Data protection

DigiFIR handles sensitive personal data: who complained, who was hurt, who is accused, what witnesses said, and evidence. This page sets out how that data is limited, protected, kept and erased.

Data minimisation

Each piece of data goes to the narrowest place that still lets the system work. On-chain and off-chain data has the full table. In short:

• The shared ledger holds IDs, numbers, statuses, links, times and salted hashes. Keys of ledger records never contain personal data.
• Narratives and personal details sit in the private data collection of the state concerned, readable only by that state's police and the judiciary.
• Files are encrypted on the device and stored as ciphertext. Their keys sit in private collections.
• Read views, event streams, push notifications, metrics and logs carry no personal data.
• Names of officials are kept in the backend's directory, never on the ledger.

Aadhaar

• Aadhaar is never mandatory to file a complaint. Every route that uses it sits beside an alternative on the same screen: DigiLocker, or verification in person at a police station.
• The Aadhaar number, VID, e-KYC XML and biometrics are never stored, logged or put on the ledger. A hash of the Aadhaar number is not used as a reference either.
• When the DigiLocker route reads a signed e-Aadhaar, the backend verifies it, keeps only the attributes a complaint needs, and drops the rest, the photograph first.
• For eSign, the citizen types the Aadhaar number on the eSign provider's page, never in DigiFIR.
• If a citizen gives an accused person's Aadhaar number, only its last four digits leave the phone.

The identity vault

The backend keeps the attributes a complaint needs in an identity vault inside PostgreSQL:

• every value is encrypted with AES-256-GCM under a per-row data key, wrapped by a key-encryption key held in the HSM;
• the vault has its own database role;
• to recognise the same person again, the vault keeps a keyed one-way reference (an HMAC under an HSM-held key) of their DigiLocker ID or UID token, never of their name or a number;
• database dumps and backups reveal nothing without the HSM.

Consent

The citizen app's Terms screen shows the terms and the privacy notice. What the citizen accepted, with the notice's version, the SHA-256 of the text as shown, the language and the time, is recorded as a consent receipt under the Digital Personal Data Protection Act, 2023. A citizen can list their consents and withdraw one through the API.

Access to private data

• Every read of private data is a request signed by the reader and checked by the chaincode against their role and jurisdiction, on a peer of an institution that holds the data. Roles and privileges lists who may read what.
• Private values pass through the backend's memory only, for at most the duration of a request (bundles: 120 seconds), and are zeroed afterwards.
• Every private read and every file download is written to the audit log with the reader's key, the targets and the parts, never the values. Registrars and auditors of the institution can see it.

Retention

Data	Kept
Ledger records and their read views	As long as the ledger
Statutory messages (FIR copy link, progress updates)	As long as the case, as evidence of the notice
Other messages	1 year
In-app notifications	90 days
Sessions	180 days (CERT-In)
Enrolments and SIM checks	3 years, as evidence of who enrolled whom
Identity proofings and key additions	30 days
Event stream backlog	24 hours
Audit log	180 days online in India, then write-once archive for the institution's statutory period
Evidence ciphertext	While any copy of its key exists, then the operator's retention policy

Retention for some operational tables is still an open decision for the pilot states.

Erasure

Nothing on the shared ledger is deleted. When personal data must go, the private value is purged and the proof that it existed stays: Erasure explains the process.

IMPORTANT

A citizen's request alone does not erase case data. Section 17(1)(c) of the DPDP Act exempts processing for the prevention, detection, investigation or prosecution of offences, and erasing evidence needs a court order or a statutory erasure rule. Deleting a citizen account erases the account's off-chain data: profile, sign-in and contacts. The vault keeps only a tombstone linking the keyed reference to the DID.

Data localisation and CERT-In

• In the pilot, the backend, its data stores and its logs are hosted in India, on NIC/NBF or a MeitY-empanelled cloud.
• Following the CERT-In directions of April 2022: access logs of every system are kept in India for 180 days, incidents are reported within 6 hours, and clocks are synchronised to the NTP servers of NPL and NIC. The API refuses to start with a clock offset above one second.
• Access logs go to an India-hosted log store that becomes write-once after 24 hours.

Sources: digifir-backend docs/architecture/BACKEND.md sections 5.5, 10 and 15.4 to 15.5, DECISIONS.md ADR-08 and ADR-12, openapi/digifir.yaml (consents); digiFIR-citizen-app docs/04-identity.md on the migration branch; digifir-chaincode docs/SPEC.md section 8.