Data Protection Policy

Toptal handles personal data for enquiries and, when a project requires it, for the client’s users under the client’s instructions.

Principles

• Collect what the enquiry or the project needs.
• Use it for that purpose.
• Limit access to people who need it.
• Keep it only for an agreed period.

Security practices

Production access is limited, passwords are hashed, form submissions are validated, and uploads are restricted by type and size. Project systems follow the controls named in the project agreement. This policy does not claim compliance certification.

Client data

When we process personal data for a client, the client remains responsible for its legal basis. A processing arrangement should be signed before production data is shared. The template clause is: [Link or description of DPA].

Incidents

A suspected personal-data incident should be reported to hello@toptal.info. We will investigate and inform affected parties when the law requires it.

Statutory context

Practices are intended to align with the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023. Confirm applicability with counsel.