Data protection & regulatory approach
Compliance
How we approach data protection and regulatory frameworks — in India and internationally — for scult.in itself and for the software we build for clients.
Covered on this page
- DPDP Act, 2023 (India)
- GDPR, CCPA/CPRA, PIPEDA
- HIPAA, PCI-DSS, SOC 2, ISO 27001
A plain-language summary of our approach, not a certification. Full detail — including exactly what we don't claim — is below.
This page is a plain-language summary of our approach — it is not a compliance certification, and Scult does not claim to hold any regulatory certification it has not actually obtained. Where a specific standard applies to your business, the compliance determination and any required audit, registration, or agreement is yours as the responsible entity — often best done with your own legal counsel. We design the technical foundation that supports it and are glad to work alongside your compliance team.
At a glance
| Framework | Region | What it governs | Who's responsible |
|---|---|---|---|
| DPDP Act, 2023 | India | Digital personal data of people in India | You, as data fiduciary — we build the technical foundation |
| GDPR | EU / UK | Personal data of EU/UK individuals | You, as data controller |
| CCPA / CPRA | California, USA | California consumers’ personal information | You, as the business |
| PIPEDA | Canada | Private-sector personal information | You, as the organization |
| HIPAA | US healthcare | Protected health information (PHI) | You (covered entity) via a signed BAA |
| PCI-DSS | Global | Payment card data | Your processor, when card data never touches your servers |
| SOC 2 | Global (SaaS) | Security/availability controls over time | An independent CPA auditor certifies you |
| ISO/IEC 27001:2022 | Global | Information security management (ISMS) | An accredited certification body certifies you |
India: the DPDP Act
The Digital Personal Data Protection Act, 2023 is India's primary personal-data law. It applies to the processing of digital personal data of individuals in India, built around three roles: a Data Fiduciary (the entity that decides why and how data is processed), a Data Principal (the individual the data belongs to), and a Consent Manager (a registered intermediary that lets a Data Principal give, review, and withdraw consent across services).
Two details worth knowing if you're scoping a project around this: the Act lets government designate certain fiduciaries as a Significant Data Fiduciary — based on the volume and sensitivity of data processed — which brings extra obligations like appointing a Data Protection Officer and running periodic Data Protection Impact Assessments. And Section 16 gives government the power to restrict transfers of personal data to specific countries, which matters if your product stores Indian user data on infrastructure outside India.
Where enforcement actually stands
The Act was passed in 2023, but its substantive obligations are being phased in — this isn't a law that's been fully enforced and audited for years yet:
- 1
13 Nov 2025
The DPDP Rules were notified and the Data Protection Board of India — the body that will hear grievances and enforce the Act — was established.
- 2
Nov 2026
Registration of Consent Managers begins.
- 3
13 May 2027
Full enforcement — consent, privacy-notice, and security-safeguard obligations — takes effect for every data fiduciary.
What this means for scult.in
As the data fiduciary for information collected through this website — names, emails, and phone numbers submitted via our contact and booking forms — we collect only what we need to respond to your enquiry, we don't sell personal data to anyone, and we provide a real contact channel (below) for any data request. Our Privacy Policy covers this in full.
What this means for client projects
When we build software that will process the personal data of people in India — a CRM, a booking system, a customer portal — we design with these principles from the start:
- Purpose limitation — collect only what a workflow genuinely needs
- Consent capture at the point of collection, with a real way to withdraw it
- Data Principal rights (access, correction, erasure) built into the product
- A grievance-redressal contact point surfaced to end users
As your project's own data fiduciary, you remain responsible for your DPDP Act registration status, any Consent Manager integration once that framework is live, and your own breach-notification obligations. See our build methodology for how data-handling decisions like these fit into how we scope a real project, or our custom software development service for what a build actually includes.
International frameworks
Scult builds for clients across the US, UK, Canada, Gulf, and Australia. Here's how we think about the frameworks that matter most for international projects.
GDPR
European Union / UK
The EU's General Data Protection Regulation gives individuals rights over their personal data — access, correction, erasure, and portability — and requires a lawful basis for processing, breach notification within 72 hours, and a Data Protection Officer in certain cases.
Our approach: For projects serving EU or UK users, we build lawful-basis-first consent flows, minimize what's collected at each step, and give users a real way to access or delete their data from inside the product — not just a policy document promising it. Article 30 processing records, DPO appointment, and cross-border transfer mechanisms (SCCs, adequacy decisions) are legal determinations you own as the data controller, typically with your own counsel.
CCPA / CPRA
California, USA
California's Consumer Privacy Act (amended by the CPRA) gives California residents the right to know what personal information is collected, request deletion, and opt out of the sale or sharing of their data.
Our approach: We build the technical hooks CCPA/CPRA compliance actually depends on — a working 'Do Not Sell or Share My Personal Information' control, a deletion workflow that really removes data (not just hides it), and clear disclosure at the point of collection. Whether your business crosses CCPA's revenue/data-volume applicability thresholds is your determination.
PIPEDA
Canada
Canada's Personal Information Protection and Electronic Documents Act sets out ten fair-information principles for private-sector data handling — consent, limiting collection, and Principle 7's requirement for appropriate physical, organizational, and technological safeguards. Quebec's Law 25 layers additional requirements for Quebec residents.
Our approach: We architect around PIPEDA's safeguards principle directly — access controls, encryption, and a documented security posture (the same technical ground ISO 27001 covers, below). For Quebec-specific obligations under Law 25, we scope those explicitly with you rather than assuming a general Canadian build covers them.
Industry-specific standards
We build healthcare, fintech, and enterprise SaaS software where these standards genuinely apply. Here's what each one actually requires, and where we fit.
HIPAA
US Healthcare
The Health Insurance Portability and Accountability Act sets security and privacy rules for protected health information (PHI) — access controls, encryption, audit logging, and breach notification — enforced through a Business Associate Agreement (BAA) between a covered entity and its vendors.
Our approach: When PHI is in scope, we architect for it from the data model up: role-based access control, encryption in transit and at rest, and audit trails on every read/write of patient data. Scult isn't a HIPAA-covered entity or business associate by default — if your engagement needs a signed BAA, that's a real document we execute alongside your compliance counsel, not a checkbox on this page.
PCI-DSS
Global — Payment Cards
The Payment Card Industry Data Security Standard governs how businesses that store, process, or transmit cardholder data must secure it — network segmentation, encryption, and regular vulnerability scanning, validated through a formal assessment (SAQ or a Qualified Security Assessor audit).
Our approach: The most defensible position on card data is not touching it at all — we route payment flows through PCI-DSS-validated processors (Stripe, Razorpay, PayU) so raw card numbers never reach your servers, which keeps most merchants in the lighter self-assessment tiers. Full validation, where your volume requires it, runs through your acquiring bank's process.
SOC 2
Enterprise SaaS (Global)
SOC 2 is an auditing framework, not a law — it evaluates security, availability, processing integrity, confidentiality, and privacy controls over an observation period, and enterprise buyers increasingly require it of their SaaS vendors during procurement.
Our approach: For SaaS products headed for enterprise sales, we build the access-control discipline, change-management process, and logging a SOC 2 Type II audit actually checks — so the product is audit-ready the day you commission one. We don't self-certify SOC 2, and no vendor honestly can; it requires an independent CPA firm over real elapsed time.
ISO/IEC 27001:2022
Global — Information Security
The current international standard for an information security management system (ISMS), reorganized in its 2022 revision into 93 controls across four themes — organizational, people, physical, and technological. It aligns closely with obligations under GDPR, PIPEDA, and similar regimes.
Our approach: We build against the same control themes ISO 27001 formalizes — access management, change control, incident response, vendor risk — whether or not a client is pursuing certification. Certification itself is a multi-month process through an accredited body; we support the technical evidence an auditor will ask for, we don't issue the certificate.
How we handle a compliance-sensitive project
The same four steps, whether the framework is the DPDP Act, HIPAA, or something else entirely.
01
Data mapping
Before writing a line of code, we map what personal or regulated data the product will touch, where it flows, who can see it, and how long it needs to be kept.
02
Framework fit
We identify which real frameworks apply — by user geography, industry, and data type — and translate each into concrete technical requirements, not a generic checklist.
03
Architecture with safeguards built in
Access control, encryption, consent capture, and audit logging get designed into the data model from day one — retrofitting these later is expensive and error-prone.
04
Documentation handover
You get a real record of what was built and why — the data flows, the access model, the retention rules — so your own legal or audit process has something concrete to work from, not a black box.
What we do on this site today
Real, checkable practices — HTTPS enforced site-wide, the security headers (CSP, HSTS, and more) documented on our Security page, and secrets kept out of source control. This site asks for your consent before loading Google Analytics — accept or decline when the banner appears, and change your choice anytime via “Cookie Preferences” in the footer.
Your data rights
To access, correct, or request deletion of personal data we hold about you, or to raise a grievance, email connect@scult.in. See our Privacy Policy for the full detail.
Frequently asked questions
Is Scult DPDP Act, GDPR, or HIPAA certified?
No — and we'd tell you if we were. None of these frameworks work as a certification a vendor holds in the abstract; DPDP Act obligations attach to the data fiduciary (usually you, for your product), GDPR compliance is assessed by a data protection authority or auditor against your specific processing, and HIPAA compliance is validated through a signed Business Associate Agreement plus your own risk assessment. What we do is build the technical foundation — access control, encryption, consent capture, audit logging — that makes your compliance work possible.
Who is legally responsible for compliance on a project you build for us?
You are, as the business that owns the data and the customer relationship. We design and build with the relevant framework's requirements in mind, document what we've implemented, and are glad to work alongside your legal counsel or auditor — but the registration, the signed agreements (like a HIPAA BAA), and the ongoing compliance program are yours to own.
What does Scult actually do with the personal data it collects through this website?
We collect only what a contact or booking form needs — name, email, phone, and the message itself. We never sell it. It's used to respond to your enquiry and, if you say yes, to follow up about your project. Full detail is in our Privacy Policy.
Does scult.in use cookies or tracking?
Yes, Google Analytics, and only after you accept the cookie banner shown on your first visit. If you decline, analytics never loads. You can change your choice anytime via "Cookie Preferences" in the footer.
What is India's DPDP Act, in one sentence?
The Digital Personal Data Protection Act, 2023 is India's law governing how digital personal data of people in India can be collected, used, and protected — built around consent, purpose limitation, and a set of rights for the person the data belongs to (the Data Principal).
Is the DPDP Act already being enforced?
Partially. The Rules were notified on 13 November 2025 and the Data Protection Board of India was set up the same day. Consent Manager registration begins in November 2026. Full enforcement of the consent, notice, and security-safeguard obligations doesn't take effect until 13 May 2027 — so this is a live, evolving compliance landscape, not a settled one.
We handle payment card data — do you become PCI-DSS responsible for us?
Generally no, and the safest architecture keeps it that way: we route card data directly to a PCI-DSS-validated processor (Stripe, Razorpay, PayU) so it never touches your servers or ours. That keeps most merchants in a lighter self-assessment tier. If your business model genuinely requires storing card data yourself, that's a materially different (and more expensive) architecture — worth a real conversation before scoping.
Can you sign a Data Processing Agreement (DPA) or a HIPAA Business Associate Agreement (BAA)?
Yes, when a project genuinely calls for one — these are real legal documents, and we'll work through them with your legal team rather than treat them as a formality. Email connect@scult.in to start that conversation.