National Law University Delhi (“the University”, the Data Fiduciary) operates this repository to hold institutional records and the records of its statutory bodies. This notice explains, as required by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, what personal data we process about you, why, and how you can exercise your rights.
1. Personal data we process
The itemised list of personal data and the specific purpose for each item appears in the table below this notice.
2. Records containing personal data of others
Some institutional records (for example result sheets or admission lists) contain personal data of students, staff or applicants. These are processed for the University's functions under law and for employment purposes, are marked as containing personal data, are visible only to authorised users, are encrypted at rest, and are erased or reviewed when their retention period ends.
3. Your rights
- Obtain a summary of your personal data and the processing activities (Access)
- Correct, complete, update or erase your personal data
- Withdraw any consent you have given, as easily as you gave it
- Nominate another person to exercise your rights in case of death or incapacity
- Have your grievance redressed by our Data Protection Officer, and thereafter approach the Data Protection Board of India
You can exercise these rights from My Privacy after signing in, or through the public privacy page without signing in.
4. Security and retention
We use encryption, access control, masking of personal data, audit logging and backups. Logs are kept for at least one year. Personal data is erased when it is no longer needed for the purpose, unless the law requires us to keep it; where practical we give 48 hours' notice before erasure.
5. Breaches
If a personal data breach affects you, we will tell you without delay, together with its likely consequences and the steps we have taken, and we will report it to the Data Protection Board.
Personal data we process and why
| Purpose | Personal data | Basis | Kept for |
|---|---|---|---|
| User account and secure access Creating and managing your account, authenticating you, enforcing role-based access and protecting the repository. |
Name, official email address, designation, department, mobile number (optional), password hash | Employment purposes | Kept while you hold an account; anonymised on closure |
| Security logs and audit trail Recording sign-ins, document access and changes to detect misuse and investigate incidents, as required by the DPDP Rules. |
User id, IP address, browser user-agent, time and nature of each action | Legal obligation | At least one year, then purged |
| Record submission and approval Routing records you submit or approve, and recording your decisions in the record history. |
Name, role, comments and decisions on records | Employment purposes | Kept for the life of the record |
| Email notifications Emailing you when a meeting, document or record task needs your attention. |
Official email address | Your consent | Until you withdraw consent |
We respond to requests and grievances within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
© 2026 National Law University Delhi