Data Protection Policy

This Data Protection Policy sets out how GSSK & Company (“the Firm”) protects the personal and business data of clients, prospective clients, website visitors, and staff. It applies across our practice at E-595, 2nd Floor, Daani Plaza, Near Ramphal Crossing, Dwarka Sector-7, Block E, Palam Extension, Palam, New Delhi, Delhi 110077, and to all systems we use in the course of our work.

We align our practices with the Information Technology Act, 2000 and the SPDP Rules, 2011, the Digital Personal Data Protection Act, 2023 (as and when its provisions are notified), the ICAI Code of Ethics confidentiality obligations, and other applicable Indian laws.

We process data lawfully, fairly and transparently; collect it only for specified, legitimate purposes; keep it accurate and only as long as needed; secure it with appropriate technical and organisational measures; and remain accountable for compliance at every level of the Firm.

Our safeguards include role-based access so that only authorised personnel see client data, encryption and password protection for devices and communications, secure and backed-up storage, vetted third-party processors bound by confidentiality agreements, and periodic review of our practices.

Client information obtained during professional engagements is treated as strictly confidential and is never disclosed except with client consent, or where required by law, regulation, or ICAI requirements.

If a personal-data breach occurs that is likely to affect you materially, we will notify affected individuals and the relevant authorities without undue delay, describe the nature and likely consequences of the breach, and take steps to mitigate and remediate it.

You may request access to your data, correction of inaccuracies, erasure where lawful, and grievance redressal. Requests should be made to the Firm at the office address above or by telephone on 011 4523 5526. We aim to acknowledge requests promptly and resolve grievances within a reasonable period.

Every person working with the Firm is made aware of their data-protection responsibilities. Breaches of this policy are treated seriously and addressed through internal disciplinary and remedial processes.

This policy is reviewed periodically and updated as the law and our practice evolve. The version on this page is the one currently in force.