of the notice version shown is stored against the account.

Consent is captured through an affirmative action (e.g., an unticked checkbox the Data Principal selects), is specific to each purpose, and is logged. Each consent record retains the fields below so consent is demonstrable and auditable.

Withdrawal: a Data Principal may withdraw consent at any time, as easily as it was given, via account settings or by emailing admin@veralispress.com. On withdrawal, VERALIS ceases the relevant processing and instructs processors to do the same, unless another lawful basis or legal obligation requires retention. Withdrawal does not affect the lawfulness of processing before withdrawal.

Consent Manager CONFIRM: if VERALIS integrates a registered Consent Manager under the Act, requests routed through it are honoured through the same workflow.

Requests are received at admin@veralispress.com, identity-verified against the account, logged in the Data Subject Request (DSR) register, and actioned within the target timelines below. Final statutory timelines follow the notified DPDP Rules; VERALIS adopts the targets below as internal SLAs.

Erasure and the scholarly record: erasure requests are honoured except where data forms part of the permanent version of record (published articles, author/contributor metadata, corrections and retractions) or where law requires retention (e.g., financial records). This limitation is disclosed to the Data Principal in the response.

Duties of Data Principals: we remind requesters that the Act requires them to provide authentic information and not to file false or frivolous grievances.

• The service is directed at researchers and professional users; we do not knowingly process personal data of children (under 18) without verifiable parental/guardian consent.
• We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
• Where a Data Principal has a lawful guardian, verifiable guardian consent is obtained in the manner the Act prescribes.
• If we become aware that a child’s data was collected without valid consent, we erase it promptly.

VERALIS engages Data Processors only under a valid contract requiring DPDP-consistent safeguards, purpose limitation, and deletion on termination. The register below is maintained and reviewed each cycle. CONFIRM vendor names and locations

Personal data is retained only as long as necessary for the purpose or as required by law, then erased or anonymised. Automated retention rules are configured in the platform. CONFIRM periods with counsel/finance

• Encryption of personal data in transit (TLS) and at rest.
• Role-based access control, least privilege, and unique credentials; MFA for administrative access.
• Audit logging and monitoring of access to personal data.
• Segregation of environments; secrets management; regular patching.
• Backups with tested restore, and secure deletion on retirement of media.
• Contractual security obligations flowed down to all processors.
• Periodic access reviews and vulnerability assessment CONFIRM cadence.

A personal data breach is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data. VERALIS follows the steps below and notifies the Data Protection Board of India and affected Data Principals in the manner and timeline required by the DPDP Act and Rules.

Breach register fields: incident ID, date/time detected, description, data & individuals affected, severity, containment actions, Board notification date, Data Principal notification date, root cause, corrective actions, closure date.

The DPDP Act permits transfer of personal data outside India except to countries restricted by Government notification. Where processors store or process data outside India (e.g., cloud regions), VERALIS confirms the destination is not restricted, applies contractual safeguards, and records the transfer in the sub-processor register. CONFIRM data-residency choice for hosting

• Channel: admin@veralispress.com, monitored by the Grievance Officer.
• Acknowledge within 48 hours; resolve within 30 days (internal SLA, subject to final Rules).
• If unresolved or the Data Principal is dissatisfied, they may approach the Data Protection Board of India.
• All grievances and outcomes are logged for audit.

• Staff and contractors with access to personal data receive DPDP awareness briefing at onboarding and annually.
• This manual and all registers are reviewed at least annually and upon notification of the DPDP Rules or material change to processing.
• The Grievance Officer maintains evidence of compliance (RoPA, consent logs, DSR register, breach register, vendor contracts).
• Significant Data Fiduciary duties (DPO, independent audit, DPIA) are activated if VERALIS is so notified.