DPDPA Compliance Statement
Summary: Unknown Verdict is a data fiduciary under the Digital Personal Data Protection Act, 2023. This statement describes how the platform complies with each material obligation of the Act. Where the platform has no exposure (because it collects no personal data), that is stated explicitly.
1. Role under the DPDPA
Under the DPDPA, the operator — The Advocacy — A Law Firm — is a Data Fiduciary in respect of any personal data it determines the purpose and means of processing. In practice, the retrieval interface collects no personal data of users, so the fiduciary obligations largely apply only to the redacted audit ledger.
2. Notice (Section 5)
The DPDPA requires a Data Fiduciary to give the Data Principal a notice describing the personal data sought, the purpose of processing, and the manner in which rights may be exercised. This Privacy Policy and the present statement together constitute that notice. They are accessible at all times from every page of the service.
3. Consent (Section 6)
The DPDPA requires consent to be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. Unknown Verdict does not seek consent for processing of user personal data, because it does not process user personal data. Query text is PII-redacted before any persistence, and the original text is discarded after the response is generated. No consent is required because no personal data is being processed.
4. Legitimate uses (Section 7)
To the extent that the redacted audit ledger is treated as containing any residual personal data, the processing falls within the "legitimate use" grounds in Section 7 — specifically, the operation of a legal research tool and the maintenance of an audit trail for integrity and accountability.
5. General obligations of a Data Fiduciary (Section 8)
| Obligation | How Unknown Verdict complies |
|---|---|
| Ensure accuracy and completeness of personal data | The platform stores no user personal data. The audit ledger stores only redacted queries. |
| Implement appropriate technical and organisational measures | Hash-chained audit ledger; PII redaction at the application layer; HTTPS in transit; no external LLM calls. |
| Take reasonable security safeguards against breach | Hash-chaining detects any tamper. No user PII is stored to be breached. |
| Notify the Board and affected Data Principals of a personal data breach | Because no personal data is held, breach of personal data cannot occur on the query path. If the operator becomes aware of a breach of the audit ledger, the operator will notify the Board as required. |
| Erase personal data upon withdrawal of consent | No consent-based processing occurs. Deletion requests for ledger entries are honoured — see Data Policy §6. |
| Appoint a Data Protection Officer (if Significant Data Fiduciary) | Unknown Verdict has designated a Grievance Officer and Data Protection contact. Whether the platform qualifies as a Significant Data Fiduciary will be reassessed periodically in light of the Central Government's notification. |
6. Rights of Data Principals (Sections 11–14)
- Right to access information (S. 11): Users may request a summary of any personal data held. Because none is held, responses will typically state that no personal data exists. Contact:
upmanyu@advocacyalawfrim.in. - Right to correction and erasure (S. 12): Users may request correction or erasure of personal data. Because none is held, the request will be recorded and the absence of data confirmed.
- Right of grievance redressal (S. 13): A Grievance Officer has been designated — see §8 below.
- Right to nominate (S. 14): Users may nominate another individual to exercise their rights in the event of death or incapacity, by email.
7. Cross-border transfer
The DPDPA permits transfer of personal data outside India subject to restrictions the Central Government may notify. Unknown Verdict does not transfer personal data outside India because it does not hold personal data. Where the platform is deployed on infrastructure outside India (e.g. by a client), the client assumes responsibility for that deployment.
8. Grievance Officer
- Name: Upmanyu Kumar, Advocate
- Designation: Grievance Officer
- Email:
upmanyu@advocacyalawfrim.in - Address: The Advocacy — A Law Firm, Delhi
- Response time: acknowledgement within 24 hours, resolution within 15 days
9. Data Protection Impact Assessment
Because Unknown Verdict does not process user personal data, a full DPIA under Section 10 is not triggered. The operator will conduct a DPIA if the platform's processing operations change in a way that materially affects data protection risk — for example, if user accounts, payment processing, or personal data uploads are introduced.
10. Contact
Data Protection contact: upmanyu@advocacyalawfrim.in
Operator: The Advocacy — A Law Firm, Advocate Registration No. D-180-2017, Bar Council of Delhi