Supplemental Information for Individuals Located in India
This supplemental section of Huron’s Privacy Statement is directed at and applies to individuals located in India, and is provided in accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (“DPDPA”), when applicable Indian data protection laws apply.
To the extent of any inconsistency, this section supplements and prevails over other portions of the Privacy Statement for individuals located in India.
Notice at the Time of Collection (DPDPA Requirement)
When Huron collects your Personal Data, Huron will provide you with a notice that is clear, standalone, and understandable, and which enables you to give specific and informed consent.
Such notice will include, at a minimum:
- An itemized description of the Personal Data collected;
- The specific purpose(s) for which such Personal Data is processed;
- Information regarding sharing of Personal Data with Data Processors or third parties, if any;
- The means by which you may withdraw consent, exercise your rights, or make a complaint; and
- Business contact information of a person able to answer questions about the processing of your Personal Data.
International Transfers of Your Personal Data
By using the website or providing Personal Data to Huron, your Personal Data may be transferred to the United States, where Huron is headquartered, or to other Huron locations where we carry out our support activities. Your country’s laws governing data collection and use may differ from those in the United States or other Huron locations.
Transfers of Personal Data outside India will be carried out in accordance with the DPDPA and any requirements or restrictions notified by the Government of India from time to time.
When transferring your Personal Data or Sensitive Personal Data outside India, Huron will only transfer the information when
- you have provided your consent,
- the transfer is permitted under applicable Indian law; or
- or it is necessary to fulfill contractual obligations.
Sensitive Data
We may collect Sensitive Personal Data about you with your consent, which may include:
- Financial and billing information;
- Any detail relating to the above clause as provided to Huron for providing service; and
- Any of the information received under above clauses provided to Huron for processing, stored or processed under lawful contract or otherwise.
Information that is freely available or accessible in public domain shall not be regarded as Sensitive Personal Data.
References to “Sensitive Personal Data” are retained for clarity; however, under the DPDPA, all Personal Data is protected and subject to applicable safeguards and rights.
Your India Privacy Rights
If you are visiting the website from India or where applicable India data protection laws so provide, you may exercise the following rights regarding your Personal Data and Sensitive Personal Data:
- Access. You have the right to obtain from, access, and review the Personal Data and Sensitive Personal Data Huron has collected about you.
- Rectification. You have the right to request the rectification of inaccurate Personal Data and Sensitive Personal Data when feasible.
- Right to refuse or withdraw consent. Please note that in case we ask for your consent to certain collection and use of your Personal Data or Sensitive Personal Data, you are free to refuse to give consent and you can withdraw your consent.
In addition, subject to applicable law, you have the right to:
- Request erasure of Personal Data where the purpose of processing is no longer served;
- Nominate another individual to exercise your rights in the event of death or incapacity; and
- Submit grievance in relation to the processing of your Personal Data.
You may also revoke your consent for processing of your Personal Data. If you wish to object to the use and processing of your Personal Data or withdraw consent to this Privacy Statement, you can contact us in the following ways:
Online Form: Exercising Your Privacy Rights
Email: privacy@hcg.com
Call us: 1-866-229-7219 (toll free) and ask for Huron’s Chief Privacy Officer
Write us:
Huron Consulting Group Inc.
Attn: Chief Privacy Officer
550 W Van Buren St, Chicago IL 60607
The requests above will be considered and responded to in the time-period stated by applicable law. Note, certain Personal Data may be exempt from such requests. We may require additional Personal Data from you to confirm your identity in responding to such requests.
You have the right to lodge a complaint with the supervisory authorities applicable to you and your situation, although we invite you to contact us with any concern as we would be happy to try and resolve it directly. Please contact us at:
Email: privacy@hcg.com
Call us: 1-866-229-7219 (toll free) and ask for Huron’s Chief Privacy Officer
Write us:
Huron Consulting Group Inc.
Attn: Chief Privacy Officer
550 W Van Buren St, Chicago IL 60607
The requests above will be considered and responded to in the time-period stated by applicable law. Note, certain Personal Data may be exempt from such requests. We may require additional Personal Data from you to confirm your identity in responding to such requests.
Complaints and Supervisory Authority
You have the right to lodge a complaint with the supervisory authorities applicable to you and your situation, although we invite you to contact us with any concern as we would be happy to try and resolve it directly.
If your grievance is not resolved, you have the right to approach the Data Protection Board of India, in accordance with the DPDPA.
Please contact us at:
Email: privacy@hcg.com
Call us: 1-866-229-7219 (toll free) and ask for Huron’s Chief Privacy Officer
Write us:
Huron Consulting Group Inc.
Attn: Chief Privacy Officer
550 W Van Buren St, Chicago IL 60607
Lawful Basis for Processing Your Personal Data
We will only collect, use, and disclose your Personal Data or Sensitive Personal Data with your consent or when there is a lawful basis for such activities. Some lawful bases may include:
- Processing on the basis of performance of a contract. Examples of situations in which we process Personal Data as necessary for performance of a contract include e-commerce transactions in which you purchase a service from us.
- Processing on the basis of consent. Examples of processing activities for which we may use consent as its legal basis include: (i) collecting and processing precise location information from your electronic device; (ii) sending promotional emails when consent is required under applicable law; and (iii) processing Personal Data on Huron Services through cookies and similar technologies when consent is required by applicable law.
- Processing for Employee Management. Examples of processing activities for employee management may include activities related to recruitment, hiring, management of employee benefits, and termination of employees.
- Processing because we are under a legal obligation to do so. Examples of situations in which we must processes Personal Data to comply with our legal obligations include: (i) providing your Personal Data to law enforcement agencies and other governmental bodies when required by applicable laws; (ii) retaining business records required to be retained by applicable laws; and (iii) complying with court orders or other legal process.
Processing is limited to the purposes disclosed at the time of collection and will not be undertaken for incompatible purposes.
Retention
We will retain your Personal Data or Sensitive Personal Data for as long as required to fulfill the purpose for its collection and use, or for as long as required by law.
Where the purpose for processing is no longer served and no legal retention obligation applies, Personal Data will be erased or anonymised, subject to minimum retention and log keeping requirements under applicable Indian law.
Regardless of our reason for retaining your Personal Data, we delete all Personal Data in accordance with our routine record keeping policies.
Personal Data Breach Notification
In the event of a Personal Data breach, Huron will notify affected individuals and the Data Protection Board of India, as required under applicable Indian law, including information regarding the nature of the breach, likely consequences, and mitigation measures taken.
