Privacy Notice

1. Our Commitment to Privacy

RSM India respects the privacy of individuals whose personal data we collect and process and is committed to handling such information responsibly, transparently and securely.

This Privacy Notice explains how personal data may be collected, used, disclosed, stored, transferred, protected and otherwise processed when you:

visit or interact with the RSM India website, including www.rsmindia.in, www.rsm.global/india, associated webpages and authorised digital platforms (“Website”);

contact us or submit an enquiry;

• engage or propose to engage an RSM India entity for professional services;
• interact with us as an employee, director, representative or other contact of a client or prospective client;
• apply for employment, internship, articleship or other career opportunities;
• register for or participate in seminars, webinars, conferences, training programmes or events;
• subscribe to newsletters, publications, regulatory updates or professional communications;
• interact with us as a vendor, consultant, speaker, trainer, service provider or business partner; or
• otherwise interact with an RSM India entity where this Privacy Notice is made available to you.

This Privacy Notice should be read together with any specific privacy notice, consent statement, engagement letter, contractual term or other privacy information provided to you for a particular processing activity.

2. Who We Are

For purposes of this Privacy Notice, “RSM India”, “we”, “us” or “our” refers to RSM Astute Consulting Private Limited and the relevant RSM India affiliates or entities responsible for the particular interaction, engagement or processing activity.

RSM Astute Consulting Private Limited and its affiliates are members of the RSM network.

RSM is the trading name used by members of the RSM network.

Each member of the RSM network is an independent accounting, tax, consulting or professional-services firm that practices in its own right.

The RSM network is administered by RSM International Limited, a company incorporated in England and Wales.

Neither RSM International Limited nor the RSM network is, merely by virtue of network membership, responsible for the acts or omissions of an individual RSM member firm.

Depending on the circumstances:

• RSM India may act as a Data Fiduciary under the Indian Digital Personal Data Protection Act, 2023 (“DPDP Act”);
• RSM India may act as a Data Processor on behalf of a client;

Where appropriate, additional privacy information will be provided regarding the responsible entity.

3. Scope of this Privacy Notice

This Privacy Notice applies to personal data relating to individuals including:

• Website visitors;existing and prospective clients;
• directors, partners, employees and representatives of clients;
• individuals whose personal data is provided to us in connection with professional engagements;
• job applicants and prospective employees;
• interns, trainees and articled assistants;
• event, seminar and webinar participants;
• speakers and trainers;
• newsletter and publication subscribers;
• vendors, consultants, contractors and service providers;
• business contacts; andother persons interacting with RSM India.

Where you provide personal data concerning another person, you should ensure that you are authorised to provide the information and that the individual has, where required, been appropriately informed of the processing.

4. Personal Data We May Collect

The type of personal data we collect depends upon your relationship with us and the nature of your interaction.

4.1 Identity and Contact Information

This may include:

• name;
• designation;
• job title;
• organisation or employer;
• business or residential address, where required;
• email address;
• telephone or mobile number;
• country of residence;
• signature;
• photograph; and
• other contact information.

4.2 Professional and Business Information

This may include:

• professional qualifications;
• business role and responsibilities;
• occupation;
• employment information;
• professional memberships;
• organisation details;
• industry information;
• business interests;
• correspondence and communications;
• information relating to projects or engagements; and
• other professional information relevant to our relationship.

4.3 Client and Engagement Information

In connection with professional services, we may process information such as:

• client instructions;
• business and financial information;
• accounting records;
• tax information;
• transaction details;
• corporate and ownership information;
• contracts;
• regulatory records;
• internal-control information;
• employee and payroll information;
• billing and payment information;
• compliance documentation;
• identity-verification information;
• technology and cybersecurity information; and
• other personal data contained in documents or information supplied for an engagement.

• The precise categories depend upon the nature of the service.

4.4 Identification and Regulatory Information

Where required, we may process information contained in or relating to:

• PAN;
• Aadhaar or other government-issued identification, where lawfully required;
• passport;
• driving licence;
• tax registrations;
• corporate identification information;
• KYC information;
• regulatory registrations; and
• other authorised verification documents.

We seek to collect such information only where relevant and proportionate to the applicable purpose.

4.5 Recruitment and Career Information

Where you apply for a role with RSM India, we may process:

• first and last name;
• contact information;
• address;
• nationality or work-authorisation information, where relevant;
• curriculum vitae or resume;
• educational qualifications;
• professional qualifications;
• employment history;
• skills and experience;
• current and expected compensation;
• references;
• interview and assessment records;
• role preferences;
• information regarding how you heard about the opportunity;
• identification documents;
• background-verification information; and
• other information voluntarily provided during recruitment.

A separate Job Applicant Privacy Notice and Consent may be provided at the point of application.

4.6 Website Enquiries

Where you submit an enquiry through our Website, we may collect:

• first name;
• last name;
• company name;
• job title;
• country of residence;
• business email;
• business telephone number;
• subject;
• message; and
• any other information you choose to include.

4.7 Events, Webinars and Training

When you participate in our events, we may process:

• name;
• organisation;
• designation;
• contact information;
• registration information;
• attendance information;
• questions and feedback;
• event preferences;
• photographs;
• audio or video recordings where appropriately notified and authorised;
• presentation materials; and
• professional interests.

4.8 Newsletters, Publications and Professional Communications

Where you subscribe or consent to receive communications, we may process:

• name;
• business email address;
• organisation;
• designation;
• areas of professional interest;
• communication preferences;
• subscription status;
• consent records; and
• unsubscribe history.

4.9 Technical and Website Information

When you use the Website, certain information may be collected automatically, including:

• IP address;
• browser type and version;
• operating system;
• device information;
• date and time of access;
• referring website;
• pages viewed;
• Website navigation patterns;
• interaction information;
• security logs;
• diagnostic information;
• cookie identifiers; and
• similar technical data.

4.10 Vendor and Business Partner Information

Where you or your organisation provides services to RSM India, we may process:

• contact and identity information;
• professional details;
• tax and banking information;
• contractual records;
• invoicing information;
• due-diligence information;
• access credentials where appropriate;
• compliance and security information; and
• communications relating to the business relationship.

4.11 Information from Other Sources

Where appropriate and lawful, we may receive personal data from:

• contact and identity information;
• professional details;
• tax and banking information;
• contractual records;
• invoicing information;
• due-diligence information;
• access credentials where appropriate;
• compliance and security information; and
• communications relating to the business relationship.
   

5. How We Collect Personal Data

We may collect personal data:

Directly from you

For example, when you:

• submit a Website form;
• contact us;
• correspond with us;
• provide information during a professional engagement;
• submit a job application;
• participate in an event;
• subscribe to communications;
• complete a survey;
• provide professional services to us; or
• otherwise interact with RSM India.

From your organisation or another authorised person

Your employer, organisation, client, colleague, representative or other authorised person may provide information about you.

From clients in connection with professional services

Clients may provide personal data relating to employees, directors, shareholders, customers, vendors or other individuals where required for us to provide professional services.

From other RSM member firms

Where professional services span multiple jurisdictions or involve network resources, an RSM member firm may provide personal data to an RSM India entity where necessary and lawful.

Automatically

Technical information may be generated when you access or interact with the Website or our systems.

From publicly available and authorised sources

We may obtain information from professional registers, government sources, company registries, regulatory databases and other lawful publicly available sources.

6. Why We Process Personal Data

We process personal data only for identified and lawful purposes.

6.1 Providing Professional Services

To:

• respond to requests for services;
• undertake client acceptance procedures;
• perform assurance, risk, tax, consulting, transaction, technology, cybersecurity and other professional engagements;
• communicate with clients;
• manage projects and engagements;
• prepare advice, reports and deliverables;
• coordinate multi-jurisdictional engagements; and
• maintain appropriate engagement records.

6.2 Client and Relationship Management

To:

• establish and manage client relationships;
• administer engagements;
• communicate with authorised contacts;
• process billing and payments;
• maintain business records;
• measure service quality;
• manage feedback; and
• understand client requirements.

6.3 Legal, Regulatory and Professional Compliance

To:

• comply with applicable laws;
• comply with tax and accounting obligations;
• meet professional standards;
• conduct independence and conflict checks;
• perform KYC or other verification where applicable;
• manage regulatory requirements;
• respond to lawful governmental or judicial requests;
• conduct internal or external audits; and
• establish, exercise or defend legal claims.

6.4 Recruitment and Workforce Management

To:

• receive and evaluate applications;
• communicate with candidates;
• assess qualifications, experience and suitability;
• conduct interviews and assessments;
• verify credentials;
• conduct authorised background verification;
• manage recruitment decisions; and
• maintain required recruitment documentation.

6.5 Events, Training and Knowledge Sharing

To:

• administer registrations;
• communicate event information;
• conduct webinars and seminars;
• facilitate training programmes;
• manage speaker engagements;
• record sessions where appropriate consent has been obtained;
• manage attendance;
• issue materials; and
• obtain feedback.

6.6 Newsletters, Publications and Regulatory Updates

Where we have an appropriate basis, including consent where required, we may use business contact information to send:

• tax updates;
• accounting and financial updates;
• regulatory developments;
• government notifications;
• newsletters;
• publications;
• thought-leadership material;
• technical alerts;
• webinar invitations;
• seminar invitations; and
• professional-event communications.

You may unsubscribe or change your preferences at any time.

6.7 Website Operation and Improvement

To:

• operate and maintain the Website;
• respond to Website enquiries;
• ensure accessibility;
• diagnose technical problems;
• improve functionality and usability;
• understand Website performance; and
• develop Website content and services.

6.8 Information Security and Fraud Prevention

To:

• protect our systems and information;
• authenticate users;
• monitor security events;
• investigate suspected misuse;
• detect malware or cyber threats;
• prevent unauthorised access;
• protect confidential information; and
• respond to security incidents.

6.9 Internal Governance and Business Administration

To:

• manage risk;
• maintain business records;
• perform audits;
• support quality management;
• manage vendors;
• administer insurance;
• maintain business continuity;
• support finance and accounting;
• manage information governance; and
• meet internal policy requirements.

7. Grounds for Processing

RSM India processes personal data in accordance with applicable law.

Under the Digital Personal Data Protection Act, 2023, personal data may be processed where:

• the Data Principal has provided valid consent for a specified purpose; or
• processing is permitted as a certain legitimate use or under another applicable legal provision.
• Where processing is based on consent, we seek to ensure that consent is:
• free;
• specific;
• informed;
• unconditional;
• unambiguous; and
• provided through clear affirmative action.

Where applicable, consent may be withdrawn.

Withdrawal will not affect processing that was lawfully undertaken before withdrawal.

Certain processing may continue notwithstanding withdrawal where retention or processing is required or permitted under applicable law.

8. Data Minimisation and Purpose Limitation

We endeavour to collect only personal data reasonably necessary for the identified purpose.

Personal data should not ordinarily be used for a materially unrelated purpose unless:

• you have been appropriately informed;
• additional consent has been obtained where required; or
• the processing is otherwise permitted by applicable law.
• As part of our Privacy Information Management System, processing activities may be periodically reviewed to identify opportunities for:
• data minimisation;
• access restriction;
• reduced retention;
• anonymisation;
• pseudonymisation; and
• elimination of unnecessary processing.

9. Sharing of Personal Data

We do not sell or rent personal data.

Personal data may be shared where reasonably necessary with the following recipients.

9.1 RSM India Personnel

Partners, directors, employees, consultants, trainees and other authorised personnel who require access for a legitimate business or professional purpose.

9.2  Contractors, Group Affiliates & Network Firms

Where an engagement, enquiry, referral or service requires expertise or resources from group affiliates, contractors or network firms personal data may be shared with  them.

9.4 Clients

Where information is processed in connection with a client engagement, relevant information may be disclosed to the instructing client or other authorised engagement participants.

9.5 Service Providers and Data Processors

We may engage third parties to provide:

• cloud services;
• Website hosting;
• IT infrastructure;
• email and communications;
• cybersecurity;
• document management;
• CRM services;
• professional software;
• recruitment systems;
• background verification;
• payroll or administrative services;
• event management;
• payment processing;
• analytics; and
• business-continuity services.

Service providers processing personal data on our behalf are expected to do so only for authorised purposes and subject to appropriate privacy, confidentiality and information-security obligations.

9.6 Professional Advisers

Personal data may be shared with legal advisers, auditors, insurers, accountants and other professional advisers where necessary.

9.7 Government and Regulatory Authorities

We may disclose personal data where required or permitted by law, including to:

• courts;
• regulators;
• law-enforcement agencies;
• tax authorities;
• government departments;
• statutory authorities; and
• professional or oversight bodies.

9.8 Business Transactions

Personal data may be disclosed in connection with a restructuring, merger, acquisition, business transfer or similar transaction, subject to appropriate confidentiality and data-protection measures.

10. Data Processors and Vendor Management

Where a service provider processes personal data on behalf of RSM India, we take reasonable measures appropriate to the nature and risk of the processing to evaluate the service provider and establish suitable contractual obligations.

Depending on the risk and service, these requirements may address:

• permitted processing purposes;
• confidentiality;
• privacy requirements;
• information-security controls;
• access management;
• incident notification;
• data location;
• subprocessors;
• cross-border processing;
• retention and secure deletion;
• audit rights;
• business continuity;
• regulatory cooperation; and
• return or deletion of data upon termination.

Where required, vendor privacy and security assessments may form part of our governance process.

11. International and Cross-Border Processing

RSM India operates as part of an international professional-services network.

Accordingly, personal data may in appropriate circumstances be accessed, processed or stored outside India, including where:

• an engagement involves another RSM member firm;
• specialist expertise is provided from another jurisdiction;
• global network technology or collaboration platforms are used;
• authorised cloud or technology providers host data outside India;
• global security or support services require access; or
• an international client engagement requires cross-border processing.

Such processing will be undertaken subject to applicable law.

Where the DPDP Act applies, transfers will remain subject to restrictions, if any, notified by the Government of India.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or as required or permitted by applicable legal, contractual, regulatory or professional obligations.

Retention periods may depend on:

• the nature of the information;
• the purpose of processing;
• the nature and duration of the professional engagement;
• professional standards;
• statutory requirements;
• tax and accounting obligations;
• contractual requirements;
• regulatory requirements;
• security requirements;
• legal limitation periods;
• litigation or investigations; and

the need to establish, exercise or defend legal claims.

When personal data is no longer required, we take reasonable steps to:

• securely delete it;
• destroy it;
• anonymise it;
• archive it subject to restricted access; or
• otherwise render it inaccessible,

subject to applicable legal and operational requirements and normal backup cycles.

RSM India maintains internal data-retention and secure-disposal requirements as part of its information-governance framework.

13. Information Security

RSM India recognises that professional engagements may involve sensitive, confidential and commercially valuable information.

We maintain administrative, technical, physical and organisational safeguards designed to protect personal data against:

• unauthorised access;
• unlawful disclosure;
• accidental loss;
• alteration;
• destruction;
• misuse; and
• other unauthorised processing.

Depending upon the nature and risk of processing, safeguards may include:

• identity and access management;
• role-based access control;
• least-privilege principles;
• multi-factor authentication;
• encryption;
• network and endpoint security;
• security monitoring and logging;
• vulnerability management;
• malware protection;
• secure backups;
• business-continuity and disaster-recovery controls;
• security-incident management;
• vendor security assessments;
• confidentiality obligations;
• secure-development practices; and
• privacy and information-security awareness programmes.

Our information-security management practices are guided by the principles and control framework of ISO/IEC 27001:2022.

Our privacy-management practices are guided by ISO/IEC 27701:2025.

No information system or communication network can be guaranteed to be completely secure. Accordingly, while reasonable and appropriate safeguards are implemented, absolute security cannot be guaranteed.

14. Personal Data Breaches

RSM India maintains processes for identifying, reporting, assessing, containing and responding to information-security and personal-data incidents.

Where a Personal Data Breach occurs, we will take appropriate steps to:

• contain the incident;
• investigate the cause;
• assess the affected information;
• assess potential impact on individuals;
• mitigate reasonably foreseeable harm;
• preserve relevant evidence;
• undertake remediation;
• implement corrective and preventive actions; and
• make notifications required under applicable law.

Where applicable, notifications may include the Data Protection Board of India, affected Data Principals, CERT-In or another competent authority.

Relevant service providers may be contractually required to promptly notify us of incidents affecting personal data processed on our behalf.

15. Cookies and Similar Technologies

Our Website may use cookies and similar technologies.

These may be used for:

• essential Website operation;
• cybersecurity;
• session management;
• accessibility;
• preference management;
• Website performance;
• analytics;
• improving content; and
• understanding Website usage.

Strictly necessary cookies may be used where required to operate and protect the Website.

Where required by applicable law, non-essential cookies will be activated only after obtaining appropriate consent.

You may manage cookie choices through the Website’s cookie-preference mechanism and, where appropriate, through browser controls.

Additional information may be provided in a separate Cookie Notice.

16. Newsletters, Publications and Professional Communications

RSM India regularly publishes professional information relating to:

• taxation;
• accounting;
• financial reporting;
• regulation;
• government notifications;
• cybersecurity;
• technology;
• risk;
• industry developments; and
• other professional topics.

Where consent is required, newsletters, publications, webinar invitations and similar communications will be sent only after an appropriate consent mechanism has been completed.

Consent to receive such communications is voluntary and is not a condition for receiving professional services.

Recipients may:

• unsubscribe through the link provided in the email;
• update their communication preferences; or
• contact us using the details provided in this Notice.

After an unsubscribe request, minimal information may be retained on a suppression list to ensure that the preference continues to be respected.

17. Recruitment and Job Applications

Candidates may apply for employment opportunities through an authorised RSM India career portal or application form.

Recruitment data may be processed to:

• assess applications;
• communicate with candidates;
• schedule interviews;
• conduct assessments;
• verify qualifications and experience;
• conduct reference checks;
• perform authorised background verification;
• make recruitment decisions;
• prepare employment offers; and
• comply with employment and regulatory requirements.

Personal data relating to unsuccessful candidates will not be retained longer than necessary for the recruitment purpose unless:

• the candidate has consented to retention for future vacancies; or
• retention is otherwise required or permitted by law.

Applicants should refer to the separate Job Applicant Privacy Notice and Consent made available during the application process.

18. Photographs, Audio and Video Recordings

RSM India may conduct training programmes, webinars, conferences and other events that are photographed or recorded.

Where required, individuals will be informed of the intended recording and appropriate consent will be obtained.

Recordings may be used for authorised purposes such as:

• internal training;
• professional development;
• knowledge management;
• event documentation;
• learning repositories; and
• other stated purposes.

Where a recording is intended for public, promotional or social-media use, additional or separate permission may be sought where appropriate.

External speakers and trainers may be asked to provide specific Recording and Training Use Consent covering their image, voice, presentation and associated content.

19. Children’s Personal Data

Our Website and professional services are not primarily directed at children.

We do not knowingly seek to collect personal data of children through the Website except where necessary for an authorised professional or employment-related purpose.

Where the DPDP Act requires verifiable consent of a parent or lawful guardian before processing a child’s personal data, such consent will be obtained unless a legally recognised exception applies.

We do not knowingly undertake tracking, behavioural monitoring or targeted advertising directed at children where prohibited by law.

20. Automated Processing and Artificial Intelligence

RSM India may use technology, analytics and artificial-intelligence-enabled tools to support business and professional activities.

Where personal data is processed using such technology:

• use will be subject to applicable confidentiality and privacy requirements;
• access will be limited to authorised purposes;
• reasonable information-security safeguards will be applied;
• personal data will not knowingly be used to train public or third-party generative AI models unless appropriately authorised and legally permitted; and
• significant employment, client or professional decisions will not ordinarily be made solely through automated processing without appropriate human involvement and lawful safeguards.

Where required, additional notice may be provided for specific automated-processing activities.

21. Your Rights

Subject to the DPDP Act and other applicable laws, you may have rights relating to your personal data.

These may include:

Access

Request a summary of personal data being processed and other information concerning the processing, as available under applicable law.

Correction

Request correction of inaccurate or misleading personal data.

Completion

Request completion of incomplete information.

Updating

Request updating of personal data that is no longer current.

Erasure

Request erasure where the applicable legal requirements are satisfied.

We may continue retaining information where necessary or permitted under:

• applicable law;
• professional standards;
• regulatory obligations;
• contractual requirements;
• statutory record-retention obligations; or
• requirements to establish, exercise or defend legal claims.

Withdrawal of Consent

Where processing is based on consent, consent may be withdrawn at any time.

The method for withdrawing consent will be reasonably comparable in ease to the method through which consent was provided.

Withdrawal will not affect processing lawfully undertaken before withdrawal.

Grievance Redressal

Raise a grievance concerning the processing of your personal data.

Nomination

Where applicable under the DPDP Act, nominate another person to exercise your rights in the event of death or incapacity.

Complaint

Where applicable statutory requirements have been satisfied, you may approach the Data Protection Board of India.

Where another privacy law applies, additional or different rights may be available.

22. Exercising Your Rights

To submit a privacy request, contact:

Privacy Office / Grievance Officer
RSM India
Email: dataprivacy@rsmindia.in
Address: 3rd Floor, A-Wing,Technopolis Knowledge Park, Mahakali Caves Road, Andheri (E), Mumbai 400 093

Please provide sufficient information to enable us to understand and locate the relevant records.

We may take reasonable steps to verify your identity before acting upon a request.

Requests will be handled within the timelines prescribed by applicable law.

23. Grievance Redressal

If you have a question or concern about the processing of your personal data, please contact:

Grievance Officer / Privacy Office
RSM India

Email: dataprivacy@astuteconsulting.com 
Address: 3rd Floor, A-Wing,Technopolis Knowledge Park, Mahakali Caves Road, Andheri (E), Mumbai 400 093

We will acknowledge, assess and respond to privacy grievances in accordance with our internal grievance-management procedures and applicable law.

Where available under applicable law, a Data Principal may subsequently approach the competent authority, including the Data Protection Board of India.

24. Accuracy of Personal Data

We take reasonable steps, where required, to ensure that personal data used to make decisions affecting individuals or disclosed to other Data Fiduciaries is accurate, complete and consistent.

You should provide accurate and current information when interacting with us.

If information held by us is inaccurate, incomplete or outdated, you may request correction or updating.

25. Third-Party Websites and Services

Our Website may include links to external websites, social-media platforms, RSM member-firm websites or other third-party services.

The privacy practices of independent third parties are governed by their own policies.

Where you leave an RSM India-controlled Website and access an independently controlled service, we encourage you to review that provider’s privacy notice.

26. Client Confidentiality and Professional Obligations

Professional engagements may involve information protected by:

• contractual confidentiality;
• professional standards;
• statutory confidentiality obligations;
• audit requirements;
• regulatory requirements; and
• other duties arising from the professional relationship.

This Privacy Notice does not reduce or replace those obligations.

Where personal data is received in the course of an audit, tax, assurance, consulting, advisory, cybersecurity, risk or other professional engagement, access will be managed according to the engagement requirements and applicable professional obligations.

27. Privacy by Design and Accountability

RSM India seeks to integrate privacy into relevant systems, projects, services and business processes.

Our Privacy Information Management System may include:

• identification of personal-data processing activities;
• records of processing;
• data classification;
• privacy-risk assessment;
• privacy impact assessment for higher-risk activities;
• privacy by design and privacy by default;
• purpose limitation;
• data minimisation;
• access control;
• retention and disposal;
• Data Principal rights management;
• consent management;
• vendor privacy assessment;
• processor-management requirements;
• incident management;
• breach notification;
• employee privacy awareness;
• internal audits;
• management review; and
• continual improvement.

These measures support our broader information-security and privacy-governance framework.

28. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes in applicable law;
• changes in regulatory requirements;
• changes in Website functionality;
• changes in processing activities;
• changes in RSM network arrangements; or
• developments in privacy or information-security practices.

The latest version will be published on the Website and will state the date of the most recent update.

Where a change materially affects how personal data is processed, additional notice or consent will be provided where required by law.

29. Contact Us

For questions about this Privacy Notice or RSM India’s privacy practices, please contact:

RSM India
Privacy Office / Grievance Officer

RSM Astute Consulting Private Limited
301–307, 3rd Floor
Technopolis Knowledge Park
Mahakali Caves Road
Chakala, Andheri East
Mumbai – 400 093
India

Email: dataprivacy@astuteconsulting.com
Telephone: +91 22 6108 5555 / +91 22 6121 4444
Website: www.rsmindia.in

30. Applicable Privacy and Information-Security Framework

RSM India’s privacy and information-security governance is designed having regard to applicable legal and regulatory requirements and recognised standards, including, where relevant:

• Digital Personal Data Protection Act, 2023 and rules made thereunder;
• Information Technology Act, 2000 and applicable rules and directions;
• applicable Indian employment, professional, regulatory and record-keeping requirements;
• ISO/IEC 27701:2025 — Privacy Information Management Systems; and
• ISO/IEC 27001:2022 — Information Security Management Systems.

References to ISO standards describe frameworks informing our privacy and information-security practices and should not, by themselves, be interpreted as a representation of certification unless RSM India expressly states that the relevant entity and scope are certified.