01 · Overview
At a glance
For the "why", read our plain-English guide to the DPDP Act for NGOs. This page is the "what do we do on Monday" companion.
- No nonprofit exemption. Digital personal data is in scope, including paper forms later typed into a spreadsheet.
- Plan for 13 May 2027. The 13 November 2026 Consent Manager date changes little for most NGOs.
- Most NGOs don't need a statutory DPO, but every NGO must publish a contact for data questions.
- Children's data needs verifiable parental consent, and NGOs are not an exempt class.
- Breaches: tell affected people and the Board without delay; detailed Board report within 72 hours.
02 · What the DPDP Rules 2025 require, and when
What the DPDP Rules 2025 require, and when
The Rules were published as G.S.R. 846(E) on 13 November 2025, with different rules commencing on different dates (Khaitan & Co; Mondaq, August 2026).
| Date | What comes into force | What it means for your NGO |
|---|---|---|
| 13 Nov 2025 | Rules 1, 2, 17–21: definitions, Data Protection Board | Nothing to file. The clock started. |
| 13 Nov 2026 | Rule 4: Consent Manager registration (Indian companies, net worth ≥ ₹2 crore) | Optional. You may use a Consent Manager; you don't have to. |
| 13 May 2027 | Rules 3, 5–16, 22, 23: notices, security, breaches, retention, children, rights, SDF duties | The core of this checklist. |
| Not notified | SDF designations; MeitY's January 2026 proposal to cut 18 months to 12 | Neither notified as of early November 2026 (SS Rana). If it is, Phase 3 moves forward. |
An October 2026 Removal of Difficulties Order fixed two words in the Act and moved no dates (India Briefing).
03 · Does your NGO need a Data Protection Officer
Does your NGO need a Data Protection Officer?
Probably not a statutory one. Section 10 requires only Significant Data Fiduciaries to appoint a Data Protection Officer, and none have been designated. Every organisation must still publish the contact details of someone who can answer questions about its processing (Section 8(9), Rule 9).
So name a data protection lead. In our assessment cohorts, what works is one point of contact giving three to four hours a week, plus an executive sponsor for the decisions only leadership can make. Pick someone who can tell a programme head "we stop collecting that field". In a small team, that's rarely the IT person.
04 · Consent management
Consent management: do you need a Consent Manager?
A Consent Manager is a registered intermediary that lets people give, review and withdraw consent across many organisations. Nothing in the Rules makes an NGO use one.
You do need consent management in your own systems: who consented, to which notice version, through which channel (paper, app, WhatsApp, IVR), when, and whether they withdrew. Keep it in the CRM or MIS record it governs, not a side spreadsheet. Withdrawing must be as easy as consenting.
05 · The checklist
The checklist: by function, with owner, evidence and effort
The phases match the 180-day plan in our ZolaShield reports: Phase 1 (days 0–30, by mid-December 2026), Phase 2 (days 30–90, by mid-February 2027), Phase 3 (days 90–180, by 13 May 2027). Effort: S under a day, M one to five days, L over a week across teams.
Governance
| # | Task | Owner | Evidence | Effort | Phase |
|---|---|---|---|---|---|
| G1 | Name a data protection lead and sponsor; publish the contact | CEO / ED | Website contact | S | 1 |
| G2 | Data inventory: every system, form, spreadsheet, drive and WhatsApp group with personal data | Data lead + all teams | Inventory register | L | 1 |
| G3 | Purpose and legal basis (consent or a Section 7 legitimate use) per data category | Data lead | Purpose register | M | 1 |
| G4 | Board-approved policy written from your practice, not a template | Data lead → board | Approved policy | M | 2 |
| G5 | Train staff, volunteers and field partners | HR + data lead | Training log | M | 3 |
Programmes and field teams
| # | Task | Owner | Evidence | Effort | Phase |
|---|---|---|---|---|---|
| P1 | Standalone, plain-language notice at every collection point (Rule 3) | Programme head | Versioned notices | M | 2 |
| P2 | Consent records with notice version and channel; easy withdrawal | Programme + MEL | Consent log in MIS | L | 2 |
| P3 | Children: verifiable parental consent; no tracking or targeted ads (Section 9, Rule 10) | Programme head | SOP + sample records | L | 2 |
| P4 | Legacy data: re-notify, re-consent or delete (Section 5(2)) | Programme + data lead | Decision log | L | 2 |
| P5 | Drop fields you never use (Aadhaar numbers, caste, ID photos) | MEL | Form change log | M | 1 |
| P6 | Sharing with government, CSR funders, partners: minimum data, written agreement, roles agreed | Partnerships | Sharing register | M | 2 |
Fundraising and donors
| # | Task | Owner | Evidence | Effort | Phase |
|---|---|---|---|---|---|
| F1 | Notices on donation pages, gateway forms and events | Fundraising | Updated forms | S | 2 |
| F2 | No beneficiary numbers in fundraising broadcasts without fresh consent | Fundraising head | Purpose register | S | 1 |
| F3 | Retention schedule separating statutory records (80G, FCRA, tax) from marketing data | Finance + CA | Retention schedule | M | 2 |
| F4 | Unsubscribe route in every email and WhatsApp broadcast | Fundraising | Screenshots | S | 2 |
HR and volunteers
| # | Task | Owner | Evidence | Effort | Phase |
|---|---|---|---|---|---|
| H1 | Notices for staff, interns and volunteers (employment is a legitimate use; volunteering may not be) | HR | Notices | S | 2 |
| H2 | Remove access the day someone leaves, volunteers included | HR + IT | Access review log | M | 1 |
| H3 | Restrict health, background-check and bank data to named people | HR | Access list | S | 2 |
IT, vendors and security
| # | Task | Owner | Evidence | Effort | Phase |
|---|---|---|---|---|---|
| T1 | Role-based access, MFA, encryption, tested backups (Rule 6) | IT lead | Controls sheet | L | 2 |
| T2 | Keep access logs for at least one year (Rule 6) | IT | Log settings | M | 2 |
| T3 | Written contract with every processor, AI tools included | IT + finance | Signed agreements | M | 2 |
| T4 | Breach response plan, rehearsed once (Rule 7) | Data lead + IT | Drill report | M | 3 |
| T5 | Apply retention; delete with evidence, vendor copies and backups included | IT + data lead | Deletion log | M | 3 |
| T6 | Answer rights requests and grievances within your published period, 90 days at most (Rule 14); run a mock request | Data lead | SOP + test log | M | 3 |
06 · Score your readiness in five minutes
Score your readiness in five minutes
07 · Where nonprofits get stuck
Where nonprofits get stuck: what our pilot showed
Every organisation in our June 2026 ZolaShield pilot landed in the high-risk band. None were careless. The gaps came from ordinary habits nobody had looked at as a whole.
One education nonprofit working in government schools is typical. Identifiable student and teacher data went to a state education department and implementation partners without data-processing agreements. One assessment platform kept records for 96 months; another app had no retention period and manual deletion. Consent for minors happened in practice but wasn't documented. New software wouldn't have fixed any of it.
Two patterns repeat. First, effort follows your data footprint, not your headcount: when we cost implementation, headcount explains roughly a fifth of the effort, and systems, intake channels, sharing arrangements and user roles explain the rest. Second, "who can reach the data" is bigger than payroll: count volunteers, interns, field partners and vendor support staff.
The risk concentrates in beneficiary management systems and case management software, where sensitive records sit beside everyday programme data. If you're adding AI, see our notes on using Claude responsibly in a nonprofit and AI interviews for research: what staff paste into a tool is still your responsibility.
When you don't need us: a small organisation with one programme, one spreadsheet and no children's data can often work through this list with an hour of a lawyer's time, or start with Project Tech4Dev's free 25-question DPDP self-assessment.
08 · Penalties under the DPDP Act
Penalties under the DPDP Act
The Schedule to the Act sets maximum penalties per instance:
| Breach of | Maximum penalty |
|---|---|
| Reasonable security safeguards (Section 8(5)) | ₹250 crore |
| Breach notification (Section 8(6)) | ₹200 crore |
| Children's data obligations (Section 9) | ₹200 crore |
| Additional SDF obligations (Section 10) | ₹150 crore |
| Any other provision | ₹50 crore |
| Data Principal duties (Section 15) | ₹10,000 |
For most nonprofits, the likelier cost is a funder or state department asking for evidence you can't produce, or lost trust after a beneficiary list leaks.
09 · Common questions
Frequently asked questions
When do the DPDP Rules 2025 apply to NGOs?
Most duties apply from 13 May 2027, 18 months after notification on 13 November 2025. Consent Manager rules start on 13 November 2026, but NGOs needn't use one. A proposal to shorten the timeline to 12 months had not been notified as of November 2026.
Are NGOs, trusts or Section 8 companies exempt from the DPDP Act?
No. There are narrow relaxations, such as for research under conditions or educational institutions monitoring children for safety, but being a nonprofit doesn't qualify by itself.
Does our NGO need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint one, and none have been designated. You must still publish the contact of a person who can answer data questions.
Do we need fresh consent for data we already hold?
Section 5(2) requires a notice to people who consented before commencement, as soon as reasonably practicable. For each legacy dataset, decide whether to re-notify, re-consent or delete.
What do we do if we have a data breach?
Inform affected people and the Board without delay, then send the Board a detailed report within 72 hours. There is no minimum size. Use our 72-hour breach response template.
Is this checklist enough to be compliant?
It tells you what to do and what evidence to keep, not whether a specific practice is lawful in your situation. Use it with a lawyer or a ZolaShield assessment.