Grass2Glory is designed from the ground up to comply with India's Digital Personal Data Protection Act, 2023 — the most comprehensive data protection law in Indian history.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's comprehensive data protection legislation. It establishes rights for Data Principals (individuals), obligations for Data Fiduciaries (organisations processing data), special protections for children's data, and a Data Protection Board for enforcement. All organisations collecting digital personal data of Indian residents must comply.
Our Compliance
Grass2Glory operates as a Data Fiduciary under DPDP Act. We have designated a Data Protection Officer and implemented all required safeguards.
Consent Management
Every athlete's data requires verifiable consent — parental/guardian consent for minors. Consent records maintained with timestamp and IP.
Data Security
TLS 1.3 in transit, AES-256 at rest, device-bound encrypted offline storage, role-based access control with full audit logging.
User Rights
All 6 DPDP rights implemented: access, correction, erasure, grievance, nomination, and consent withdrawal — all actionable within the platform.
Data Minimisation
We collect only the data necessary for the stated purpose. Athletes provide performance data; contact info is collected only for coaches and admins.
Cross-Border Restriction
All data stored on India-based cloud infrastructure. No cross-border data transfer without explicit consent and legal basis.
Grievance Officer
Designated Grievance Officer with 48-hour response commitment. Escalation path to the Data Protection Board of India available.
School Data Protection
Schools act as data intermediaries. They collect and maintain parental consent records before any athlete data is entered into the platform.
Athlete Privacy
Athlete full profiles are never visible to federation or authority users without explicit consent and specific trial-related legal basis.
Breach Protocol
Breach notification to Data Protection Board within 72 hours. Affected users notified within 7 days as required by DPDP rules.