# DPDP for CSR foundations: what you owe for data your implementing partners collect

> A CSR foundation that designs a programme, specifies what data an implementing partner collects, or receives named beneficiary records is very likely a Data Fiduciary for that programme alongside the partner, and each remains responsible for its own compliance whatever the grant agreement says (s. 2(i), 8(1)). The foundation's main controls are receiving counts instead of names, tiering partners by risk, and a data annex that fixes what is shared, how withdrawals and breaches travel between the two, and when the foundation erases its copy. Scholarships, monitoring visits and photographs are where foundations hold the most personal data directly; most duties start on 13 May 2027.

Source: https://dpdp.commons.inc/dpdp-for-csr-foundations · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

If your foundation designs a programme, decides what data an implementing partner collects, or receives named beneficiary records, it is very likely a Data Fiduciary for that programme alongside the partner, because the definition covers anyone who decides why and how data is processed "alone or in conjunction with other persons" (s. 2(i)). Each fiduciary is responsible for its own compliance whatever the grant agreement says (s. 8(1)), so a contract can divide the work but cannot move the liability. Most duties start on 13 May 2027, with penalties of up to ₹250 crore for failing to keep reasonable security safeguards (Schedule, item 1). The cheapest control a funder has is to receive less: counts for reporting, and named data only where a specific purpose needs it.

Like the Act (s. 2(y)), we say "she" and "her" for every person.

**Jump to what you need:**

- **CSR heads and programme teams:** [Your role](#funder-fiduciary-or-processor-a-test-for-each-programme), [What to receive](#what-data-to-receive-purpose-by-purpose), [Monitoring visits](#monitoring-visits-photographs-and-stories).
- **Legal and compliance:** [Partner tiers and questionnaire](#tier-your-partners-then-ask-the-right-questions), [The data annex](#the-funder-partner-data-annex), [Where the law is unclear](#where-the-law-is-unclear-for-funders).
- **Trustees, CSR committees and listed companies:** [Board reporting](#what-the-board-or-csr-committee-should-see), [Listed companies](#if-the-csr-company-is-listed).

## Funder, fiduciary or processor: a test for each programme

The Act asks one question: who determines the purpose and means of processing (s. 2(i))? A Data Processor processes "on behalf of" a fiduciary and decides neither (s. 2(k)). Neither definition mentions money, so writing the cheque settles nothing. What you decide, specify and receive does.

Answer these for each programme separately:

| Question | If yes |
|---|---|
| Did you set the eligibility criteria, or select or approve named individuals? | You decide the purpose for those people. Fiduciary. |
| Did you specify the data fields, forms or app the partner must use? | You decide the means. Fiduciary, very likely jointly with the partner. |
| Do you receive names, phone numbers, photos, IDs or case details? | You process personal data, so you need a role and a basis of your own. |
| Do you run the MIS, portal or app the partner enters data into? | Processor if you only host it for the partner; fiduciary for any use you make of the data for yourself. |
| Do you only fund, and receive counts that identify nobody? | You may hold no personal data for that programme at all (s. 2(t)). Check small numbers first. |

Typical arrangements, with our reading of the roles:

| Arrangement | Roles |
|---|---|
| Foundation runs its own scholarship portal and selects scholars | Foundation is the fiduciary; the portal vendor and any screening agency are its processors. |
| NGO designs and runs its own programme with an untied grant and reports counts | NGO is the fiduciary; the foundation holds no beneficiary data. |
| Foundation co-designs the programme, sets the fields and receives monthly named lists | Both are fiduciaries for the programme. |
| Foundation gives partners a free MIS and looks at nothing inside it | Foundation is each partner's processor and needs a contract with each (s. 8(2)). |
| Foundation gives partners an MIS and tracks progress beneficiary by beneficiary | Fiduciary for that monitoring use, processor for the rest. |
| Foundation funds an edtech app or learning platform deployed in government schools | The school or department is the fiduciary for the school's own use, and the vendor is usually its processor. If the foundation contracts the vendor or receives child-level usage data, it is a fiduciary too. The school's Fourth Schedule exemption covers only its own tracking and monitoring for educational activities and children's safety ([row A3](/dpdp-childrens-data#the-fourth-schedule-row-by-row)); everything else needs verified parental consent unless another row applies, such as B1 for duties under law. |
| Foundation commissions an impact assessment by an independent agency | Usually the foundation is the fiduciary and the agency its processor. An agency that designs the study and publishes under its own name may be a fiduciary too. |
| Programme run with a district administration under an MoU | The department relies on the State's grounds (s. 7(b), 7(c)); the foundation and NGO usually act on its instructions as processors. |

The CSR company and its foundation are separate fiduciaries, since the Act has no group exemption. Programme data passing from the foundation to the company's CSR committee, communications team or HR is a disclosure between fiduciaries and needs a basis the beneficiaries were told about. See [DPDP for corporates](/dpdp-for-corporates) for the group view.

## Joint fiduciaries: what the funder must hold

Where you and a partner are both fiduciaries, each carries all of its own duties, and the agreement between you decides who does each task. The general model for joint fiduciaries, with a task-by-task allocation, is in [our processor and joint-fiduciary guide](/dpdp-processor-contracts). The funder's side is narrower: the partner usually does the work, and you hold the evidence that it was done.

| Duty | What the foundation should hold |
|---|---|
| Notice and consent (s. 5, 6, Rule 3) | The notice text and version, naming the foundation; access to consent records on request, because each fiduciary relying on consent bears the burden of proving it (s. 6(10)) |
| Parent verification for children (s. 9(1), Rule 10) | The method used and the share of child records verified |
| Rights requests (s. 11–14) | A log of requests it passed to the partner, and closure dates. Where she consented to each of you (for example through one notice naming both), she can ask either of you whom her data was shared with (s. 11(1)(b)), subject to the law-enforcement exception in s. 11(2). |
| Withdrawal (s. 6(4), 6(6)) | Confirmation that it stopped and erased its own copy |
| Security (s. 8(5), Rule 6) | The partner's questionnaire answers and gap plan |
| Retention (s. 8(7)) | Written confirmation of its own erasure at grant close |

Your own basis for named data is usually the partner's consent request, naming the foundation and what it receives for which purpose (s. 6(1), Rule 3(b)). A line saying "data may be shared with funders" is unlikely to be specific enough. Our view is that the partner's 7(a) ground does not carry over to a funder she never dealt with ([legitimate uses](/dpdp-legitimate-uses)), and the State's grounds in 7(b) and 7(c) are not yours. A properly run evaluation may fall within the research exemption (s. 17(2)(b), Rule 16); monitoring that leads you to drop a beneficiary does not. Data received under past grants needs the triage in [the data you already hold](/dpdp-existing-data).

## What data to receive, purpose by purpose

Foundations often ask for named data out of habit: the template has a name column, or a dashboard looks better with drill-down. Every named record you hold is one you must secure, list in reply to access requests, and erase on time. Our position: start each programme from counts and add named data only where a purpose below needs it.

| Purpose | Ask for | Named data? |
|---|---|---|
| Release of a tranche | Counts by activity and location; partner's certificate | No |
| Verifying that beneficiaries exist | Your auditor or staff check a random sample on the partner's screen or at its office | Viewed, not received |
| Utilisation and board certification | Financial statements and counts | No |
| Impact assessment | Data goes from partner to agency under a processing contract; you receive the report | The agency only |
| Board, CSR committee and annual report | Aggregates by programme, district, gender and age band | No |
| Website, social media and donor stories | A few stories with separate consent for that use; verified parental consent for children | Yes, with specific consent |
| Scholarship disbursement you make directly | Payee and account details for selected scholars, at the point of payment | Yes |
| Escalated grievances | The facts of the case concerned | Case by case |

Aggregates can still identify people: one girl with a disability in a village of 300 is identifiable from a table. We recommend suppressing any count below 5 or 10 before reports leave the partner; the Act sets no threshold. Pseudonymised lists, where the partner keeps the key, reduce risk but remain personal data in our view (see the unclear-law section).

## Tier your partners, then ask the right questions

Not every partner needs the same scrutiny. Our recommended rule:

| Tier | A partner is in this tier if | What you do |
|---|---|---|
| 1 | It sends you named data, works with children, or holds programme data on more than 10,000 people | Full questionnaire, full annex, one review a year, funded gap plan |
| 2 | It holds personal data for the programme but meets none of the Tier 1 tests | Questions 1, 2, 4, 7, 9 and 12; the annex without Annex B detail; desk review |
| 3 | It holds no personal data for the programme, or you receive counts only and the programme involves no children | A one-page undertaking on security, breach contact and no onward sharing |

The 10,000 figure is ours; pick the number that splits your portfolio sensibly.

### A cover note partners can forward

*Illustrative.*

> Subject: Data protection in our partnership, before 13 May 2027
>
> Dear [Partner lead],
>
> From 13 May 2027 India's Digital Personal Data Protection Act will apply to the personal data both our organisations hold about the people in [Programme]. Because we [set the programme's indicators / receive some named information], the law treats us as jointly responsible with you for parts of it.
>
> We would like to agree, by [date], what personal data you share with us, how you tell participants about it, and how we tell each other quickly if something goes wrong. Attached are a short questionnaire and a draft data annex to our grant agreement. There are no wrong answers: where something is not yet in place, tell us, and we will discuss what support we can fund.
>
> [Name], who leads this for us, will call you in the next two weeks. You can reach her on [phone, email].
>
> With thanks, [Name, role, foundation]

### The questionnaire

*Illustrative.* Keep the answers. If a partner's breach becomes your problem, they show you chose and supervised it with care. The last column is our suggestion of what a foundation can fund.

| # | Question | Good answer | Red flag | What we will fund |
|---|---|---|---|---|
| 1 | Who is accountable for personal data, and how do we reach her? | A named person and a deputy | "The programme team" | Part of a staff member's time |
| 2 | What personal data do you collect for this programme, field by field? | A list matching the form | "Whatever the field team needs" | A half-day mapping session |
| 3 | What is your basis for each purpose: consent, or a named clause of section 7? | Purpose by purpose | One consent for everything | Legal review of the form |
| 4 | Show us the notice. In which languages, and how is it delivered? | English or a Scheduled language such as Hindi, with dialect audio where needed (s. 5(3)) | An English form for people who cannot read English | Translation and audio recording |
| 5 | Does the notice name our foundation and say what we receive? | Yes, with the purpose | No | Revision of the notice |
| 6 | Could you produce one named person's consent record within a day? | App or register entry with notice version, channel, collector and time | Unindexed paper forms | A consent module or register |
| 7 | How do you check a parent's identity and age before processing a child's data? | A method from [our children's guide](/dpdp-childrens-data), recorded per child | "Parents sign the form" | Facilitator training |
| 8 | Which vendors hold the data, and do you have contracts with them? | A short list, each with terms (s. 8(2)) | Free tools, no terms | Contract review |
| 9 | Is any beneficiary data on WhatsApp groups or staff personal phones? | No, or a dated plan to stop | Yes, no plan | Devices or an app to replace the groups |
| 10 | Who can open the full database, and how do you remove leavers? | Named roles; access removed on exit | Shared logins | Individual accounts, a password manager |
| 11 | Is the data scrambled (encrypted) on phones, laptops and the database, and do you keep a record of who opened it for at least a year? | Yes (Rule 6(1)(a), (c), (e)) | "Not sure" | Device encryption and logging setup |
| 12 | If data leaked tomorrow, who would call us, and how fast? | A one-page plan with a named caller | No plan | A drill |
| 13 | How long do you keep each data set, and how do you erase it? | A retention schedule and an erasure record | "We keep everything" | A retention workshop |
| 14 | How can a beneficiary ask what you hold, correct it, or complain? | A published route, with grievances answered within a stated period of at most 90 days (Rule 14(3)) | No route | A helpline number |
| 15 | Do you pass data to anyone else: sub-grantees, government, researchers? | Listed, with terms | Not known | — |
| 16 | How do you take consent for photos and stories? | A separate consent; parental for children | Assumed | Consent cards or app step |

The partner-side version of this work is in [DPDP for NGOs](/dpdp-for-nonprofits).

## The funder–partner data annex

These clauses and annexes are illustrative and need adapting by your lawyer. They assume both parties are fiduciaries and the foundation receives a limited set of named data. For a partner acting purely as your processor, use the processing contract in [our processor guide](/dpdp-processor-contracts) instead.

1. **Roles.** "For the Programme, [Partner] and [Foundation] each determine purposes and means of processing of the Programme Data listed in Annex A and are each a Data Fiduciary under the Digital Personal Data Protection Act, 2023. This annex allocates tasks between the Parties and does not limit either Party's obligations under law."
2. **Data shared.** "[Partner] shall share with [Foundation] only the data in Annex A, for the purposes, at the frequency and through the channel stated there. All other reporting shall be aggregate, with counts below [5] suppressed."
3. **Notice and consent.** "[Partner] shall give each beneficiary a notice meeting Rule 3 of the DPDP Rules, 2025, available in English and [Scheduled language], naming [Foundation] and the purposes in Annex A, and shall record consent for each purpose that relies on it. [Partner] shall produce the record for any named beneficiary within [2] working days of a request."
4. **Children.** "Before processing any personal data of a beneficiary under eighteen, [Partner] shall obtain verifiable consent of a parent or lawful guardian under Rule 10 and record how the parent's identity and age were checked. No photograph, video or story identifying a child shall be shared with [Foundation] without that consent for that use."
5. **Withdrawal and objection.** "Each Party shall tell the other within [5] working days of any withdrawal, objection or erasure request affecting data the other holds. The receiving Party shall stop processing and erase its copy within [10] working days, unless law requires retention, and confirm in writing."
6. **Requests and grievances.** "A Party that receives a request or grievance about Programme Data shall pass it to [Partner] within [3] working days. [Partner] shall respond within its published period, not exceeding [30] days; [Foundation] shall provide what it holds within [5] working days of being asked."
7. **Security.** "Each Party shall maintain safeguards at least equal to Rule 6(1): encryption or masking, access control, access logs kept for one year, backups, and contracts with its processors. Programme Data shall not be kept on personal devices or shared on messaging groups."
8. **Breach.** "A Party that becomes aware of a personal data breach affecting Programme Data shall tell the other by telephone to the contact in Annex B within [12] hours, and in writing within [24] hours. The Parties shall agree the text of intimations to beneficiaries affected in both Parties' hands. Nothing in this clause delays either Party's intimation to the Board."
9. **Processors and recipients.** "Neither Party shall disclose Programme Data except to the recipients in Annex B, under written terms no less protective than this annex."
10. **Other uses.** "Neither Party shall use Programme Data for fundraising, marketing, recruitment, research outside this Programme, or training artificial intelligence models, without the beneficiaries' specific consent and the other Party's written agreement."
11. **Retention.** "[Foundation] shall erase named Programme Data [6] months after the final report is accepted, and [Partner] at the end of the periods in its retention schedule, each subject to any retention required by law, including the one-year minimum under Rule 8(3) for the Seventh Schedule purposes, and each shall confirm erasure in writing."
12. **Review and audit.** "[Partner] shall answer [Foundation]'s questionnaire annually. [Foundation] may carry out one review a year, on site or remotely, on [10] working days' notice, and a further review after any breach. [Foundation] bears its own costs and keeps what it sees confidential."
13. **Liability.** "Each Party is responsible for its own compliance. Each shall indemnify the other against third-party claims, costs and, to the extent the law permits, penalties, to the extent caused by its breach of this annex, subject to [the liability cap in the grant agreement]."
14. **Termination and return.** "On termination or expiry of the grant, [Partner] shall, at [Foundation]'s choice, return or erase any data [Foundation] supplied to it, and [Foundation] shall erase named Programme Data under clause 11. Clauses 5 to 8, 11 and 13 survive for as long as either Party holds Programme Data."
15. **Cost.** "The Programme budget includes [₹ amount to be agreed] for data protection work by [Partner]."

Clause 13 cannot shift what the law puts on each party (s. 8(1)); an indemnity moves money, and many lawyers doubt that a regulatory penalty can be indemnified at all.

### Annex A: data shared with the foundation (illustrative)

| Data set | Fields | Purpose | Frequency | Channel | Foundation keeps for |
|---|---|---|---|---|---|
| Progress report | Counts by village, gender and age band; cells under 5 suppressed | Tranche release, board and annual reporting | Monthly | MIS export to programme mailbox | Life of grant (no personal data) |
| Verification sample | Beneficiary ID, name, village, enrolment date, attendance | Confirming that a random sample of 20 beneficiaries exists and is served | Quarterly | Viewed on [Partner]'s screen during a call or visit; nothing transferred | Only the list of IDs checked |
| Stories | First name, district, photograph, quote, consent reference | Annual report, website and social media | Up to 6 a year | Shared album with named access | Until consent is withdrawn, or 3 years |
| Escalated grievances | Case ID, summary, status | Oversight of complaints raised with [Foundation] | As they arise | Phone, then encrypted email | 12 months after closure |

### Annex B: recipients and contacts (illustrative)

| Recipient | Role | Data | Location | Terms |
|---|---|---|---|---|
| [MIS vendor] | [Partner]'s processor | All programme data | India | Processing contract dated [ ] |
| [SMS gateway] | [Partner]'s processor | Names, mobile numbers | India | Processing contract dated [ ] |
| [Cloud drive provider] | [Foundation]'s processor | Annex A data sets | [Country] | Provider terms, reviewed [date] |
| [Impact assessment agency] | [Foundation]'s processor | Survey data from [Partner] | India | Processing contract dated [ ] |
| Breach contacts | — | — | — | [Partner]: [name, mobile]; [Foundation]: [name, mobile]; tested on [date] |

The partner-side annex in [our NGO guide](/dpdp-for-nonprofits) is a subset of this one.

## Monitoring visits, photographs and stories

Visits by foundation staff, company volunteers and senior leaders produce personal data nobody planned for: photos on personal phones, names in notebooks, videos posted from the bus. Each is processing by the foundation or the company, and the partner's consent covers none of it unless its notice named that use.

Rules we recommend for every visit:

- **Brief visitors beforehand.** One page: what they may record, on which device, and where it goes.
- **Photograph only people the partner confirms have consented** to the foundation's use. For children, the parent's consent, verified under Rule 10, must come before the photograph (s. 9(1)), and the well-being duty applies on top (s. 9(2)). [Our NGO guide](/dpdp-for-nonprofits) explains how a picture can identify a child without her name.
- **Use a foundation device or a shared album with named access.** Photos on a personal phone are moved and deleted within 48 hours.
- **Give withdrawal a route.** A person who objects to a photo later tells the partner, the partner tells you, and you remove it from your channels. Printed reports cannot be recalled, so say so in the consent request.
- **Case notes from visits** go into the programme's systems. A visitor's notebook or inbox is the wrong place for them.

Give each image in your media library a consent reference and an expiry date. [Consent in the field](/dpdp-field-consent) has scripts for photo and story consent.

## Scholarship programmes you run yourself

A scholarship is where a foundation is plainly the fiduciary: it sets criteria, collects applications, picks winners and pays money. It also collects identity documents, income certificates, marksheets, bank details and sometimes caste or disability certificates, mostly from applicants who will not be selected.

- **Collect in stages.** The minimum at application; documents only from the shortlist. Consent is limited to the data necessary for the purpose (s. 6(1)).
- **Notice before the form,** itemising data and each purpose and saying how long you keep rejected applications (Rule 3(b)), in English and the Scheduled languages applicants use (s. 5(3)). [Our notice guide](/dpdp-consent-notice) has a web-form example.
- **Applicants under eighteen are children,** including many first-year college students. Verify a parent before processing (s. 9(1), Rule 10); see [our children's guide](/dpdp-childrens-data).
- **Get decision data right.** Data used to decide about her must be complete and accurate (s. 8(3)); let applicants correct errors before selection closes.
- **Limit reviewers** to their assigned applications, through the portal, with access logged (Rule 6(1)(b), (c)).
- **Erase rejected applications** after the appeal window, keeping anonymised counts. Rule 8(3) separately requires data and logs to be kept for at least a year, for the Seventh Schedule purposes only.
- **Aadhaar has its own law.** The Aadhaar Act and UIDAI's regulations apply alongside the DPDP Act; ask counsel before collecting numbers or copies.
- **Contract the portal vendor** as your processor (s. 8(2)).

## When something goes wrong: breaches and requests

A breach can start anywhere: the partner's field tablet, the evaluation agency's laptop, the shared drive holding last quarter's lists. The fiduciary whose processing it was must tell the Board and each affected person (s. 8(6), Rule 7), and the Board's 72-hour detailed report runs from when each fiduciary becomes aware (Rule 7(2)(b)). A partner's delay does not shorten your 72 hours, but it delays the intimations you must give "without delay" to the Board and to each affected person (Rule 7(1), 7(2)(a)). Whether the Board would treat what the partner knew as known to you is untested. That is why clause 8 sets hours and Annex B names tested phone numbers. Where both of you hold the affected data, our view is that both should intimate the Board, and the people affected should receive one agreed message naming both organisations and one contact. Route every rights request reaching the foundation or the company's CSR inbox to one person and log it. [Our breach guide](/dpdp-breach-response) has the full sequence.

## If the CSR company is listed

A listed parent adds reporting touchpoints. We describe them at a general level; confirm the current requirements with your company secretary.

- **CSR reporting.** The Companies Act, 2013 (s. 135) and the Companies (CSR Policy) Rules, 2014, as amended, including in 2021 and in 2022 (G.S.R. 715(E), 20 September 2022), require among other things the registration of implementing agencies (Form CSR-1), board satisfaction that funds were used as approved, certified by the CFO (or the person responsible for financial management), an annual report on CSR in the board's report, and, for companies with an average CSR obligation of ₹10 crore or more in the three preceding financial years, an independent agency's assessment of projects with outlays of ₹1 crore or more completed at least one year earlier ([SCC Online](https://www.scconline.com/blog/post/2021/02/06/companies-corporate-social-responsibility-policy-amendment-rules-2021/)). As we read them, none of these requires the company to hold beneficiaries' names. The impact assessment agency does handle personal data, so contract it as a processor.
- **Sustainability and risk reporting.** The top 1,000 listed entities by market capitalisation report on data privacy and cyber security in their Business Responsibility and Sustainability Report (SEBI LODR reg. 34(2)(f)), and the risk management committee's role includes cyber security (reg. 21(4)), as of 25 October 2026. Decide whether the foundation's data, and its partners' breaches, fall within what the company reports, and give the risk committee the board measures below.
- **Before 13 May 2027, the SPDI Rules.** Until s. 44(2) deletes IT Act s. 43A on 13 May 2027, the 2011 SPDI Rules bind body corporates. Bank account details are sensitive personal data under them, so a company-form foundation collecting scholarship bank details today needs the SPDI consent and security practices now. Whether a trust-form foundation is a body corporate for this purpose is arguable; ask counsel.

## What the board or CSR committee should see

Trustees and CSR committees should ask for evidence. A one-page quarterly report is enough:

| Measure | Why it matters |
|---|---|
| Programmes with roles decided and a signed annex, out of all active programmes | Each programme has a basis and terms |
| Programmes where the foundation receives named data, with the purpose for each | Minimisation is working |
| Tier 1 partners reviewed this year, and open gaps by severity | Partner oversight |
| Share of child beneficiaries with a recorded parent-verification method | Children carry the ₹200 crore penalty item (Schedule, item 3) |
| Requests and grievances received, and any answered late | Grievances must be answered within the published period, at most 90 days (Rule 14(3)) |
| Breaches, near misses and the date of the last drill | Mitigation speed affects any penalty (s. 33(2)(e)) |
| Named data erased at grant close | Retention is real |

## Where the law is unclear for funders

**Is a foundation that co-designs a programme a fiduciary if it receives only counts?** Probably not for the beneficiaries' data. *Why:* the duties attach to processing personal data, and a funder that holds none processes none, even if it shaped the form. *Would change if:* the Board treats specifying fields as determining the means for data held by someone else. *Confidence:* medium.

**Is one notice from the partner, naming the foundation, enough for both?** Yes, if it meets Rule 3 for each purpose and names each fiduciary. *Why:* the Act requires a specific, informed notice and consent (s. 5, 6(1)) and does not require one from each fiduciary. *Would change if:* the Board reads "given by the Data Fiduciary" in s. 5(1) as requiring each to give its own. *Confidence:* medium.

**Is pseudonymised data personal data in the foundation's hands?** Treat it as personal data. *Why:* data is personal if she is identifiable "by or in relation to" it (s. 2(t)), and a partner holding the key can identify her, often at your request. *Would change if:* the Board or government sets a de-identification standard. *Confidence:* medium.

**Must both fiduciaries report the same breach?** Yes, each for its own processing. *Why:* s. 8(6) puts the duty on "the Data Fiduciary", with no joint route. *Would change if:* the Board accepts a single joint intimation. *Confidence:* medium.

**When a child scholar turns eighteen, does the parent's consent still cover her?** Take her own consent at eighteen for anything that continues. *Why:* the parent consents because she is a child (s. 9(1)); the Act is silent on what happens at eighteen. *Would change if:* the Board or rules address the transition. *Confidence:* low.

## Who does what before 13 May 2027

| Task | Responsible | Accountable | Consulted | Informed | Finish by |
|---|---|---|---|---|---|
| List programmes, partners and the personal data reaching the foundation | Programme officers | Head of CSR | Partners | CSR committee | 30 Nov 2026 |
| Decide roles per programme; cut reporting to counts | Head of CSR | CSR committee chair | Legal counsel | Partners | 31 Dec 2026 |
| Adopt the annex in the grant template | Legal counsel | Head of CSR | Finance | Programme officers | 31 Jan 2027 |
| Fix the scholarship portal and its vendor contract | Scholarship lead | Head of CSR | IT, vendor | CSR committee | 28 Feb 2027 |
| Tier partners; send cover note and questionnaire | Programme officers | Head of CSR | Partners | — | 28 Feb 2027 |
| Sign annexes and funded gap plans with Tier 1 partners | Programme officers | Head of CSR | Legal, finance | CSR committee | 31 Mar 2027 |
| Brief staff and volunteers on visits and photos; clean the media library | Communications lead | Head of CSR | Partners | Company volunteering team | 31 Mar 2027 |
| Run a breach drill with one Tier 1 partner; first board report | Accountable owner | Head of CSR | Partner | CSR committee | 30 Apr 2027 |

If the time left is shorter than this table assumes, work in risk order: first stop receiving named data you do not need; then sign annexes with Tier 1 partners; then fix the systems you run yourself. Everything else can follow in the first quarter after 13 May 2027. The calendar for the whole Act is in [DPDP deadlines](/dpdp-timeline).

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023) and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), as published in the Gazette of India. Companies Act and listed-company points are summarised at a general level from the linked report and should be confirmed with your company secretary. Events after November 2025 were last checked on 25 October 2026. Statements marked as our view, position or recommendation are judgement, not law. This guide explains the law; it is not legal advice for your situation.
{: .note }

## Questions people ask

### What if a partner refuses to sign the data annex or answer the questionnaire?

Ask why first. Small partners usually refuse because they fear the cost or the paperwork, and a funded gap plan with a simpler annex solves that. If a partner still refuses, stop receiving named data from it and fund only programmes reported in counts, because you cannot show care in choosing and supervising a partner you know nothing about. For a partner that processes data on your behalf, a valid contract is a legal requirement (s. 8(2)), so refusal there ends the arrangement.

### Does FCRA or a foreign co-funder change who is the fiduciary?

No. FCRA regulates foreign contributions to Indian organisations; it says nothing about who decides the purpose and means of processing personal data, which is the DPDP test (s. 2(i)). A foreign co-funder that specifies data fields or receives named beneficiary data is a fiduciary for that processing like any other, and the Act may reach its processing outside India if it is connected with offering goods or services to people in India (s. 3(b)); whether funding a programme counts is untested. Its processing in India is covered in any case (s. 3(a)). Agree roles with every funder in the same annex.

### What does a CSR-1 registration already cover?

CSR-1 is the form an implementing agency files with the Registrar of Companies to register for undertaking CSR activities, under the Companies (CSR Policy) Rules, 2014, as amended, including in 2021 and in 2022 (G.S.R. 715(E), 20 September 2022). As we understand it, the registration records the entity's legal identity and eligibility, such as its legal form and its registration under the income-tax law as a charitable entity, and issues a registration number. It does not examine how the entity handles personal data. Confirm the current requirements with your company secretary, and treat CSR-1 as an eligibility check only.

### Does our foundation need to appoint a Data Protection Officer?

Only a Significant Data Fiduciary must appoint a DPO (s. 10(2)(a)), and none has been notified as of 25 October 2026. Every fiduciary must still publish the business contact details of a person who can answer questions about its processing, and give them in every reply to a rights request (s. 8(9), Rule 9). We recommend naming one accountable person in the foundation, with time set aside, and a deputy, rather than spreading the role across programme officers.

### We send beneficiary data to a foreign parent or donor. Is that allowed?

Transfers abroad are allowed unless the government restricts the destination country by notification (s. 16(1)), and we have found no such notification as of 25 October 2026. You must meet any requirements the government sets about making data available to a foreign State (Rule 15), and stricter sector rules still apply (s. 16(2)). The beneficiaries' notice should say the data goes to the donor, and the transfer still needs a basis and security. Sending aggregates usually removes the question.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start