The foundation's grant letters ask its 12 partner NGOs for aggregate numbers only, nothing about beneficiaries' personal data. Alongside that, it gave every partner the training, tools and integration support to get ready for the DPDP Act. After six months, 9 of the 12 meet the bar of the readiness assessment. The foundation, with ₹18 crore in grants, did this with Commons Trust. We have not named it.
Why the grant letter matters
Our view: grant reporting often asks for more than it needs, such as lists of beneficiaries with names and phone numbers, sent so the funder can verify or count. Every such list is personal data the funder then holds, and with it come the duties to protect it, erase it when its purpose is served, and report a breach if it leaks.
This foundation's grant letters ask only for aggregates. A partner reports how many women were trained or how many children enrolled, not who they are. The grant letter asks for no personal data. Each partner that decides what it collects and why is a Data Fiduciary for that data (s. 2(i)), alone or with others.
What every partner got
A clause in a grant letter does not make a partner ready. The foundation, with Commons Trust, gave every partner the support to get there:
- A five-part webinar series on what the Act asks of them.
- A readiness assessment, to see where each one stood and to check progress.
- Help with notices, the text people see before they agree.
- Consent management software.
- A Data Principal portal of its own, for its beneficiaries.
- Integration support for three core systems, fully paid by the foundation. Partners pay for any systems beyond those three themselves.
Our view on the three-system cap: most of an NGO's personal data may sit in a few systems, such as a beneficiary database, a field data collection app and its accounts. Paying for those covers much of the data at a known cost per partner, and each partner decides whether the rest is worth paying for.
Where it stands
After six months, 9 of the 12 partners meet the readiness assessment's bar. Three are not there yet.
Most duties under the Act start on 13 May 2027, so we do not call any partner compliant with duties not yet in force. Ready, here, means the partner met the bar of the readiness assessment.
What you can take into your own foundation
We recommend:
- Read your reporting template. Find every field that asks for a name, phone number or ID.
- Ask for aggregates. If you need to verify, check a sample on a field visit rather than collect the full list. Even looking at records is processing, so agree with the partner what you will see and why.
- Set a minimum group size for every breakdown, so no row points to one person.
- Fund the tools, not just the clause: training, an assessment, notices, consent software and a portal.
- Cap what you pay for. Integration for a few core systems per partner covers much of the data at a known cost.
- Track readiness partner by partner, and give the ones still behind a dated plan.
If you are a partner NGO
- Your grant reports carry no beneficiary details. Reporting in aggregates sends numbers, not names.
- You are responsible for that data. If you decide what to collect and why, you are a Data Fiduciary, and you stay responsible for what your vendors do with that data on your behalf (s. 8(1)).
- Ask your funder what support comes with the grant, and which costs stay with you, such as systems beyond the ones the funder pays to integrate.
If you fund NGOs and want to know where your partners stand, take our readiness check or write to us for a first call. Our guide for CSR foundations covers the rest.
This case study explains the law as of 26 October 2026; it is not legal advice.
Questions people ask
Is a CSR foundation responsible for its partners' beneficiary data?
It depends on who decides why and how the data is processed. The Data Fiduciary is whoever, alone or with others, determines the purpose and means of processing (s. 2(i)), and it stays responsible even for processing a Data Processor does on its behalf (s. 8(1)). A partner NGO that runs its own programme and decides what to collect is usually the Data Fiduciary for its beneficiaries. Our view: asking for aggregates only means the foundation receives no personal data, but it does not settle the question by itself. If the grant terms decide what beneficiary data partners collect and how, the foundation may still share the Data Fiduciary role. Leave those choices to each partner.
Do aggregate numbers count as personal data?
The Act covers data about an individual who is identifiable by or in relation to that data (s. 2(t)). A total count of women trained points to nobody. A table broken down so finely that one row is one person, such as one village, one age band and one disability, can point to someone. Our view: set a minimum group size for every breakdown in your reporting template.
Should a foundation pay for its partners' compliance?
The Act does not say. Each Data Fiduciary carries its own duties, and a foundation cannot take them over by paying. What it can do is make those duties cheaper to meet. Our view: shared training, shared tools and paid integration for the few systems that hold most of the data get more partners ready than a grant clause alone.
What happens to partners that are not ready yet?
Most duties under the Act do not apply yet; they start on 13 May 2027. Until then the question is one of risk and grant terms, not penalties. Our view: give each partner a dated plan for its remaining gaps, and check progress at the next grant review.