Donors and supporters
Donation forms, receipts, recurring contribution instructions, event registrations and optional updates. Separate transaction records from communications preferences and identify which teams and vendors can access them.
For NGOs, trusts, charities and nonprofit teams
DPDP compliance for NGOs and trusts
A community programme can touch many records: a donor receipt, a volunteer roster, a beneficiary case file, an event form and a photo shared with supporters. Preparing for the DPDP Act starts with understanding where digital personal data moves, why the organisation uses it, and who can access it.
- Donors & supporters
- Purpose-led records
- Programmes
- Limit access
- Phased commencement
- 13 May 2027*
*Several core provisions are scheduled to commence on this date under the notification.
Map data by relationship and purpose
Use these examples to start an internal inventory. Actual records and lawful bases depend on your programmes, systems and obligations.
Beneficiaries and applicants
Applications, eligibility notes, referrals, service delivery records and follow-up. Collect only details needed for the stated programme; set role-based access and review how case notes are shared.
Staff and volunteers
Recruitment, onboarding, schedules, training and emergency contacts. Establish who handles each record and when it should be reviewed or deleted, subject to applicable record-keeping duties.
Children and families
Where a programme involves children, assess the Act's child-data requirements and any applicable exemption conditions. Avoid public photos, stories or identifiable case details without a documented, appropriate process.
Campaigns and storytelling
Website analytics, mailing lists, event images and impact stories often have different purposes. Make choices clear and avoid treating participation in a service as permission for unrelated publicity.
Service providers
Donation platforms, cloud storage, email tools, case-management systems and field apps can all be part of the data flow. Record what each provider handles and review access, safeguards and contractual responsibilities.
A practical preparation sequence
Build a repeatable process that fits the way your organisation works.
Inventory the records
List collection points and systems used by fundraising, programmes, HR, communications and field teams.
Write down each purpose
For every use, document why it happens and assess the applicable basis under the Act. Consent is not the only basis provided by the Act.
Improve notices and choices
Explain collection and use in plain language. Keep optional fundraising updates and publicity choices distinct from essential programme communications.
Set access and retention rules
Limit access to people who need it, define review and deletion steps, and account for legal or programme record-keeping requirements.
Prepare to respond
Assign owners for data-principal requests, grievances and incident escalation. Make sure small teams know whom to contact and how to preserve relevant records.
Review vendors and training
Check provider access and safeguards, then train staff and volunteers on safe handling, sharing and incident reporting.
Understand the law and its commencement
The DPDP Act, 2023 and DPDP Rules, 2025 have phased commencement. The notification schedules sections 3–5, sections 6(1)–(8) and 6(10), sections 7–17 and several connected provisions eighteen months after Gazette publication, on 13 May 2027. Other provisions have different commencement dates. Confirm the current position in official notifications as you plan.
Applicability depends on the Act's scope and the organisation's processing of digital personal data. A nonprofit label by itself is not a blanket exemption. The Act also recognises specified legitimate uses alongside consent; map the basis for each purpose rather than assuming every activity follows the same route.
Read the DPDP Act summary, use the compliance checklist, and consult the official DPDP Act text, DPDP Rules, 2025 and commencement notification.
This page is general information, not legal advice. Your obligations may depend on the specific processing, other applicable laws, exemptions and later notifications.
Questions NGOs and trusts ask
Use your own data map and legal context to guide implementation.
Are NGOs automatically exempt from the DPDP Act?
No general exemption follows solely from being a nonprofit. Check whether the Act applies to the processing and whether a specific statutory exemption is relevant.
Does every use of donor or beneficiary data need consent?
No. The Act provides for consent and specified legitimate uses. Identify and document the basis for each purpose; do not assume a basis for one activity automatically covers another.
What if our organisation works with children?
The Act contains additional provisions for children's personal data, including verifiable parental consent and restrictions, subject to exemptions and conditions prescribed or notified under the law. Review the current Rules and your specific activity.
Do paper records fall under the Act?
The Act concerns digital personal data and certain data digitised subsequently, within its stated scope. A paper-only record is not automatically in scope, but digitising, using or storing records electronically can change the analysis.
When should we start preparing?
Use the phased commencement period to inventory systems, clarify purposes, improve processes and train teams. Sections 3–5, sections 6(1)–(8) and 6(10), sections 7–17 and several connected provisions are scheduled for commencement eighteen months after the November 2025 Gazette publication, on 13 May 2027, subject to any later official change.
Make privacy workable for your mission
Start with a focused readiness review, then turn the findings into owners, timelines and clear processes.