DPDP Act for NGOs: A Plain-English Guide
Yes. India’s Digital Personal Data Protection Act, 2023 applies to every organisation that handles personal data in digital form, and it has no exemption for NGOs, trusts, societies or Section 8 companies. Most of its duties apply from around May 2027, under the DPDP Rules notified in November 2025.
If your organisation keeps beneficiary records in a field app, a donor list in a spreadsheet or a volunteer group on WhatsApp, the Act covers that data. Paper registers on their own are outside it, but the moment a page is typed into Excel, scanned, photographed onto WhatsApp or uploaded to an MIS, the data is in scope.
Most nonprofits will not fall short through one dramatic failure. They fall short through ordinary habits: a policy nobody follows, a sheet nobody remembers, records nobody deletes. Not negligence. Normality. This guide explains, in plain words, what the law asks of a nonprofit, what is already in force, where organisations usually fall short, and a 180-day plan to get ready.
This is practical guidance, not legal advice. Ask a legal adviser to confirm what applies to your organisation.
The words the law uses, in nonprofit terms
Your nonprofit is almost always the Data Fiduciary for the people it serves. That means the law holds you accountable, even when a vendor or partner does the processing.
| Term in the Act | What it means | In a nonprofit |
|---|---|---|
| Data Principal | The person the data is about. For a child, it includes the parent or lawful guardian. | Participants, students, patients, donors, volunteers, staff |
| Data Fiduciary | Decides why and how personal data is processed | Your organisation |
| Data Processor | Processes data on the Fiduciary’s behalf | Your MIS or CRM provider, a survey tool, an implementation partner entering data for you |
| Consent Manager | A registered Indian company that runs a platform for giving and withdrawing consent | Optional. You do not need to register as one to manage your own consent records. |
| Significant Data Fiduciary | An organisation the government names because of the volume or sensitivity of its data. It has extra duties: a DPO, audits, impact assessments. | No list had been notified as of October 2026 |
| Data Protection Board of India | The digital regulator that hears complaints and sets penalties | Where a participant can complain if your own grievance process fails them |
The Act has no separate category for sensitive data. Health, caste and disability information are ordinary personal data under it, but children’s data and data about persons with disabilities carry their own rules (see below).
What the law asks of a nonprofit
The Act comes down to eight duties. Each one needs a working practice behind it, not just a sentence in a policy.
- Have a lawful reason for every piece of data. That means consent, or one of the “legitimate uses” the Act lists: data someone gave voluntarily for a stated purpose, employment, a medical emergency, a legal duty, and a few State functions. There is no general “legitimate interest” ground.
- Give a clear notice when you collect. It must stand on its own, list the data item by item, state the purpose, and say how to withdraw consent, use rights and complain to the Board. Use the language people actually speak, and read it aloud where literacy is low.
- Make consent real. Free, specific, informed, unconditional and unambiguous, given by a clear action, and as easy to withdraw as to give. You must be able to prove it was given: keep the date, the notice version and who gave it.
- Use data only for its purpose, and collect only what you need. Attendance data does not quietly become a fundraising list.
- Keep it safe. The Rules list minimum safeguards: encryption or masking, access controls, logs and monitoring, backups, security clauses in vendor contracts, and keeping logs for at least a year.
- Report breaches. Tell affected people and the Board without delay, then send the Board a detailed report within 72 hours of becoming aware. There is no minimum size: every breach counts.
- Let data go. Erase personal data once its purpose is served or consent is withdrawn, unless another law (tax, FCRA, a grant agreement) requires you to keep it, and make your vendors erase it too.
- Answer people. Publish a contact for data questions. Give people a way to see, correct or erase their data, nominate someone to act for them, and raise a grievance, answered within 90 days at most.
You also stay responsible for everyone who processes data for you. A vendor’s “compliant” badge covers the vendor; your notices, consent records, retention decisions and replies to requests are still your own work.
Children, persons with disabilities and sensitive programmes
Children’s data is where nonprofits carry the most risk, and where the penalties go up to ₹200 crore. Under the Act, anyone under 18 is a child.
- Verifiable consent from a parent or lawful guardian is needed before you process a child’s data. A student filling in a form is not consent from their parent. You must check that the person consenting is an identifiable adult, using details you already hold or a token from a service such as DigiLocker.
- No tracking, behavioural monitoring or targeted advertising aimed at children, and no processing likely to harm a child’s well-being.
- Persons with disabilities who cannot decide for themselves: consent comes from a lawful guardian, and you must verify the guardian was appointed by a court or a designated authority under the RPwD Act 2016 or the National Trust Act 1999.
The exemptions are narrow. The Rules (Fourth Schedule) relax these duties only for listed organisations and purposes, and only as far as necessary:
| Who or what | What is relaxed | Condition |
|---|---|---|
| Clinics, mental health establishments, healthcare professionals | Parental consent and monitoring rules | Only to provide health services and protect the child’s health |
| Educational institutions | Tracking and behavioural monitoring only | For educational activities or the child’s safety |
| Crèches and child day-care centres | Tracking and behavioural monitoring only | For the child’s safety |
| School or crèche transport | Location tracking only | For safety during travel |
| Specific purposes (any organisation) | As listed | A legal duty in the child’s interest, State benefits, real-time safety, blocking harmful content, confirming a user is not a child |
“Child welfare organisation” is not a listed class, and there is no class for NGOs. A school-run programme is relieved only of the monitoring rules, not of parental consent for everything else. Do not assume your organisation is exempt because it works in health, education or child protection.
Health records, case notes and survivor stories come next after children’s data. The law does not label them sensitive, but exposure does the most harm there, so they deserve the tightest access and the shortest retention you can justify.
When it applies, and what happens if you don’t comply
The Rules come into force in three steps. The Board has existed since November 2025, Consent Manager registration opens around November 2026, and almost every duty in this guide applies from around May 2027.
| Date | What applies |
|---|---|
| Aug 2023 | Parliament passes the DPDP Act, 2023 |
| Nov 2025 | DPDP Rules notified; the Data Protection Board in force |
| Nov 2026 | Consent Manager registration opens (optional for NGOs) |
| May 2027 | Core duties apply: notice, consent, security, breaches, children’s data, retention and rights |
MeitY consulted in early 2026 on shortening the 18-month period to 12 months. No change had been notified as of October 2026, but check before you plan around May 2027. Some partners are not waiting: in March 2026, Uttarakhand’s Samagra Shiksha directorate asked partner NGOs to file DPDP affidavits within 15 days or risk losing their MoUs.
The penalties are maximums per instance. The Board decides the actual amount after an inquiry, weighing how serious and how long the failure was and what you did to fix it.
| Failure | Maximum penalty |
|---|---|
| No reasonable security safeguards, leading to a breach | ₹250 crore |
| Not telling the Board or affected people about a breach | ₹200 crore |
| Breaking the rules on children’s data | ₹200 crore |
| Significant Data Fiduciary duties | ₹150 crore |
| Any other provision of the Act or Rules | ₹50 crore |
| A Data Principal making false or frivolous complaints | ₹10,000 |
Compliance is not really about the penalty, though. It is about being worthy of the trust your communities already place in you.
Where nonprofits fall short today
Every organisation in ZolaShield’s June 2026 pilot scored in the high-risk band. They were well-run organisations with everyday habits. These are the gaps we see most often:
- Children’s data with no consent trail. Collected through apps, forms and paper, without verifiable parental consent records to show for it.
- Records kept for 8 to 10 years, deleted by hand if at all. One education programme kept records for eight years on one platform and had no retention rule on another.
- Sharing without agreements. Identifiable data sent to government departments, implementation partners and vendors with no data processing agreement behind it.
- Personal data on email and WhatsApp. Beneficiary lists exported for a funder visit, volunteer groups where every member sees every number, files on a former employee’s drive.
- Shared tools with no evidence. Heavy use of Google Forms, Sheets and Drive, with access, backup and deletion never written down.
- No route for requests. Consent workflows undocumented, and no clear answer to “who replies if a participant asks to see their record?”
One lesson from the assessments: a generic self-assessment gets “it depends” for an answer. Walking one real programme from first contact to deletion, with field and finance staff in the room, finds the copies leadership has never seen. Expect the first map to look worse than anyone hoped. That is the point of making it.
A 180-day plan to get ready
Start with an inventory, not a policy. A full readiness journey usually takes four to six months, so a nonprofit that starts by December 2026 can be ready before May 2027. Work from the riskiest data outwards, and keep evidence at each step that a board member or auditor could inspect.
Days 0 to 30: see what you hold
- Name one internal owner for data protection, with leadership sign-off.
- Map every place personal data lives: field apps, spreadsheets, paper registers that get typed up, WhatsApp groups, email, personal drives. Ask each team to show, not describe, where they keep names and phone numbers.
- Build a register with one row per activity (such as learner enrolment or donation receipts), not per system: whose data, what data, why, who can see it, where it goes, and when it should be deleted.
- Flag children’s data, then health, case and survivor records, as the first to fix.
- Close the obvious holes: shared logins, accounts of staff who have left, beneficiary lists sitting on email and WhatsApp.
Days 30 to 90: fix the foundations
- Write one plain-language purpose for each activity, and test every form field against it. Drop the fields you don’t need.
- Draft notices in the languages participants speak. Store each consent with its date, notice version and who gave it, and keep photo and story consent separate from consent for services.
- Set up verifiable parental consent for every programme that works with under-18s.
- Give field workers their own caseload, programme managers their programme and funders aggregates only. Turn on two-step login and encryption, and mask identifiers such as Aadhaar unless a scheme requires them.
- Sign data processing agreements with vendors, implementation partners and anyone else who handles data for you.
- Publish a contact for data questions on your website.
Days 90 to 180: make it routine
- Set a retention rule for each data category, tied to its purpose and to any legal or grant obligation, and schedule deletion or anonymisation.
- Rehearse a rights request (a participant asks to see or correct their record) and a breach (who tells whom, within 72 hours).
- Train staff and field teams on the everyday habits: what to collect, where to keep it, what never goes on WhatsApp.
- Review the register every quarter and whenever a new programme, form or vendor starts. Take a short summary to leadership twice a year.
Systems can hold the register, the consent records and the deletion schedule. Interpreting the law, accepting a residual risk and deciding what to tell people after a breach stay with named leaders and their legal adviser.
Sharing data with funders, CSR partners, government and vendors
You stay responsible for data you share. That does not mean you cannot share; it means each flow needs a reason, a limit and an agreement.
| Who you share with | What to do |
|---|---|
| Funders and CSR partners | Send aggregates or anonymised data by default. Share names only where the notice or consent covers it, and only the fields the report needs. A funder that wants the whole database should be asked what decision each field supports. A funder that uses beneficiary data for its own purposes may be a Data Fiduciary in its own right. |
| Government departments and schemes | Expect the same questions your partners now ask: parental consent, safeguards, third-party sharing, deletion at project end. Keep the affidavits, MoU clauses and data-sharing terms on file. |
| Implementation partners | A partner entering data for your programme is usually your processor. Put it in writing: what they may do with the data, security, breach reporting to you, and deletion when the project ends. |
| Software vendors (Zoho, Google, WhatsApp, Kobo and others) | The vendor is a processor; you remain the Fiduciary. Check where data is hosted, who can access it and how to delete it, and make sure your contract includes security terms. |
More funders and CSR partners now ask grantees how they protect the personal data of the people they serve. A current data map and a plan with owners and dates is a better answer than a policy document.
Two cases need a legal adviser’s view: donor details filed for 80G and FCRA returns (likely covered by the legal-obligation grounds), and volunteers, who are not employees, so the employment ground probably does not cover them.
Questions nonprofits ask about DPDP
Are small NGOs exempt from the DPDP Act? No. The Act has no exemption for nonprofits, trusts, societies or Section 8 companies of any size. Size changes how much work compliance takes, not whether the law applies.
Is the DPDP Act already in force? Partly. The Data Protection Board has existed since November 2025 and Consent Manager registration opens around November 2026. Notice, consent, security, breach reporting, children’s data, retention and rights apply from around May 2027.
Does the DPDP Act cover paper records? Paper alone is outside the Act. Once paper data is typed into a spreadsheet, scanned, photographed or entered into an app, it is digital personal data and the Act applies.
Does every NGO need a Data Protection Officer? No. Only organisations named as Significant Data Fiduciaries must appoint a DPO. Every other organisation must publish a contact person who can answer questions about its data.
Do we need consent for data we collected before the Act? The Act requires a fresh notice for data processed on consent given before it came into force, as soon as reasonably practicable. Plan to re-notify existing participants, starting with children’s and health records.
Do education or health NGOs need parental consent? Usually, yes. The exemptions cover named classes such as clinics, educational institutions and crèches, and only for listed purposes like health services or a child’s safety. Child welfare organisations are not a listed class.
Is our software vendor responsible for DPDP compliance? No. Zoho, Google, WhatsApp and other vendors are processors. Your organisation remains the Data Fiduciary, responsible for notices, consent, retention and answering requests.
How EdZola can help
The only difference between the prepared and the exposed is who chose to look first. ZolaShield, our DPDP readiness assessment for nonprofits, is built to make that first look quick.
- Assess. A short voice AI interview asks your team how data moves through your systems: field apps, paper forms, spreadsheets, WhatsApp and partners. It asks how you handle data, never for the data itself. Within two weeks you get a map of every system and flow, a scored risk report and a prioritised 180-day plan with owners and effort for each fix. From ₹10,000, by team size.
- Comply. We work with your team and vendors to put the plan in place: notices and consent across web, WhatsApp, field and paper, a way to answer rights requests, plain-language policies and training.
- Sustain. An annual re-assessment, regulatory updates turned into actions, and refresher training.
The next ZolaShield Assess cohort starts on 16 November 2026. Book your assessment to join it. If you’re not yet sure where data protection sits among your other system needs, the free nonprofit technology assessment takes 10 minutes.
Sources
- PIB backgrounder on the DPDP Rules, 2025 (17 November 2025)
- DPDP Rules, 2025, full text (G.S.R. 846(E))
- SCC Online: MeitY notifies the DPDP Rules, 2025 (14 November 2025)
- PRS Legislative Research: DPDP Bill, 2023
- Amlegals: penalties under the DPDP Act
- MirvoLegal: DPDP Rules compliance timeline (20 September 2026)
- dpdprules.org: the 18-to-12-month proposal
- MediaNama: Uttarakhand asks Samagra Shiksha NGOs to comply with DPDP (24 March 2026)
- IDR: Answering key questions about India’s data protection regulations (25 August 2026)
- IDR: What does the DPDP Act mean for philanthropy in India? (13 October 2023)
- Pacta: the DPDP Rules and the social sector, part I
- India Briefing: DPDP Removal of Difficulties Order, 2026