Data Protection and Consent Compliance

All Users must comply with the Information Technology Act, 2000, and applicable data privacy laws, including applicable rules and guidelines. Users must obtain informed consent from Data Principals before accessing personal data and must inform them of the purpose of such processing. Privacy notices must be provided in clear and accessible terms. Any breach affecting personal data must be reported to API Setu within 24 hours. Data retention must be limited to what is necessary and permitted by law. Where DigiLocker integration is involved, Users must strictly comply with all consent mechanisms defined under the DigiLocker framework as well as the Terms of Use as updated on DigiLocker website (https://www.digilocker.gov.in/web/about/tos). Requesters shall exercise due diligence to ensure that data accessed through the APIs is used lawfully and shall not hold API Setu liable for any misuse or unauthorized access resulting from their failure to exercise such diligence.

For non-personal data, compliance with NDSAP’s open sharing principles shall apply, distinct from personal data consent under applicable data sharing laws. Consent mechanisms shall mirror DigiLocker’s OTP/eSign flows for integrated APIs. Furthermore, API Setu will not provide personal data without legally valid consent signals embedded in the API transaction.