Minimise by default
The workflow is being designed around opaque or pseudonymous subject references, so Evidely does not need a person's name, email address, or phone number merely to coordinate an action.
Security, privacy, and legal guardrails
Collect less. Record precisely. Keep judgement human.
Evidely is being designed to coordinate configured actions and preserve their evidence without becoming another unnecessary store of direct identity data.
Discuss your requirementsDesign principle / 01Pseudonymous subject references
Move the workflow using the customer’s opaque identifier—not a copied name, email, or phone number.
Keep tenants separate
Tenant isolation is a foundational design requirement across case data, connector credentials, logs, and exported evidence—not a later interface setting.
Make evidence checkable
The target evidence architecture carries ordered events, hashes, acknowledgements, verification receipts, and a planned signature that can be checked independently.
Preserve human judgement
Software can coordinate configured work and record outcomes. It does not decide legal basis or replace the customer's privacy, security, or legal judgement.
Regulatory context
Useful dates, without manufactured urgency.
These statements describe the published position as of 18 July 2026 and are not legal advice.
The DPDP Act says withdrawing consent must be as easy as giving it, and processing should stop within a reasonable time unless another legal basis authorises or requires it.
DPDP Act, 2023 — Section 6The 13 November 2025 commencement notification brings most substantive provisions in Sections 3–17 into force 18 months after publication: 13 May 2027.
Official commencement notificationThe notified Consent Manager rule and First Schedule provisions commence one year after publication: 13 November 2026.
Digital Personal Data Protection Rules, 2025Hosting direction
India-region by default, for practical reasons.
The product is planned to use India-region hosting for latency, procurement comfort, data-sovereignty expectations, and compatibility with customers subject to stricter sectoral requirements—not because the DPDP Act universally requires India-only storage. Section 16 allows government-notified restrictions on specific transfers.
Trust requirements
Become a design partnerBring the hard security questions early.
Design partners can help shape isolation, credential handling, retention, evidence verification, incident readiness, and procurement requirements before production hardening.