A personal safety platform processes the most sensitive personal data imaginable: real-time location, emergency events, audio evidence, trusted contacts. India's Digital Personal Data Protection Act, 2023 sets the legal floor for handling such data — but for a product like Guardian, treating the DPDP Act as a checkbox would miss the point. Privacy is a safety feature.
Consent that is explicit and understandable
Guardian opens with a consent gate that explains, in plain language, what data is collected, why, and what happens during an emergency versus normal use. Consent is specific to purpose — agreeing to emergency location streaming is not agreeing to anything else — and it can be reviewed and withdrawn.
Purpose limitation in an emergency product
The DPDP Act's purpose-limitation principle maps naturally onto how Guardian is built: precise location is used at full fidelity during an active SOS, because that is what the user asked us to do with it. Outside an emergency, the platform minimises what it touches. Responder identity, victim location and evidence each have distinct access rules enforced server-side — not by client-side politeness.
Data minimisation and erasure
We collect what the emergency workflow needs and no more. Server-authoritative Cloud Functions gate every privileged read and write, and erasure workflows exist so that data does not outlive its purpose. The same discipline extends to our internal tools.
Why this matters commercially, not just legally
Institutions — colleges, corporates, government programmes — cannot adopt safety platforms that create privacy liabilities. Building DPDP-aligned from the first line of code is what makes Guardian deployable where it is needed most.