Skip to main content
Bharat Surveyभारत सर्वे
फील्ड में हाथ में पकड़े फोन पर खुला सर्वे ऐप
Data security · DPDP Act 2023

Consent first, least access, a log of who touched what

If you collect names, phone numbers, locations or opinions from people in India, the Digital Personal Data Protection Act makes you answerable for that data. Bharat Survey is built to be a DPDP Act compliant survey tool for the organisations that use it: consent is recorded before the first question, field data is encrypted on the phone until it syncs, access is limited by role, and every edit leaves a trail. This page explains what the software does, what stays your responsibility, and what to ask us before you sign.

Ask for our security note See all features
  • Consent screen recorded with each interview
  • Encrypted autosave on the device until sync
  • Role-based access down to team level
  • Audit log of reviews, corrections and exports
Home #17 · Intro & consent

Hello, I am Ram Kumar. This survey is run by Sample Organisation. Purpose: to learn about amenities in your area. It is voluntary, and you can say no at any time.

Consent v2 · 09:44
Agreed — start surveyDeclined
Consent on recordEncrypted on deviceTLS in transitRole-based accessAudit trailExport controlsDeletion on requestData fiduciary support

Where we stand

The law in brief

The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to paper data once it is digitised. The organisation that decides why and how data is collected is the data fiduciary. In a survey that is usually you, the client. Bharat Survey acts as a data processor on your instructions.

Timeline that matters for 2026–27

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025. Some rules took effect at once, consent manager provisions follow after twelve months, and the core duties on notice, consent, data principal rights and security safeguards apply eighteen months after notification, in May 2027. Surveys you design today will still be running, or still stored, when those duties bite.

Duties that change how a questionnaire is built

A clear notice in a language the respondent understands, consent that is free and specific, collection limited to the purpose, reasonable security safeguards, breach reporting, and erasure once the purpose is served. Each of these has a setting or a workflow in the app; none of them can be bolted on after fieldwork.

Roles in a typical survey

  • Client: data fiduciary
  • Bharat Survey: data processor
  • Field volunteer: acts for the client
  • Respondent: data principal
Layers

Security in a field survey is a chain from the respondent's doorstep to your export file. These are the links we control.

01 · Doorstep

Consent before the first question

The consent screen is part of the form, not a separate sheet of paper. The notice text, the language shown and the respondent's answer are saved with the record, so a refusal ends the interview and is counted as a refusal.

  • Hindi-first notice text
  • Refusal recorded as an outcome
  • Photo capture only with consent
Home #17 · Intro & consent

Hello, I am Ram Kumar. This survey is run by Sample Organisation. Purpose: to learn about amenities in your area. It is voluntary, and you can say no at any time.

Consent v2 · 09:44
Agreed — start surveyDeclined
02 · Phone

Encrypted autosave while offline

Volunteers often work for hours without network. Answers are autosaved in encrypted form on the device and removed from the phone after a confirmed sync, so a lost handset does not become a readable spreadsheet.

  • OTP login bound to one device
  • Work permit expires offline
  • Local copy cleared after sync
Sync
6
Safe on phone
8
Synced to server
Last sync12:40
Offline permit18 h left
Photos pending3
Sync now
03 · Transit

Encrypted connection to the server

Sync and web panel traffic run over HTTPS with TLS certificates. Uploads are idempotent, so a patchy network retrying the same record does not create duplicates.

  • HTTPS only
  • Duplicate-safe sync
Offline
No network
6
Safe on phone
8
Synced to server
Syncs when network returns
04 · Panel

Least access by role

Owners, managers, supervisors and volunteers see different things. A volunteer sees only today's assigned work; a supervisor sees their own team; exports are limited to roles you choose.

  • Tenant isolation in the database
  • Team-scoped supervisor views
  • Export permission per role
Constituency 172 · Survey round 2Updated 12s ago · sample
3,000
Target homes
2,184
Visits
1,962
Completed
1,871
Accepted
Daily accepted surveysLast 12 days
05 · Record

Audit trail on every change

Reviews, corrections, back-check results and exports are logged with user and time. When a respondent asks what happened to their answers, you can show it.

  • Correction history kept
  • Export events logged
Location evidence
Survey #BS-0412
  • In areaInside approx. boundary
  • Accuracy±12 m
  • Time09:42 · fresh fix
  • Mock GPSNot detected
  • Interview length11 min
Added to accepted count
Plain answers

Responsibilities for personal data in a Bharat Survey project
TopicBharat Survey providesYou decide or confirm
Consent noticeConsent screen, language options, stored responseNotice wording and purpose
What is collectedOptional fields, skip logic, photo toggleMinimum data needed for the study
Hosting locationWritten statement of server and backup locations in the proposalWhether it meets your policy on survey data stored in India
AccessRoles, team scopes, export permissionWho in your organisation gets which role
RetentionDeletion of project data on instructionHow long the purpose lasts
BreachNotice to you without delay with known factsReporting to the Data Protection Board and respondents
CertificationNo ISO 27001 or SOC 2 claim todayWhether your procurement requires one

There is no official 'DPDP certification'. Treat any vendor that sells one with care.

Election and political work

Opinion data about voters is sensitive in practice even when the law does not label it separately. The political workspace is built with fewer features on purpose.

No voter-roll import

Version 1 does not import electoral rolls or voter lists, and does not build profiles of named voters. Booth analysis works on aggregates and on answers people chose to give.

Location of the visit, not the person

GPS is captured in the foreground when the volunteer submits, to verify the visit happened in the assigned area. There is no background tracking of respondents.

Separate tenants, separate data

Each client is its own tenant. Two campaigns using the platform in the same constituency never see each other's forms, answers or dashboards.

Live view only during shifts

Leaders see volunteer locations only while a volunteer has started a shift, and the sharing stops when the shift ends.
Before you sign

Use these with us or anyone else. A vendor who cannot answer them in writing is not ready for personal data.

Data and hosting

  • Where are production servers and backups located?
  • Is data encrypted on the device before sync?
  • Can we get a full export and then deletion?
  • Which sub-processors touch our data?

People and process

  • Who at the vendor can see our responses?
  • Are admin actions and exports logged?
  • What is the breach notice time to us?
  • How are devices de-registered when a volunteer leaves?

Your own house

  • Is the consent notice in the respondent's language?
  • Do we collect phone numbers we will never use?
  • Who owns the retention decision?
  • Is there a named grievance contact?

Not the right fit if

  • You need a vendor with ISO 27001 or SOC 2 certification today
  • Your policy requires on-premise hosting inside your own network
  • You want to import electoral rolls or Aadhaar numbers
  • You need an iOS app for the field team

A good fit if

  • You want consent and visit evidence captured with every record
  • Field teams work offline on Android phones
  • You need role-based access and an audit trail
  • You want a written processor note for your DPDP file

All features

Form builder, GPS verification, back-checks and exports in one place.

Learn more

Survey app development

When you need a custom workflow on top of the core app.

Learn more

WhatsApp and SMS surveys

Consent and opt-out rules for message-based surveys.

Learn more

Customer feedback software

Collecting customer contact data with less exposure.

Learn more

Field inspection app

Photo evidence and location checks for inspections.

Learn more
FAQ

Straight answers to the questions people ask most about this topic.

Is election survey data secure?

It is as secure as the weakest step. In Bharat Survey answers are encrypted on the phone until sync, travel over HTTPS, sit in a tenant separated from other campaigns, and are visible only to roles you assign. We do not import voter rolls. Risks that remain are human: shared logins, careless exports and screenshots, which is why exports are permission-based and logged.

Is Bharat Survey DPDP certified?

No, and nobody can be, because the DPDP Act does not create a certification. What we provide is a consent workflow, security safeguards, deletion on instruction and a written note on our role as data processor. Compliance also depends on your notice wording, purpose and retention choices as the data fiduciary.

Is survey data stored in India?

Ask for the hosting and backup locations in writing for your project; we state them in the proposal rather than on a marketing page, because infrastructure can change. If your department or funder requires survey data stored in India only, tell us at the brief stage so we can confirm whether we can meet that requirement.

Can a respondent ask for their answers to be deleted?

Yes. Under the DPDP Act the request goes to you as data fiduciary. You can locate the record by its ID, and on your instruction we delete it from the live database; backups roll off on their normal cycle. Aggregated results already reported are not re-published, but the underlying personal record is removed.

What happens if a volunteer's phone is lost?

Unsynced answers stay encrypted on the device and the offline work permit expires. An admin can revoke the device from the panel, which blocks it from syncing or downloading new work. Synced data is already off the phone. Report the loss the same day so the supervisor can reassign the area.

Sources: Digital Personal Data Protection Act, 2023 (MeitY) · DPDP Rules, 2025 notified — PIB

शाम के समय कस्बे का हवाई दृश्य
India Nationwide, Hindi-first

Tell us who the data fiduciary is and what the study collects. We will send a short written note on hosting, access, retention and our processor role.

Request the note See pricing