Data Processing Agreement (DPA)
Contractual framework detailing the roles of Controller and Processor under the Digital Personal Data Protection (DPDP) Act, 2023.
1. Scope & DPDP Act Definitions
This Data Processing Agreement (DPA) applies to the processing of employee records (personal data) uploaded by the Employer to AccoNova. Under the Digital Personal Data Protection (DPDP) Act of India, the Employer acts as the Data Fiduciary (Controller), and AccoNova acts as the Data Processor.
AccoNova processes employee records strictly on the written instructions of the Data Fiduciary and solely to execute payroll, attendance, and HR operations.
2. Categories of Processed Personal Data
To execute automated payroll and geofence tracking, the Data Fiduciary authorizes the processing of the following employee records:
- Identity Records: Full name, official email, telephone numbers, and photographic selfie hashes.
- Statutory Details: Permanent Account Number (PAN), Aadhaar card details (if used for verification), bank routing numbers, and IFSC codes.
- Payroll Records: Monthly salary slabs, tax regime declarations, EPF UAN, ESIC IP numbers, and state professional tax classes.
- Telemetry Data: GPS coordinates logged during mobile geofenced attendance punches.
3. Technical Security & Indian Data Residency
AccoNova implements robust technical measures to prevent unauthorized data access. All databases are encrypted at rest using AES-256 and in transit using TLS 1.3.
Data Residency: In compliance with localization guidelines under Indian IT rules and the DPDP Act, all employee data, payroll records, and document uploads are hosted strictly on secure cloud servers located within the territory of India (Mumbai/Delhi regions).
4. Data Breach Response & Notifications
In the event of a confirmed security incident affecting the Fiduciary's employee data, AccoNova will notify the primary administrator of the Fiduciary within seventy-two (72) hours of confirming the breach.
We will provide a detailed report outlining the nature of the breach, the estimated categories of affected employee records, and the remediation steps taken by our security team.
5. Authorized Infrastructure Sub-processors
AccoNova engages sub-processors to assist in delivering SaaS services, including cloud hosting providers and bulk notification gateways. All sub-processors are contracted under confidentiality clauses and must comply with the DPDP Act 2023 rules.
Our list of primary sub-processors includes Amazon Web Services (AWS) Mumbai region for database clusters, and government-approved SMS gateway providers inside India for OTP authentication.