Video KYC (V-CIP)

In the context of the DPDP Act, Video KYC (V-CIP) involves the collection and processing of personal data, including identity information, through a video-based verification process.

Organizations using Video KYC must ensure that personal data collected during the verification process is processed responsibly, securely, and only for the intended purpose. This includes maintaining transparency with individuals, implementing appropriate security safeguards, managing consent where applicable, and ensuring that data handling practices align with DPDP obligations.

Video KYC processes often involve multiple data elements such as identity details, video recordings, documents, and verification information. Organizations need appropriate controls to manage data storage, access, retention, and sharing throughout the lifecycle of this information.

In practice, gaps emerge when:

• Organizations collect more personal data than required during verification.
• Video recordings are retained without clear retention policies.
• Access to KYC data is not appropriately restricted.
• Third-party KYC service providers are not adequately governed.
• Individuals lack clarity about how their verification data is used.

Organizations address these challenges by implementing data minimisation, access controls, retention policies, consent mechanisms, vendor governance, and secure storage practices. Within Privy, capabilities such as consent management, data discovery, data mapping, and privacy workflows help organizations manage personal data involved in identity verification processes.