Data Management, Retention, and Privacy Policy

Scope

• All employees, contractors, consultants, temporary staff, interns, visitors, and third-party vendors handling or accessing the organization's data, IT infrastructure, cloud services (AWS, Azure, Google Cloud), or operational systems.
• All data types — customer data (PII, payment details), operational data, financial records, and intellectual property.
• All IT assets — endpoints (laptops, desktops, mobile devices), servers, network devices, applications, databases, and APIs.
• All business operations — SaaS platform delivery, customer support, billing, payment processing, and internal processes.
• Data handling, storage, and processing — ensuring compliance with data localization (storing customer data in India per DPDPA) and privacy regulations.

4.1 Data Classification

• Confidential — Customer PII (names, emails, payment details), financial records, intellectual property (source code).
• Sensitive — Internal business data (operational plans, employee records, internal APIs).
• Public — Marketing materials, public-facing website content, open APIs.
• Data is tagged with classification labels in storage and transit to enforce security controls.

4.2 Data Collection and Processing

• Collect only data necessary for a specific, lawful purpose (data minimization).
• Ensure data is accurate, up-to-date, and processed with explicit consent or legal basis.
• Document data processing activities in a centralized data inventory.

4.3 Data Storage and Security

• Store data in secure, encrypted environments (AWS ap-south-1) compliant with data localization requirements.
• Protect data with AES-256 encryption at rest and TLS 1.3 in transit.
• Restrict access to authorized roles based on Principle of Least Privilege (PoLP) and Role-Based Access Control (RBAC).

4.4 Data Access and Sharing

• Access is granted only to authorized personnel with a legitimate business need.
• Data sharing with third parties requires contractual agreements and compliance with privacy regulations.
• Use secure channels (encrypted APIs, SFTP) for data transfers.

5.1 Retention Periods

• Retain data only as long as necessary to fulfill its purpose or meet regulatory requirements.
• Define retention periods based on data type, regulatory obligations, and business needs.
• Regularly review retention schedules to ensure compliance and relevance.

5.2 Data Archiving

• Archive data no longer actively needed in secure, encrypted, and access-restricted repositories.
• Ensure archived data remains retrievable for audits or legal purposes.
• Limit access to archived data to authorized personnel with Multi-Factor Authentication (MFA).

5.3 Data Disposal

• Dispose of data securely when retention periods expire, using methods that prevent recovery (data wiping, shredding).
• Certify disposal processes to ensure compliance with privacy regulations.
• Maintain records of disposal activities for audit purposes.

6.1 Lawful Basis for Processing

• Process data only with a lawful basis (consent, contract, legal obligation) per GDPR, CCPA, and DPDPA.
• Document the lawful basis for each data processing activity in the data inventory.
• Cease processing if the lawful basis no longer applies, unless required by law.

6.2 Data Subject Rights

Uphold data subject rights, including:

• Access — Right to view personal data held by the organization.
• Rectification — Right to correct inaccurate data.
• Erasure — Right to request data deletion (subject to legal obligations).
• Restriction — Right to limit data processing.
• Portability — Right to receive data in a machine-readable format.
• Objection — Right to object to processing (e.g., for marketing).
• Respond to data subject requests within 30 days (GDPR/CCPA) or as per DPDPA timelines.

6.3 Consent Management

• Obtain explicit, informed consent for processing personal data when required.
• Provide clear, accessible mechanisms for granting, reviewing, and withdrawing consent.
• Maintain records of consent for audit and compliance purposes.

6.4 Data Minimization

• Collect and process only the minimum data necessary for the intended purpose.
• Regularly review data collection practices to eliminate unnecessary data points.
• Anonymize or pseudonymize data where possible to reduce privacy risks.

6.5 Data Protection by Design and Default

• Embed data protection principles into system design, processes, and operations.
• Configure systems to default to the most privacy-preserving settings (minimal data access, encryption enabled).
• Conduct Privacy Impact Assessments (PIAs) for new systems or processes handling personal data.

7.1 Data Inventory and Mapping

• Maintain a centralized data inventory documenting all data types, sources, purposes, and storage locations.
• Map data flows to identify collection, processing, storage, and sharing activities.
• Update the inventory quarterly or upon significant changes (new systems, vendors).
• Use Data Governance tools (Collibra, OneTrust) to automate inventory and mapping.
• Restrict inventory access to the Compliance Officer, DPO, and authorized auditors.

7.2 Data Security Controls

• Encryption — AES-256 for data at rest; TLS 1.3 for data in transit.
• Access Controls — Enforce PoLP, RBAC, and MFA for all data access; use Privileged Access Management (PAM) for sensitive data and systems.
• DLP — Deploy Data Loss Prevention tools to detect and prevent unauthorized data exfiltration.
• Monitoring — Use SIEM and XDR tools to monitor data access and detect anomalies in real-time.

7.3 Data Backup and Recovery

• Schedule daily backups of critical data (customer databases, billing records) to encrypted, off-site storage.
• Test backup integrity and restoration processes quarterly.
• Restore data within RPOs (e.g., 1-hour data loss limit) during incidents.
• Verify restored data for integrity and security before resuming operations.
• Maintain geo-redundant backups across AWS regions (ap-south-1, ap-southeast-1).

7.4 Third-Party Data Management

• Assess vendors' data security and privacy practices before sharing data.
• Require vendors to provide SOC 2 Type II, ISO 27001, or equivalent certifications.
• Include data protection clauses in contracts mandating compliance with Alphawave's policies.
• Require vendors to notify Alphawave of data incidents within 24 hours.
• Conduct annual vendor audits to verify data handling compliance.

8.1 Retention Schedule

Examples of retention periods applied across data categories:

• Customer Data — Retain for 5 years post-contract per DPDPA, unless requested for deletion.
• Financial Records — Retain for 7 years per Indian tax laws.
• Employee Records — Retain for 5 years post-employment per labor laws.
• Logs (Access, Incident) — Retain for 5 years for critical systems, 3 years for others.
• Public Data — Retain indefinitely unless obsolete or requested for removal.
• Document retention periods in a centralized retention schedule, reviewed annually.
• Automate retention tracking using Data Governance tools.
• Extend retention for legal holds or regulatory investigations, with approval from the Compliance Officer.

8.2 Archiving Process

• Move inactive data to a secure, encrypted archive repository after active use ends.
• Restrict archive access to authorized personnel with MFA and PAM controls.
• Maintain metadata for retrievability (data type, retention period, access history).
• Use cloud-based archives (AWS S3 Glacier) with geo-redundancy and encryption.
• Conduct semi-annual archive audits to verify security and compliance.

8.3 Secure Data Disposal

• Digital Data — Use secure wiping tools (NIST 800-88 compliant) to overwrite data.
• Physical Media — Shred or incinerate physical records and storage devices.
• Identify data eligible for disposal based on retention schedules.
• Obtain approval from the Compliance Officer and DPO before disposal.
• Certify disposal with documented evidence (destruction certificates).
• Conduct annual disposal audits to verify compliance and completeness.

9.1 Privacy Impact Assessments (PIAs)

• Conduct PIAs for new systems, processes, or vendors handling personal data.
• Assess data processing risks, including privacy, security, and compliance impacts.
• Identify mitigation measures (encryption, anonymization).
• Document findings and obtain DPO approval before implementation.
• Review PIAs annually or upon significant changes to data processing activities.

9.2 Data Subject Request Handling

• Receive requests via a dedicated privacy portal or email (privacy@mitigata.com).
• Verify requester identity using secure methods (MFA, ID checks).
• Respond within 30 days (GDPR/CCPA) or as per DPDPA timelines, providing requested data or actions.
• Log all requests, responses, and timelines in a privacy management system.
• Escalate complex requests to the DPO and Compliance Officer for resolution.

9.3 Breach Notification

• Internal — Report breaches to the SOC Team and IRT within 1 hour of detection; escalate to Compliance Officer and DPO.
• Customer — Notify affected customers within 24 hours of confirmed personal data breaches via email, status page, and social media.
• Regulatory — Report to CERT-In within 6 hours for critical incidents; notify GDPR authorities within 72 hours for personal data breaches; comply with DPDPA timelines for Indian data breaches.
• Documentation — Maintain detailed breach records, including impact, response, and notifications.

9.4 Cross-Border Data Transfers

• Ensure transfers comply with GDPR, DPDPA, and other regulations (Standard Contractual Clauses, Binding Corporate Rules).
• Store customer data in India per DPDPA localization mandates, unless explicit consent is obtained.
• Conduct transfer impact assessments for cross-border data flows.
• Use encrypted channels and contractual safeguards for transfers.
• Review transfer compliance annually with DPO oversight.

10.1 Mandatory Training

• Annual training for all employees, contractors, and vendors, with onboarding sessions within 7 days of hire.
• Content — Data classification, handling, security best practices, retention schedules, secure disposal, data subject rights, consent management, breach notification, and regulatory requirements (GDPR, DPDPA, ISO 27001).
• Delivery — Online portal with interactive modules, quizzes, and case studies.
• Certification — Completion certificates required, tracked by HR.

10.2 Role-Specific Training

• IT Staff — Encryption, DLP, backup, and recovery processes.
• Customer Support — Handling data subject requests and customer privacy inquiries.
• Developers — Secure coding and data protection by design.
• Management — Approving data-sharing agreements and overseeing compliance.
• Frequency — Semi-annual sessions, supplemented by annual refreshers.

10.3 Awareness Campaigns

• Monthly campaigns via newsletters, posters, videos, and workshops.
• Topics — Data minimization, secure handling, breach risks, consent management, data subject rights.
• Use CERT-In, CSIRT-Fin advisories, and real-world examples to highlight risks.
• Host quarterly town halls to discuss data privacy updates and gather feedback.
• Track participation and feedback to assess effectiveness.

10.4 Third-Party Training

• Vendors handling data must complete annual data management and privacy training.
• Training covers Alphawave's policies, regulatory obligations, and incident reporting.
• Require vendors to submit training completion certificates during audits.
• Suspend vendor data access until training is completed.

11.1 Regulatory Compliance

• Align practices with ISO 27001, GDPR, CCPA, DPDPA, and CERT-In requirements.
• Comply with data localization mandates, storing customer data in India per DPDPA.
• Meet regulatory reporting timelines (6 hours for CERT-In, 72 hours for GDPR).
• Maintain a compliance register documenting data policies, audits, and regulatory communications.

11.2 Data Audits

• Annual audits by internal teams and CERT-In empaneled auditors, with quarterly internal reviews.
• Verify data inventory, classification, and retention compliance.
• Assess security controls — encryption, DLP, access restrictions.
• Review data subject request handling and breach notification processes.
• Evaluate training completion and third-party compliance.
• Use Data Governance and SIEM tools to generate audit reports.
• Conduct PIAs and Vulnerability Assessments annually to test data controls.
• Address critical findings within 30 days, non-critical within 90 days.

11.3 Incident Reporting and Response

• Report data-related incidents (breaches, unauthorized access) within 1 hour via the incident reporting portal.
• SOC Team escalates to the IRT, Compliance Officer, and DPO.
• Isolate affected data/systems, mitigate risks, and notify stakeholders.
• Follow Incident Management Policy procedures for containment and recovery.
• Conduct root cause analysis and update data controls.
• Document lessons learned and integrate into training.