What is GDPR and DPDP?
Two major privacy laws shape how Certko and Instacertify Labs Private Limited handle personal data — the EU’s GDPR and India’s DPDP Act. This page explains both in plain language and how they apply on this website.
GDPR
The General Data Protection Regulation is the European Union’s primary privacy law (with a closely aligned UK GDPR). It protects personal data of people in the EU / EEA (and UK under UK GDPR) and applies to organisations that offer goods or services to those people or monitor their behaviour — even if the organisation is based outside Europe.
- Requires a lawful basis to process personal data (consent, contract, legitimate interests, legal obligation, etc.)
- Gives people rights: access, correction, erasure, restriction, portability, objection
- Expects transparency, security, and accountability (records, DPIAs where needed)
- Cookie / tracking technologies generally need consent before non-essential use
DPDP Act (India)
India’s Digital Personal Data Protection Act, 2023 (DPDP) is the national law for digital personal data. Organisations that decide why and how personal data is processed are Data Fiduciaries; people whose data is processed are Data Principals.
- Consent must be free, specific, informed, unconditional and clear (with notice)
- Data Principals can seek access, correction, erasure and withdrawal of consent
- Grievance redressal with the fiduciary, and escalation to the Data Protection Board of India
- Cross-border transfers allowed unless the government restricts specific countries
How they compare
| Topic | GDPR | DPDP |
|---|---|---|
| Geography | EU / EEA (+ UK GDPR) | India (digital personal data) |
| Who you are | Data subject | Data Principal |
| Who we are | Controller / processor | Data Fiduciary / Data Processor |
| Consent for cookies | Required for non-essential tracking | Consent / notice for personal data use |
| Rights portal | Use Certko’s data request form for either regime | |
How Certko complies
- Cookie banner with necessary / analytics / marketing choices
- Analytics scripts load only after analytics consent (when enabled in admin)
- Privacy Policy + this guide explain purposes and rights
- Data subject / Data Principal requests logged in our GDPR management console
- Inquiry retention and anonymisation controls for contact leads
This page is guidance, not legal advice. Scheme and regulatory details change — consult counsel for your organisation’s obligations.