LOKNEETI 12 - APPLICATIONS OPEN | Get 10% off with our Early Bird Offer till 25 October 2026. Register Now!

Data protection at ISPP

Data Protection

Q: What personal data does ISPP collect?

ISPP collects information you provide directly, such as your name, email address, phone number, address, and educational, professional or application information, and information collected automatically when you use the website, such as device and browser information, IP address where collected, and cookie identifiers. What is collected depends on how you interact with the School.

Q: How can I request access to my personal data?

Use the privacy request form on the ISPP Privacy and Data Protection page and select Access my personal data, or write to the privacy contact listed in the grievance section. ISPP may need to verify your identity before responding, and will respond in accordance with applicable law.

Q: Can I request deletion of my personal data?

You can request erasure, and ISPP will consider the request under applicable law. Erasure may not be possible where personal data must be retained to meet a legal or regulatory obligation, to complete a process you are part of, for institutional record-keeping, or to establish or defend a legal claim.

Q: What cookies does ISPP use?

The website uses strictly necessary cookies for functionality, security, session management and storing privacy preferences. Functional, analytics and marketing technologies operate only where consent has been given, where consent is required. The cookie inventory table on the Privacy and Data Protection page lists the cookies in use and is reviewed periodically.

How the Indian School of Public Policy collects, uses, protects and manages personal data under applicable data protection laws.

Last updated: 10 September 2026
Version: v2
Applies to: ispp.org.in

Manage your privacy Exercise your data rights

Your privacy matters

ISPP may collect personal information when visitors, applicants, students, programme participants, employees, faculty, vendors, partners or other individuals voluntarily interact with the School or use its digital services - for example by browsing this website, submitting an enquiry, applying to a programme, registering for an event or corresponding with our teams.

The Data Fiduciary is Foundation for Reinventing Governance (FRG), operating under the brand name Indian School of Public Policy. Where FRG/ISPP determines the purpose and means of processing personal data, it acts as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and you - the individual the data relates to - are the Data Principal. References to "ISPP" on this page mean FRG operating as ISPP.

Information may be processed for legitimate institutional purposes, which can include:

Admissions
Applications
Enquiries
Programme administration
Communications
Events
Research and institutional activities, where applicable
Website operation
Security
Analytics
Marketing, where consent or another lawful basis permits
Compliance with legal obligations

Not every category applies to every individual. The purposes that apply to you depend on how you interact with ISPP.

What is personal data?

Personal data is any information about an individual who can be identified from that information - either on its own or when combined with other information ISPP holds.

Information you provide

Given directly when you fill in a form, write to us, apply, register or otherwise interact with the School.

Name
Email address
Telephone or mobile number
Postal address
Professional information
Educational information
Application information
Enquiry details
Communication preferences
Any other information submitted through our forms
Information necessary to administer programmes, events and services

Information collected automatically

Generated by your device or browser as you use the website, where such collection takes place.

Website and device information
Browser type and operating system
IP address and technical information, where collected
Pages viewed and time of access
Referring website or link
Cookie identifiers and similar technologies

Some of this information is collected only if you consent to non-essential cookies. See Cookies & similar technologies.

What data we collect, and when

What ISPP collects depends on your relationship with the School. Open the section that describes you.

If you browse this website

You can visit ispp.org.in without telling us who you are. Our servers and, where enabled, our analytics and tag-management tools may record technical information such as IP address, browser and device details, date and time of access, and the pages you view. Strictly necessary cookies operate for security, session management and to remember your privacy preferences. Analytics, preference and marketing technologies operate only where you have given consent, in the manner set out in the cookie section below.

If you make an enquiry or subscribe to updates

We collect the contact details and enquiry information you submit, together with your communication preferences, so we can respond to you and - where you have opted in or another lawful basis applies - send you information about programmes, events and publications. You can withdraw consent to marketing communications at any time.

If you apply to a programme

Application processing may involve identity and contact information, educational and professional history, supporting documents you upload, interview or assessment records, and correspondence relating to your application. Some information may be required by the programme's admission process; where information is optional, this will be indicated at the point of collection.

If you are a student, participant or alumnus

Programme administration may involve enrolment and academic records, attendance, assessment and certification information, placement and career-support information where you use those services, campus and facilities records, and communications with the School. Alumni engagement is handled in line with the preferences you record with us.

If you register for an event or webinar

Event registration typically involves your name, contact details, organisation or affiliation, and any accessibility or dietary information you choose to share. Where an event is recorded or photographed, this will be indicated in the event notice.

If you are an employee, prospective employee, consultant or intern

Employment-related processing is set out in full in the Employee Personal Data Privacy Notice and Consent Form, which applies from the recruitment stage onward. This page summarises it; for employment data, the Employee Notice governs.

Categories processed can include:

Identity and contact information, including photograph, date of birth, gender, PAN, masked Aadhaar where used for identity verification, and addresses
Recruitment and onboarding records - CV, qualifications, employment history, reference and background verification reports, offer and appointment records
Financial and statutory information - bank account details, compensation, PF/UAN, ESI, professional tax and tax documents
Employment and performance records, including appraisals, training, disciplinary and exit records
Attendance and access data, including biometric attendance where deployed, access-control logs, leave records and CCTV footage at ISPP premises
Health and insurance information, including group medical enrolment, dependant details and claims data shared with insurers or third-party administrators
Emergency and family information, including nominee and dependant details
IT and communications data, including accounts and usage logs on ISPP-provided systems
Statutory and compliance records, including POSH Act records, handled under separate confidentiality protocols

Health information and biometric data may constitute sensitive personal data. Heightened safeguards apply, and such data is processed strictly for the purposes identified in the Employee Notice.

If you are a vendor, partner or professional adviser

Personal data may be processed for engagement, contracting, payment, compliance and record-keeping purposes - typically the contact details of the individuals we deal with, together with the documentation a contract or statutory filing requires.

Why we process personal data

ISPP processes personal data for defined institutional purposes. The purposes that apply to you depend on your relationship and interaction with the School.

Admissions & applications

Assessing, processing and communicating about applications to ISPP programmes.

Programme administration

Delivering, administering and certifying academic and executive programmes.

Enquiry management

Receiving, routing and responding to questions from prospective participants and the public.

Communications

Sending operational, academic and administrative messages relating to your interaction with ISPP.

Events & registrations

Managing invitations, registrations, attendance and follow-up for events and webinars.

Student & alumni engagement

Supporting career services, the alumni association, newsletters and community activity.

Institutional operations

Running the School's administrative, facilities, finance and governance functions.

Website functionality

Operating this website, remembering your preferences and keeping sessions working correctly.

Security & fraud prevention

Protecting our systems, premises, people and information from misuse.

Analytics & improvement

Understanding aggregate website usage to improve content and performance, where consent applies.

Marketing & outreach

Sharing information about programmes and events where consent or another lawful basis permits.

Legal & regulatory compliance

Meeting obligations under applicable law and responding to lawful requests.

On what legal basis

Processing does not all rest on the same thing. Under the DPDP Act, ISPP relies on the following:

Consent

Where you have given free, specific, informed, unconditional and unambiguous consent - for example non-essential cookies, marketing communications, optional benefit schemes, or use of personal contact details for non-statutory communications.

Compliance with law

Where processing is necessary to meet a legal obligation - for example tax deduction at source, Provident Fund and ESI contributions, and statutory reporting.

Employment-related legitimate uses

Processing necessary for purposes related to employment, including safeguarding the employer from loss or liability, recruitment, termination, provision of a service or benefit to an employee, and verification of attendance, in accordance with Section 7 of the DPDP Act.

Other legitimate uses under Section 7

Including compliance with a judgment or order, medical emergencies, and the other purposes expressly recognised under the Act.

Where processing rests on a basis other than consent, withdrawing consent does not stop that processing. See withdrawing consent.

We aim to collect only what we need

ISPP's intention is to request personal data that is reasonably necessary for a stated purpose, and to avoid asking for unrelated information. Where a field is optional, it should be marked as optional at the point of collection.

Purpose

A specific, stated institutional reason for processing - for example, assessing a programme application.

Data

Only the categories of personal data reasonably needed to serve that purpose.

Retention

Kept for as long as the purpose, or an applicable legal or record-keeping requirement, calls for.

We do not need every provider to receive every type of data

Different platforms do different jobs, so they see different information. Each row below reads: purpose, then the minimum information that purpose needs, then the system that handles it.

WhatsApp communicationMobile number and the relevant communication informationWATI

Telephone interactionTelephone and call informationExotel

LearningAccount, course and activity informationMoodle

Career developmentCV and career informationVMock

Email communicationEmail and account informationGoogle Workspace

CRM and enquiry managementRelevant contact and enquiry informationZoho

This is why a person who only ever sent an enquiry will not have a record in the learning platform, and a course participant will not necessarily have a record in the career platform.

Your rights as a Data Principal

Under the DPDP framework, a Data Principal is the individual to whom personal data relates. If ISPP processes personal data about you, you can use the mechanisms below, subject to applicable law.

Right 1

Access

Request a summary of the personal data being processed, the processing activities undertaken, and the identities of other Data Fiduciaries or Data Processors with whom your data has been shared, together with a description of the data shared.

Right 2

Correction or updating

Request correction of inaccurate or misleading personal data, completion of incomplete data, and updating of data.

Right 3

Erasure

Request erasure of personal data that is no longer necessary for the purpose it was processed for, unless retention is required by law.

Right 4

Withdrawal of consent

Where processing is based on your consent, withdraw it at any time with the same ease as it was given. Withdrawal does not affect the lawfulness of processing carried out before it.

Right 5

Grievance redressal

Raise a concern about how ISPP has processed your personal data, and receive a response through our grievance process.

Right 6

Nomination

Nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

Please note: ISPP will consider each request in line with applicable law. Not every request can be granted in full - for example, where personal data must be retained to meet a legal or regulatory obligation, to complete an ongoing process, or to establish or defend a legal claim. Where a request cannot be met in full, ISPP will explain the position, subject to applicable law. ISPP may need to verify your identity before acting on a request.

Consequences of withdrawing consent. Some data is collected and retained under a legal obligation or because it is necessary to perform a contract - for employees, this includes PAN, bank details, PF and ESI numbers and statutory tax records. Withdrawing consent in respect of such data may mean ISPP cannot continue to process payroll, provide certain benefits, or in some cases continue the relationship, to the extent that data is essential to it. ISPP will tell you of any specific consequence at the time a withdrawal request is made.

How we use technology and service providers

ISPP uses trusted technology providers and platforms to operate its website, forms, communications, applications, career services and learning environments.

ISPP determines why and how personal information is processed for its institutional purposes. Technology providers may process information on ISPP's behalf, according to the applicable contractual, security and privacy arrangements.

Every description below is subject to ISPP's actual configuration of the service concerned.

Using a technology provider does not necessarily mean that ISPP shares all of your personal information with that provider.

Information is processed through a particular service only where the relevant service is used and configured to handle that information.

Zoho

CRM, forms, workflow and operational systems

Primary function: Customer relationship management, web forms, enquiry and lead handling, workflow automation and related institutional systems.
Why ISPP may use it: To receive and route enquiries and applications, keep a record of correspondence, and run the administrative workflows behind admissions, programmes and events.

Zoho services may support functions such as… Potential uses - subject to ISPP's actual configuration

CRM and contact management
Web forms
Lead and enquiry management
Email and communications
Workflow automation
Customer and user support
Analytics
Document management
Other institutional workflows

This lists functions Zoho products can support. It is not a statement that ISPP uses all of them.

Categories of personal data that may be processed

Name
Email address
Mobile number
Enquiry and application information
Communication history
Documents submitted through forms
Programme and course interest
Account and activity metadata within the platform

These are categories the service can handle. What is actually processed depends on ISPP's configuration and on how you interact with the School.

What this means for your rights

Requests to access, correct or erase information held in Zoho are handled by ISPP through the request form on this page. You do not need to contact Zoho directly.

Security and privacy

Zoho publishes its own security, privacy and compliance documentation, including its stated certifications for its own services. Those describe Zoho's posture, not ISPP's compliance status. ISPP considers relevant security, privacy and contractual safeguards when configuring the platform.

Provider documentation

WATI

WhatsApp Business communications

Primary function: Sending and receiving WhatsApp messages with individuals who have chosen to communicate with ISPP on that channel.
Why ISPP may use it: To answer enquiries, send programme and event updates, and provide service messages where an individual has opted to use WhatsApp.

Whether WATI is used for marketing messages, transactional service messages, or both, depends on ISPP's configuration.

Categories of personal data that may be processed

Name
Mobile number
WhatsApp message content
Communication history and timestamps
Enquiry information shared in a conversation
Files or documents shared in a conversation
Message delivery and read status
Opt-in and opt-out status

These are categories the service can handle. What is actually processed depends on ISPP's configuration and on how you interact with the School.

What this means for your rights

You can stop receiving WhatsApp messages from ISPP at any time by replying to opt out, or by asking through the request form on this page. Withdrawing consent to WhatsApp messaging does not affect other ways ISPP may contact you where a different lawful basis applies.

Security and privacy

WATI is operated by Clare.AI Limited and publishes its own privacy policy covering how it handles personal data for its own purposes and on behalf of its business customers. ISPP considers relevant security, privacy and contractual safeguards when configuring the platform.

Provider documentation

WATI Privacy Policy

Exotel

Cloud telephony and voice communications

Primary function: Handling inbound and outbound calls and related telephony services between ISPP teams and individuals.
Why ISPP may use it: To run the enquiry and admissions helplines, return calls to people who ask to be contacted, and keep a record that a call took place.

Whether call recording is enabled, and the retention period applied to recordings and call detail records, depend on ISPP's Exotel configuration.

Categories of personal data that may be processed

Name, where linked to a contact record
Telephone or mobile number
Call metadata such as date, time, duration and outcome
Call recordings, where recording is enabled
Call routing and agent handling information
SMS delivery information, where SMS is used

These are categories the service can handle. What is actually processed depends on ISPP's configuration and on how you interact with the School.

What this means for your rights

If you would like to know whether a call you had with ISPP was recorded, or ask for a recording to be provided or erased, use the request form on this page. ISPP will locate the record and respond under applicable law.

Security and privacy

Exotel publishes security, compliance and data-privacy documentation for its platform, including its stated certifications, data-region options and default retention periods for call recordings and call detail records. Those are Exotel's stated platform positions; the settings that apply to ISPP depend on ISPP's account configuration.

Provider documentation

Google Workspace

Institutional email and collaboration

Primary function: Email, calendar, document creation and storage, and collaboration tools used by ISPP staff and faculty.
Why ISPP may use it: To correspond with you, schedule meetings and interviews, and prepare and store the documents that institutional work produces.

The Google Workspace edition and configuration in use at ISPP determine which data-processing terms and controls apply.

Categories of personal data that may be processed

Name
Email address
Email content and attachments
Calendar entries and meeting invitations
Documents and files created or stored by ISPP
Form responses, where Google Forms is used
Account and access information for ISPP-issued accounts

These are categories the service can handle. What is actually processed depends on ISPP's configuration and on how you interact with the School.

What this means for your rights

Correspondence you have had with ISPP by email falls within the scope of an access request. Requests are made through the form on this page, not to Google.

Security and privacy

Google publishes a Cloud Data Processing Addendum and a Cloud Privacy Notice covering Workspace, together with administrator guidance on privacy compliance and records. Those describe Google's commitments as a provider; the edition and configuration ISPP uses determine what applies in practice.

Provider documentation

VMock

AI-enabled career development, résumé and employability platform

Primary function: Supporting career development, résumé or CV review, employability and related student and candidate services.
Why ISPP may use it: To give students and candidates structured feedback on their résumés and career materials as part of ISPP's career-support services.

Depending on the services enabled by ISPP, VMock may process information submitted by users for résumé, career-development, employability or related educational purposes.

AI-assisted processing

Where AI-assisted tools are used within VMock, information submitted by a user may be analysed to provide the relevant career-development, résumé or employability service. The specific AI processing applicable to ISPP users depends on the VMock services and configuration enabled by ISPP.

Use of an AI-enabled career-development feature does not by itself mean that ISPP makes solely automated decisions producing legal or similarly significant effects about an individual.

Information you choose to submit

Résumé documents can carry a great deal of personal information, some of it unrelated to the feedback you are asking for. Users should provide only information reasonably necessary for the relevant career-development or résumé service and should avoid including unrelated sensitive or confidential information.

Retention

Personal data processed through VMock is retained according to the applicable ISPP retention requirements, the purpose for which the information was collected, the services enabled by ISPP and applicable contractual or legal requirements. The general institutional retention period is not applied automatically to résumé or career-development data.

The applicable period is published in the retention schedule.

Provider responsibility

Where VMock processes personal data on behalf of ISPP, ISPP will manage that processing through appropriate contractual, organisational and technical measures in accordance with applicable law. The role VMock plays for each processing activity depends on the applicable contractual and privacy documentation.

Categories of personal data that may be processed

Name
Email address
Student or applicant identifier
Educational information
Programme or course information
Résumé or CV content
Employment or professional information
Skills
Career preferences
Career-development information
User activity within the platform
Platform and account metadata
Assessment or feedback information

These are categories the service can handle. What is actually processed depends on ISPP's configuration and on how you interact with the School.

What this means for your rights

Requests relating to information you submitted to VMock are directed to ISPP, not to VMock, and are handled through the request form on this page - unless ISPP's actual process specifies otherwise.

Security and privacy

ISPP considers relevant security, privacy and contractual safeguards when using third-party technology platforms. No certifications, encryption standards, data-centre locations or specific security controls are stated here, because they have not been verified from VMock's current official documentation.

Provider documentation

VMock's privacy and security documentation is published by VMock. Links will be added here once verified against VMock's current official pages.

Moodle

Learning management and online education platform

Primary function: Delivering and administering online learning, course materials, assessments and learner records.
Why ISPP may use it: To run courses, give participants access to materials and assignments, record completion and results, and provide academic support.

Moodle provides privacy and data-management functionality that can assist an organisation in managing learner information. ISPP remains responsible for configuring the platform appropriately and meeting its own applicable legal and institutional obligations.

The information actually processed depends on the Moodle features and courses enabled by ISPP.

Learning and course activity

Moodle may record the information needed to provide and administer online learning. This can include course access, assignment submissions, quiz and assessment participation, completion status, grades, course activity, forum participation and which learning resources were accessed.

Such information may be processed to deliver courses, administer assessments, monitor completion, provide academic support and maintain appropriate educational records.

Data access and deletion

Moodle provides functionality that can support data access, export and deletion requests. ISPP will determine how such requests are handled within its overall Data Principal rights process.

Policies and consent

Moodle can display applicable site, privacy and third-party policies to users and can maintain records of policy acceptance. ISPP will configure these mechanisms according to its privacy and governance requirements.

Retention

Moodle data is retained according to the purpose for which it is collected, ISPP's applicable retention schedule, course or programme requirements and applicable legal or record-keeping requirements. The general institutional retention period is not assigned automatically to every Moodle record.

Course data, account data and assessment records each follow their own period, published in the retention schedule.

Hosting

A Moodle site can be self-hosted, run on MoodleCloud, hosted by a Moodle Partner, or hosted by another third party. These arrangements differ materially in where data is held and who operates the infrastructure.

The hosting location and infrastructure applicable to ISPP's Moodle environment depend on the Moodle deployment and hosting arrangement selected by ISPP.

Categories of personal data that may be processed

Name
Email address
User or account identifier
Programme and course information
Enrolment information
Course participation
Assignments
Assessment information
Grades and results
Learning activity
Login information
Device and IP information
User-generated content
Course communications
Attendance information, where enabled
Certificates or completion information
Support requests

These are categories the service can handle. What is actually processed depends on ISPP's configuration and on how you interact with the School.

What this means for your rights

Moodle includes functionality that can support data access, export and deletion requests. You do not need to use it. The request form on this page remains the single entry point, and ISPP will determine how a request is handled across its systems.

Security and privacy

Moodle's own documentation is clear that software tools alone cannot make a site compliant with privacy legislation, and that the institution operating the site is responsible for configuring it and for responding to data requests. ISPP considers relevant security, privacy and contractual safeguards for its deployment.

Provider documentation

Privacy laws and Moodle (Moodle documentation)

How information moves

Data Principal

You provide information, or it is generated as you use a service.

ISPP website, forms, applications, communications and learning platforms

The points at which information is collected.

ISPP

Decides the purposes, what is collected and how it is handled. ISPP is the Data Fiduciary.

Operational technology

Providers that carry out processing on ISPP's instructions. They support ISPP's operations; they do not become independent decision-makers over ISPP's purposes.

ZohoCRM / forms / workflows

WATIWhatsApp communications

ExotelTelephony

Google WorkspaceEmail / collaboration

VMockCareer / résumé / employability services

MoodleLearning / course management

Authorised ISPP personnel and institutional processes

Staff who need the information for a stated purpose, working within ISPP's access controls and governance.

Which data may reach which system

This matrix shows what each platform may handle. It is a map of possibilities, not a statement that every field reaches every system.

Categories of personal data against the technology providers ISPP may use.
Data type	Zoho	WATI	Exotel	Google Workspace	VMock	Moodle
Name	Possible	Possible	Possible	Possible	Possible	Possible
Email	Possible	Possible	Possible	Possible	Possible	Possible
Mobile number	Possible	Possible	Possible	Possible	Possible	Possible
Enquiry information	Possible	Possible	Possible	Possible	Possible	Possible
Communication history	Possible	Possible	Possible	Possible	Possible	Possible
CV / résumé	Possible	Possible	Not primary	Possible	Likely where used	Possible
Career information	Possible	Possible	Not primary	Possible	Possible	Possible
Course information	Possible	Possible	Not primary	Possible	Possible	Possible
Assignment / submission data	Depends on configuration	Depends on configuration	No	Possible	Depends on configuration	Possible
Grades / assessment data	Depends on configuration	Depends on configuration	No	Possible	Depends on configuration	Possible
Call metadata	Possible	Not primary	Possible	Depends on configuration	No	Depends on configuration
Call recordings	Depends on configuration	No	Depends on configuration	No	No	No
Documents / files	Possible	Possible	Depends on configuration	Possible	Possible	Possible
Learning activity	Depends on configuration	No	No	Possible	Possible	Possible

Who is responsible for what

Protecting personal data is shared between the School, the technology providers it engages, and you.

ISPP

Determines the purposes of processing, what information is collected, and how it is handled for institutional purposes.

Technology & service providers

Provide infrastructure, applications and processing capabilities in accordance with the applicable arrangements with ISPP.

Data Principal

Provides information, keeps it accurate where they can, and exercises the applicable rights and preferences.

Use of a third-party technology provider does not by itself determine ISPP's compliance status. ISPP remains responsible for configuring its processes, notices, consent mechanisms, access controls, retention practices and governance appropriately.

How we protect personal data

ISPP applies organisational and technical safeguards proportionate to the information it handles. These are described here at a high level.

Access controls

Limiting access to personal data to those who need it for a stated purpose.

Authentication

Requiring users of ISPP systems to authenticate before accessing information.

Role-based access

Aligning permissions in institutional systems with a person's role and responsibilities.

Secure transmission

Using secure channels for the transmission of information where appropriate.

Monitoring

Monitoring systems for unusual activity and operational issues.

Data governance

Maintaining internal ownership and oversight of how personal data is handled.

Vendor management

Assessing and contracting with technology providers before entrusting them with information.

Security procedures

Documented procedures covering the handling of information and access to systems.

Incident response

A documented process for identifying, reporting and responding to personal data breaches, including notification to the Data Protection Board of India and to affected Data Principals where required under the DPDP Act.

Periodic access review

Reviewing access permissions on institutional IT systems so that access stays matched to current roles.

Secure physical records

Restricted physical access to paper records such as identity documents and signed contracts.

Confidentiality obligations

Confidentiality obligations imposed on staff and on third-party vendors who handle personal data.

Staff awareness

Awareness and training for staff who handle personal data, where applicable.

No method of transmission or storage can be guaranteed to be completely secure. ISPP works to protect information under its control, but cannot warrant the security of information transmitted over the internet.

How long do we keep your data?

ISPP keeps personal data only for as long as the purpose it was collected for requires, or for as long as an applicable legal or record-keeping requirement calls for. Twenty-five years is the outer institutional ceiling for the longest-lived academic records; most categories are kept for far less, as the schedule below sets out.

The schedule below sets the periods that apply to each category. Within those periods, how long a particular record is kept depends on:

The purpose for which the data was collected
The nature of your relationship with ISPP
Legal and regulatory requirements
Institutional record-keeping requirements
Security and fraud-prevention needs
The resolution of disputes or grievances

When the purpose has been served, or on separation of employment, whichever is later and subject to statutory retention requirements, ISPP will either erase the personal data or restrict access to it - except where retention is legally mandated or necessary to establish, exercise or defend a legal claim.

Retention schedule

Retention periods applicable to categories of personal data held by ISPP.
Category	Retained for	Basis

International and third-party processing

Some technology providers, including cloud storage and software service providers, may store or process personal data on servers located outside India, depending on the services and configuration used.

In accordance with Section 16 of the DPDP Act, ISPP may transfer personal data outside India, except to countries or territories restricted by the Central Government by notification.

Where personal data is processed outside India, ISPP will manage such processing in accordance with applicable law and its contractual and organisational safeguards, and will require the receiving party to be contractually bound to a standard of data protection consistent with this notice and the DPDP Act.

Where you would like to know the arrangements applying to a particular service, you can ask using the privacy request form.

Cookies and similar technologies

Cookies are small files placed on your device by a website. Similar technologies include pixels, tags, local storage and software development kits. They can keep a session working, remember a preference, or help measure how a website is used.

Categories used on this website

Your choices

You have three options, and they are equally easy to take. Whichever you choose, strictly necessary cookies stay active and your choice is remembered on this device until you change it.

Cookie inventory

Cookies and similar technologies used on ispp.org.in, by category.
Category	Purpose	Provider	Duration	Consent

Cookie inventory should be reviewed periodically, because cookies may change when website plugins, embedded services, analytics platforms or marketing tools are added or removed.

Children's data

ISPP's programmes and services are generally intended for adults. Some activities, events or outreach may nevertheless involve individuals of different ages.

Where processing involves a child, ISPP will handle that processing in accordance with the requirements applicable under the DPDP Act and other applicable law, including any requirements relating to verifiable parental or guardian consent and to restrictions on certain kinds of processing.

If you believe a child's personal data has been provided to ISPP in circumstances where it should not have been, please contact us using the details in the grievance section so we can review it.

Privacy questions or grievances?

If you have a question about this notice, or a concern about how ISPP has handled your personal data, you can contact us directly. We would rather hear from you early than late.

Data Protection Officer: Shashikant Rai, Data Protection Officer
The Data Protection Officer also acts as Grievance Officer for matters relating to personal data processing.
Data Protection Officer email: DPO@ispp.org.in
General privacy enquiries: privacy@ispp.org.in
Postal address: Foundation for Reinventing Governance (operating as Indian School of Public Policy)
K-11, Hauz Khas Enclave, New Delhi - 110016

What happens next

We acknowledge your request or grievance when we receive it.
We may ask you for information needed to verify your identity or to locate the relevant records.
We review the request and respond, in accordance with applicable law and within the timelines prescribed under the DPDP Rules.
If we cannot meet a request in full, we explain the position, subject to applicable law.

If you are not satisfied with the outcome, you may have the right to approach the Data Protection Board of India in accordance with the DPDP Act and the rules made under it.

Submit a privacy request General contact page

Frequently asked questions

What personal data does ISPP collect?

ISPP collects information you provide directly - such as your name, email address, phone number, address, and educational, professional or application information - and information collected automatically when you use the website, such as device and browser information, IP address where collected, and cookie identifiers. What is collected depends on how you interact with the School.

Why does ISPP collect my personal data?

For defined institutional purposes: admissions and applications, programme administration, enquiry management, communications, events, alumni engagement, institutional operations, website functionality, security, analytics, marketing where permitted, and legal and regulatory compliance. Not all purposes apply to every individual.

What is a Data Principal?

Under India's Digital Personal Data Protection Act, 2023, a Data Principal is the individual to whom personal data relates. The organisation that determines the purpose and means of processing that data is the Data Fiduciary. Where ISPP decides why and how your personal data is processed, ISPP is the Data Fiduciary and you are the Data Principal.

How can I request access to my personal data?

Use the privacy request form on this page and select "Access my personal data", or write to the privacy contact listed in the grievance section. ISPP may need to verify your identity before responding, and will respond in accordance with applicable law.

Can I request correction of my personal data?

Yes. You can ask ISPP to correct, complete or update personal data that is inaccurate or incomplete, using the privacy request form. Where correcting a record would affect an official or academic record, ISPP will explain what can and cannot be changed.

Can I request deletion of my personal data?

You can request erasure. ISPP will consider the request under applicable law. Erasure may not be possible where personal data must be retained to meet a legal or regulatory obligation, to complete a process you are part of, for institutional record-keeping, or to establish or defend a legal claim. Where a request cannot be met in full, ISPP will explain the position, subject to applicable law.

Can I withdraw consent?

Yes, where processing is based on your consent. Use the cookie preference controls on this page for non-essential cookies, the unsubscribe link in our emails for marketing messages, or the privacy request form for anything else. Withdrawal does not affect processing that already took place, or processing that rests on a different lawful basis.

Does ISPP use Zoho to process personal data?

ISPP expects to use Zoho applications and services to capture, manage and process personal information for its institutional purposes. The data actually handled through Zoho depends on the specific Zoho products and features ISPP has configured. ISPP determines why and how information is processed; Zoho processes information on ISPP's behalf under the applicable arrangements.

Does ISPP share personal data with third-party service providers?

Personal data may be shared with technology and service providers, professional advisers, institutional partners, payment and related providers, government or regulatory authorities where legally required, persons you have authorised, and other recipients where permitted or required by applicable law. ISPP does not sell personal data as a commercial product.

What cookies does ISPP use?

This website uses strictly necessary cookies for functionality, security, session management and storing your privacy preferences. Functional, analytics and marketing technologies operate only where you have consented, where consent is required. The cookie inventory table on this page lists the cookies in use and is reviewed periodically.

Can I reject analytics and marketing cookies?

Yes. Rejecting non-essential cookies is as easy as accepting them: choose "Reject non-essential" in the cookie banner or the preference centre, or turn individual categories off in the privacy choices section. Strictly necessary cookies remain active because the site cannot function without them. You can change your choices at any time from the Cookie settings button in the footer.

How can I raise a privacy grievance?

Use the privacy request form and select "Raise a privacy grievance", or contact the Data Protection Officer listed in the grievance section. ISPP will acknowledge the grievance, may ask for information to verify your identity, and will respond in accordance with applicable law. If you are not satisfied with the outcome, you may have the right to approach the Data Protection Board of India.

Does ISPP use Moodle to process student or learner information?

ISPP may use Moodle as its learning management platform to deliver and administer online learning. What is processed depends on the Moodle features and courses ISPP has enabled. Moodle provides privacy and data-management functionality that can assist in managing learner information, but ISPP remains responsible for configuring the platform appropriately and meeting its own applicable legal and institutional obligations.

What information may be stored in Moodle?

Depending on ISPP's configuration, this can include name, email address, user or account identifier, programme and course information, enrolment, course participation, assignments, assessment information, grades, learning activity, login and device information, user-generated content, course communications, attendance where enabled, completion or certificate information, and support requests. The information actually processed depends on the Moodle features and courses enabled by ISPP.

Can I request access to my Moodle data?

Yes. Use the privacy request form on this page and, if you wish, indicate that you believe the data is held in Moodle. You do not need to know which system holds your information, and you do not need to use Moodle's own privacy tools. ISPP will determine how the request is handled across its systems and will respond in accordance with applicable law.

Does ISPP use VMock to process résumé or career information?

ISPP may use VMock to support career development, résumé or CV review, employability and related student and candidate services. Depending on the services enabled by ISPP, VMock may process information submitted by users for résumé, career-development, employability or related educational purposes.

What information may VMock process?

Depending on ISPP's configuration, this can include name, email address, a student or applicant identifier, educational and programme information, résumé or CV content, employment or professional information, skills, career preferences, career-development information, activity within the platform, account metadata, and assessment or feedback information. Users should provide only information reasonably necessary for the relevant service and avoid including unrelated sensitive or confidential information in a résumé.

Can I request deletion or correction of information submitted to VMock?

Yes. Direct the request to ISPP using the form on this page rather than to VMock, unless ISPP's process specifies otherwise. ISPP will identify the relevant records and respond under applicable law. Retention of career-development data follows the applicable ISPP retention requirements and the purpose the information was collected for, rather than the general institutional retention period.

Who is responsible for my personal data when ISPP uses third-party platforms?

ISPP is. Where ISPP determines why and how your personal data is processed, ISPP is the Data Fiduciary, and technology providers process information on ISPP's behalf under the applicable arrangements. Using a provider does not shift that responsibility, and it does not by itself mean ISPP shares all of your information with that provider - information reaches a service only where that service is used and configured to handle it.

I work at ISPP. Does this page cover my employment data?

Partly. This page describes ISPP's overall approach, but employment data is governed by the Employee Personal Data Privacy Notice and Consent Form, which applies from the recruitment stage onward and covers categories such as payroll, statutory records, attendance, health and insurance information. Where the two documents differ on employment data, the Employee Notice applies. Data Principal rights and the request route are the same either way.

Who is the Data Fiduciary - ISPP or FRG?

Foundation for Reinventing Governance, operating under the brand name Indian School of Public Policy. FRG is the legal entity that determines the purposes and means of processing, and so is the Data Fiduciary under the DPDP Act. References to ISPP mean FRG operating as ISPP.

Related policies and resources

This page sits alongside ISPP's other published policies. Where an earlier document and this page describe the same practice, they should be read together.

We use cookies

Your privacy choices

Strictly necessary

Functional / preference

Analytics

Marketing