DPDPA

Bot protection under India's DPDPA

India's Digital Personal Data Protection Act holds Data Fiduciaries accountable for their processors. CaptchaFox keeps that accountability easy: minimal data, contractual guarantees and security built in.

Processing under contract
Security safeguards built in
No tracking or profiling

Data Processor under contract

CaptchaFox processes personal data only on your behalf and under a valid contract – the arrangement the DPDPA requires between Data Fiduciary and Data Processor.

Reasonable safeguards

Identifying data is anonymized as early as possible and never stored permanently in plain text, supporting the security obligations the Act places on you.

Minimal data footprint

The IP address, plus other technical and usage signals needed for bot detection – nothing beyond that is collected, and identifying data is anonymized without delay.

DPDPA compliance checklist

How CaptchaFox supports your obligations under the Digital Personal Data Protection Act, 2023.

Processing only under a valid contract
Sec. 8(2) DPDPA
The DPDPA lets Data Fiduciaries engage processors only under a valid contract. CaptchaFox provides exactly that, restricting all processing to your instructions.
Reasonable security safeguards
Sec. 8(5) DPDPA
Early anonymization, no plain-text storage of identifying data and EU data-center security support the safeguards the Act requires to prevent breaches.
Only the necessary signals
Sec. 6(1) DPDPA
The widget processes the minimum needed to distinguish humans from bots – no behavioral history, no advertising identifiers.
Transfers to the EU unrestricted
Sec. 16 DPDPA
The DPDPA restricts transfers only to countries the government blacklists. Processing in EU data centers is not restricted.
No tracking or profiling
Sec. 8 DPDPA
CaptchaFox builds no user profiles and attaches no advertising identifiers – visitor data is used solely for bot detection.

Frequently asked questions

Everything you need to know. Can't find your answer? Contact our support team.

Is CaptchaFox compliant with India's DPDPA?

Yes. CaptchaFox operates as a Data Processor under a valid contract, processes only minimal visitor data on your instructions, applies reasonable security safeguards and never tracks or profiles users.

Can Indian websites use an EU-hosted CAPTCHA?

Yes. The DPDPA only restricts transfers to countries specifically restricted by the central government (Sec. 16). Transfers to EU data centers are not restricted.

Does CaptchaFox require consent from Indian visitors?

The widget stores nothing on the visitor's device and processes only the technical signals needed to block bots. As the Data Fiduciary you decide the basis for processing; the minimal, security-only footprint keeps that assessment simple.

Is a processing agreement available?

Yes, on every plan. The agreement restricts processing to your instructions and documents our subprocessors and technical and organizational measures. Contact hello@captchafox.com to receive it.