The law we follow, and what we hold
The data protection and incident reporting laws we follow in each region, and where we stand on ISO 27001 and SOC 2.
The law we follow
- India
- Section 43A of the IT Act, 2000 and the SPDI Rules today; the DPDP Act, 2023 from 13 May 2027
- European Union and United Kingdom
- The GDPR and the UK GDPR, with the EU standard contractual clauses and the UK Addendum in our Data Processing Agreement
- United States
- We act as your service provider under the state privacy laws that apply, such as the California Consumer Privacy Act
- Incident reporting
- To CERT-In within six hours of noticing an incident, under its Directions of 28 April 2022
ISO 27001 and SOC 2
Not held today but planned for Q3 2027. We answer your security questionnaire.
MAGDOX Private Limited does not currently claim ISO 27001 certification or a SOC 2 report. Our measures follow the structure of the IS/ISO/IEC 27001 standard; this page describes them and is not evidence of an independent audit. On request, we complete your security questionnaire and share summaries of our security assessments, under confidentiality. A change to these measures never lowers their overall level of protection during a customer's term.