Data Protection & DPDP Policy

Last updated: September 2026

As a background verification company handling sensitive personal data on behalf of employers across India and the US, Krib Information Services Pvt. Ltd. maintains strict data protection standards, including compliance with India’s Digital Personal Data Protection Act (DPDP Act) and other applicable global regulations.

Data Protection & Security

• Encryption – All sensitive data is encrypted both in transit (SSL/TLS) and at rest.
• Access Control – Access is granted only on a need-to-know basis with multi-factor authentication.
• Data Retention – Candidate data is retained only for the legally required period—typically 5 years or as per local law—after which it is securely deleted using certified data erasure techniques.
• Cloud Storage – Data is hosted in certified secure data centers located in India, the EU, and the USA, depending on client requirements.

Consent & Authorization

• Candidate Consent – No background check is initiated without written or electronic consent.
• Digital Authorization – Candidates may provide consent electronically via secure e-signature platforms.
• Withdrawal – Candidates can withdraw consent at any time, though this may impact the employment process.

Compliance with the DPDP Act & Other Laws

• Global Compliance – Krib follows the DPDP Act (India), FCRA (USA), GDPR (EU), and other applicable data protection laws.
• Fair Practices – Background verification is conducted lawfully, transparently, and with candidate consent as a “Data Fiduciary” under the DPDP Act.
• Non-Discrimination – No unfair or unlawful decisions will be made based on race, religion, gender, or disability.

Your Rights & Dispute Resolution

• Right to Access & Correction – Candidates (Data Principals) may request access to, correction of, or erasure of their personal data.
• Right to Challenge – Candidates may dispute incorrect or incomplete verification reports; disputes are reviewed and resolved within 30 days, and any verified inaccuracies are corrected with employers re-notified.
• Grievance Redressal – Concerns about data handling can be raised through our Contact Us page and will be addressed by our Compliance Team.

This policy works alongside our Privacy Policy and Terms and Conditions.