The group policy for how HyperNext protects personal data, both as a custodian of the data we hold and as a processor of the data our customers entrust to our infrastructure. For our Indian campuses it is built around the Digital Personal Data Protection Act 2023; our international campuses follow the data-protection law that applies to them.
Personal data is among the most sensitive things anyone entrusts to a business. As we build the infrastructure of India's digital and AI economy, we are conscious that we hold personal data of our own, and that our customers run systems containing the personal data of millions of people on our infrastructure. That trust is at the heart of this policy.
For our Indian campuses, this policy is built around the Digital Personal Data Protection Act 2023, alongside the Information Technology Act 2000 and the rules made under it. Our international campuses follow the data-protection law that applies to them. We process personal data lawfully, fairly and securely, we honour the rights of the people it belongs to, and we treat customer personal data as their data, not ours.
Privacy is not a one-off compliance exercise. We design for privacy and security from the start, we measure how we are doing, and we hold ourselves accountable for getting it right. Every HyperNext employee and every partner working with us is expected to do the same.
| Field | Detail |
|---|---|
| Policy title | Data Protection and Privacy Policy |
| Classification | Public |
| Version | 1.0 |
| Effective date | February 2024 |
| Policy owner | Office of the Data Protection Officer |
| Approved by | The Board of HyperNext Data Center Limited |
| Next review | February 2025, or earlier on material or legal change |
| Applies to | All HyperNext entities, their people and processors acting on their behalf |
| Version | Summary of change |
|---|---|
| 1.0 | February 2024, initial issue, approved by the Board of HyperNext Data Center Limited. |
This policy governs how HyperNext collects, uses, stores, shares, transfers and protects personal data, both the data we determine the use of and the data we process on behalf of our customers. It sets the minimum standard across the group, against which subordinate procedures and contractual terms are aligned.
For our Indian campuses, Indian law applies, principally the Digital Personal Data Protection Act 2023, together with the Information Technology Act 2000 and the rules made under it. Our international campuses follow the data-protection law that applies to them, which may include the European Union General Data Protection Regulation and other comparable laws. Where a customer or law sets a stricter standard than this policy, the stricter standard applies.
The policy is implemented through subordinate standards on consent and notice, data subject rights, breach management, retention, cross-border transfers and supplier engagement.
Under the Digital Personal Data Protection Act 2023, HyperNext acts in two roles. Our duties differ in each, and this policy makes the distinction explicit.
| Role | When we are in it | What we are accountable for |
|---|---|---|
| Data Fiduciary | Personal data we determine the purpose and means of processing for: employees, candidates, suppliers' contacts and our own customer contacts. | Lawful basis, notice, consent management, rights of Data Principals, security, retention, breach notification and accountability. |
| Data Processor | Personal data hosted, transmitted or stored by customers on our infrastructure. | Acting only on documented customer instructions, securing the data, assisting the customer on rights and breach, and controlling sub-processors. |
We process personal data according to a consistent set of principles, wherever we operate, that are aligned with the Digital Personal Data Protection Act 2023 and with internationally accepted norms.
Where we act as a Data Fiduciary, we process personal data on a lawful basis. Under the Digital Personal Data Protection Act 2023, that is principally the free, informed, specific, clear and unambiguous consent of the Data Principal, or a legitimate use permitted by the Act.
Before or at the time we ask for consent, a notice is provided in clear and plain language describing the personal data being processed, the purpose for which it is processed, how a Data Principal can exercise their rights and how to make a complaint.
Where consent is the basis, it is collected through clear, affirmative action, with separate consent for separate purposes where it makes sense, and can be withdrawn as easily as it was given. We record consents, withdrawals and the version of the notice on which they were given. Where the law provides for a Consent Manager, we are able to interoperate with one.
Where we rely on a legitimate use permitted by the Act, for example employment matters, compliance with a court order, or response to a medical emergency, we do so only within the limits the Act sets.
The personal data of children, and of persons with disabilities for whom a lawful guardian acts, is handled with the additional care the Act requires, including verifiable parental or guardian consent and a prohibition on harmful tracking or targeted advertising.
Where HyperNext is the Data Fiduciary, we honour the rights the law gives to Data Principals. Where we are a processor, we support our customers in honouring those rights.
Requests are verified for identity, logged, tracked and answered within the timelines set by the law. Requests that are manifestly unfounded or excessive may be declined with reasons given to the Data Principal.
We design new services, products and changes so that privacy is the default outcome, not an after-thought, and so that personal data is protected throughout its life.
We protect personal data with reasonable security safeguards as the law requires and as good practice demands. The detail of those safeguards sits in our Information Security Policy, with which this policy works hand in hand.
Most of the personal data on our infrastructure belongs to our customers' systems. For that data, the customer is the Data Fiduciary and we are a processor. Our role is to handle it on their instructions, protect it, and help them meet their own obligations.
Where personal data moves across borders, for example between our Indian and international campuses, we do so only where the law allows and with appropriate safeguards.
Transfers comply with the restrictions and conditions of the applicable law, including the Digital Personal Data Protection Act 2023 and the rules and notifications made under it for data originating in India. Customer instructions on data location are respected, and we are transparent with customers about where their data is processed.
A personal data breach is handled through our incident response process, with the additional steps the law requires.
Personal data is kept only as long as it is needed for its purpose or as the law requires, and is then deleted or anonymised securely.
Retention periods are defined in a retention schedule maintained for each category of personal data we process as Data Fiduciary. For data we process on behalf of customers, retention and deletion follow the customer's instructions and contract. Media and equipment are sanitised securely at end of life, and the act of destruction is recorded.
Data protection is owned at executive level and overseen by the Board, with a clear way for people to raise concerns and independent assurance that we do what we say.
| Role | Responsibility |
|---|---|
| Board / Audit and Risk Committee | Approve this policy and oversee privacy risk and incidents. |
| Data Protection Officer | Owns the privacy programme, advises the business, and acts as the contact for Data Principals and the Data Protection Board of India. |
| Grievance Redressal Officer | Receives and resolves Data Principal grievances within the timelines the law requires. |
| System and information owners | Apply privacy controls to the systems and information they own. |
| All staff and third parties | Handle personal data correctly and report concerns through the channels provided. |
Our people receive privacy training at induction and at least annually, with role-specific training for those who handle personal data routinely.
Privacy controls are audited internally, and external assessments are conducted as customer and regulatory expectations require. The policy is reviewed at least annually and on legal change. Where HyperNext is notified that it is a Significant Data Fiduciary, the additional obligations of that designation are met.
Privacy questions, or a request to exercise a right, can be sent to confidential@hypernxt.com.
This page reproduces the published policy in full. For a signed, classification-marked PDF copy for your records, audit or due-diligence pack, email governance@hypernxt.com and we will send it across.