Security and Learner Data

How we handle learner data when you deliver our courses on your own LMS or on our hosted platform, and how that fits with the DPDP Act.

Last updated

Two ways to deliver our courses

On your own LMS (SCORM). We supply courses as SCORM packages that run inside your learning management system. Learner names, IDs, progress and scores are stored by your LMS, not by us. In this model we do not receive learner personal data unless you send it to us, for example for support.

On our hosted platform. If you use our managed Compliance Central platform, we host the courses and store the learner data needed to run them: typically name, work email or employee ID, department, course progress, scores, completion dates and certificates. We process this data on your behalf and only to deliver and report on your training.

How we protect data on the hosted platform

  • Data is transmitted over encrypted (HTTPS/TLS) connections.
  • Access to client data is restricted to staff who need it to deliver or support the service.
  • Each client’s learners and reports are kept separate from other clients’.
  • We collect only the learner fields needed to run and report on training.
  • Client administrators control who is enrolled and can export completion records for audits.

DPDP Act alignment

Under the Digital Personal Data Protection Act, 2023, the employer that decides why and how learner data is used is the Data Fiduciary. When we host training for you, we act as your Data Processor and process learner data under your instructions and our agreement with you. We support your obligations by limiting the data we collect, protecting it with reasonable security safeguards, telling you without delay if we become aware of a personal data breach affecting your learners, and returning or deleting data when our engagement ends.

Our DPDP Act training helps your own employees meet the same standards.

Retention and deletion

We keep hosted learner records for as long as our agreement with you requires, so that you can evidence training to auditors and regulators, and delete or return them at the end of the engagement or on your written request.

Security questionnaires and reporting a concern

We can complete your vendor security and data protection questionnaires during procurement. To report a security concern or ask about our controls, email enquiry@complianceatworkplace.com. See also our Privacy Policy and Terms of Service.