Tech Blog

Ensuring Data Sovereignty: Jio Haptik Completes SAR Audit for Data-localization

By Kishore Mavuri | Published July 12, 2024

Data localization has emerged as a pivotal requirement in today’s digital era, particularly in the context of national security and data sovereignty. The Indian government has been proactive in mandating data localization across various sectors such as BFSI, Defence and Healthcare to ensure that critical data concerning Indian citizens and businesses is stored within the country's borders. The sectoral regulators like Reserve Bank of India (RBI), Insurance Regulatory and Development Authority of India (IRDAI), Securities and Exchange Board of India (SEBI) have already mandated data residency with the regulated entities for specific sensitive data (as per the sectoral norms). This mandate aims to secure and protect the privacy of individuals and bolster the nation's cybersecurity framework.

Though not a regulated entity, Jio Haptik Technologies Limited, a leader in conversational AI solutions, has recently achieved a significant milestone in this domain by completing the Audit for data localization and procuring the System Audit Report (SAR) for the same. The audit was conducted by Talakunchi Networks, an independent third-party auditor accredited by CERT-in (Computer Emergency Response Team – India). This blog delves into what this achievement means for Haptik, its clients, and the broader landscape of data security and compliance in India.

Understanding Data Localization and Its Importance

Data localization refers to the practice of storing data on servers located within a specific country. For India, this means that any data generated by Indian users, especially sensitive and critical information, must reside on servers within Indian territory. The rationale behind this is multifaceted:

National Security: Localized data storage ensures that sensitive information is not subjected to foreign jurisdictions, reducing the risk of international espionage and enhancing national security.
Data Sovereignty: It ensures that Indian laws govern data generated within the country, giving the Indian government more control over its citizens' information.
Privacy Protection: Storing data locally helps in adhering to local privacy laws more effectively and enables better enforcement of data protection regulations.

Haptik's Commitment to Data Localization

Haptik has always been at the forefront of adopting robust data protection measures. Recognizing the critical importance of data localization, the company has undertaken extensive efforts to comply with India's evolving regulatory requirements. The completion of the System Audit Report for data localization signifies Haptik's dedication to safeguarding the data of its users and clients in India.

Key Steps in the SAR Process

Assessment and Gap Analysis: The first step in the SAR process was a comprehensive assessment of Haptik's existing data capturing, processing and storage practices. This involved identifying gaps between current practices and the stringent requirements set forth by Indian regulatory bodies like RBI, SEBI etc.
Data Traceroute on Haptik System: To ensure data localization, one of the requisites of the audit is to do the data traceroute to identify and verify the paths data has taken in the Haptik network/system. To meet localization requirements, Haptik invested in enhancing its IT infrastructure via association with Tier-3 (or) above data centers within India, ensuring that all critical data was securely stored.
Policy and Process Alignment: Haptik revamped its data governance policies to align with local regulatory standards. This included revising data handling, storage, and access policies to ensure compliance with Indian data protection laws.
Security Measures Implementation: Robust security measures were implemented to protect localized data. This encompassed advanced encryption techniques (including field-level encryption and disc-level encryption meeting AES 256 bit encryption standard), data masking, access controls & reviews, secure data deletion, and continuous monitoring to safeguard data against unauthorized access and breaches.
Compliance Certification (or SAR): The final step involved in this rigorous external audit for verifying the compliance with data localization requirements is the System Audit Report. Successfully obtaining the System Audit Report validates that Haptik's data localization practices comply fully with regulatory mandates from authorities like the RBI, IRDAI, and SEBI. This report is available to external parties, including customers and industry professionals, under a signed Non-Disclosure Agreement (NDA).

What This Achievement Means for Haptik and Its Clients

Enhanced Trust and Confidence

By localizing data storage, Haptik strengthens the trust and confidence of its clients and users. Haptik is already the market leader for providing conversational AI services in the Indian BFSI segment; and this provides an added assurance and Haptik’s compliance validation to all BFSI and other clients assuring that their data is stored securely within Indian borders, governed by Indian laws. This is particularly crucial for clients governed by regulators like RBI, IRDAI, SEBI etc; healthcare and government entities will also have such a need where data security is paramount.

Compliance with Regulatory Requirements

Jio Haptik itself is not directly subject to sector-specific regulatory requirements. However, many of our clients operate under stringent regulations enforced by bodies such as RBI, IRDAI, and SEBI. The completion of SAR for data localization positions Jio Haptik as a compliant and forward-thinking company. This not only ensures adherence to current regulations but also prepares the company for future compliance requirements as data protection laws continue to evolve.

Improved Data Security

Localized data storage, coupled with enhanced security measures, significantly reduces the risk of data breaches and unauthorized access. This aligns with Haptik's commitment to providing secure and reliable AI solutions to its clients.

Competitive Advantage

In a market where data security and compliance are critical differentiators, Haptik's proactive approach to data localization gives it a competitive edge. Clients seeking reliable and compliant AI solutions are more likely to partner with a company that prioritizes data protection and localization.

Conclusion

Haptik's successful completion of the SAR for data localization underscores its commitment to data security, regulatory compliance, and customer trust. By localizing data storage and implementing robust security measures, Haptik is well-positioned to meet the needs of its clients while adhering to the stringent regulatory landscape in India. This achievement not only enhances the company's reputation but also sets a benchmark for others in the industry to follow.

As data protection continues to be a top priority for businesses and governments alike, Haptik's proactive approach serves as a model of excellence in the field of data localization and security. External parties, including customers, prospects, and industry professionals, can access this report upon signing a Non-Disclosure Agreement (NDA). Additionally, they are welcome to explore Haptik’s extensive security and compliance capabilities through our trust portal, https://trust.haptik.ai/.