Data Protection Policy

1. Purpose

This Data Protection Policy establishes a comprehensive framework for protecting personal data and sensitive information processed by Alphawave Technologies Private Limited, ensuring compliance with applicable data protection regulations and maintaining the confidentiality, integrity, and availability of data. The policy aims to:

• Protect Personal Data — Safeguard customer, employee, and partner data against unauthorized access, loss, or misuse.
• Ensure Compliance — Align with ISO 27001:2022, GDPR, CCPA, DPDPA, and contractual SLAs.
• Mitigate Risks — Prevent data breaches and minimize the impact of incidents through proactive measures.
• Maintain Trust — Foster confidence among customers, partners, and stakeholders through transparent data practices.
• Support Accountability — Define roles, responsibilities, and procedures for data protection across the organization.

2. Scope

This policy applies to:

• Data — All personal data (e.g., customer PII, employee records), sensitive business data (e.g., intellectual property, financial records), and operational data processed by Alphawave.
• IT Systems — All hardware (laptops, servers), software (SaaS applications, APIs), cloud services (AWS EC2, S3, RDS), and network infrastructure.
• Personnel — Employees, contractors, consultants, and temporary workers across DevOps, Product Development, Customer Support, QA, HR, IT, Admin and Physical Security, Infosec and Compliance, Finance, and Legal.
• Dependencies — Third-party providers including Cloud Service Providers (e.g., AWS), API vendors, and payment processors.
• Exclusions — Non-personal data not subject to regulatory requirements and external parties not directly processing Alphawave's data.

3. Roles and Responsibilities

• Data Protection Officer (DPO) — Sarthak Dubey, COO. Oversees data protection, ensures compliance, manages regulatory reporting.
• IT Security Team — Implements technical controls (encryption, access controls) and monitors data security.
• System Administrators — Configure systems to comply with data protection requirements (encryption, backups).
• Compliance Officer — Verifies adherence to GDPR, CCPA, DPDPA, ISO 27001:2022; conducts audits.
• HR Manager — Manages employee data protection training and insider threat investigations.
• Employees / Contractors — Handle data responsibly, report breaches, complete mandatory training.
• Third-Party Vendors — Comply with data protection requirements and provide compliance reports per SLAs.

4. Data Protection Principles

• Lawfulness, Fairness, and Transparency — Process data lawfully and transparently with clear justification (consent, contractual necessity).
• Purpose Limitation — Collect data only for specified, legitimate purposes (SaaS platform services, customer support).
• Data Minimization — Collect and process only the data necessary for the intended purpose.
• Accuracy — Ensure data is accurate and updated as needed, with mechanisms for correction.
• Storage Limitation — Retain data only for as long as necessary (e.g., 7 years for audit logs under DPDPA).
• Integrity and Confidentiality — Protect data against unauthorized access, loss, or alteration using encryption and access controls.
• Accountability — Document and demonstrate compliance through policies, audits, and training.

5. Data Protection Procedures

6. Data Breach Response

• Detect breaches using AWS GuardDuty, CloudWatch, and Splunk, with alerts to the IT Security Team within 15 minutes.
• Report breaches internally via the IT ticketing system or security@alphawave.com within 1 hour, per the SIRP.
• Follow the SIRP for containment, eradication, and recovery (isolate affected systems within 1 hour, restore from backups within 90 minutes).
• Notify affected customers within 72 hours via email and status page, per GDPR/DPDPA.
• Report to regulatory authorities (CERT-In, EU DPA) within 72 hours, coordinated by the DPO.
• Conduct a post-incident review within 72 hours, documenting lessons learned in a secure AWS S3 bucket.
• Update risk assessments and mitigation plans, per the Risk Remediation Plan.

7. Monitoring and Auditing

• Monitor data access and processing using AWS CloudTrail, GuardDuty, and Splunk, with alerts for unauthorized activities within 15 minutes.
• Review data handling practices monthly to ensure compliance with this policy.
• Conduct quarterly audits of data protection practices using AWS Config and external tools (e.g., Qualys).
• Retain audit logs for 7 years in a secure AWS S3 bucket, per GDPR/DPDPA.

8. Training and Awareness

• Conduct mandatory bi-annual training on data protection principles, regulatory requirements, and breach reporting.
• Include role-specific modules for Customer Support, DevOps, and IT Security.
• Perform quarterly phishing simulations to test employee awareness.
• Conduct annual tabletop exercises to simulate data breach scenarios.

9. Third-Party Management

• Require vendors to comply with data protection standards (ISO 27001:2022, GDPR) via DPAs.
• Conduct annual vendor audits to verify data protection controls, with results reported to the Compliance Officer.
• Ensure AWS configurations (S3 bucket policies, IAM roles) align with data protection requirements.
• Review AWS Shared Responsibility Model compliance quarterly.

10. Policy Review and Updates

• Review the policy annually or after significant changes in regulations (e.g., DPDPA amendments), technology (e.g., new AWS services), or processes.
• Reviews conducted by the DPO in coordination with the IT Security Team and Compliance Officer.
• Updates proposed by the DPO, approved by the CISO and senior management, and communicated via training and internal announcements.
• Updated policies stored in a secure AWS S3 bucket, accessible to all employees.

11. Enforcement

All employees, contractors, and third-party vendors must adhere to this policy. Non-compliance (mishandling data, bypassing encryption) results in:

• First Offense — Written warning and mandatory retraining within 14 days.
• Second Offense — Suspension and review by HR and the CISO.
• Repeat Violations — Termination or contract cancellation, as determined by HR and the CISO.
• Employees report violations via the IT ticketing system or anonymously through the whistleblower portal.
• Violations investigated by the Infosec and Compliance Team within 48 hours.