DPDP for NGOs: beneficiary registers, WhatsApp groups and field teams

Yes, the DPDP Act applies to your NGO. There is no exemption for nonprofits, trusts, societies or section 8 companies. If your organisation decides why and how beneficiary, donor, volunteer or staff data is processed in digital form, including paper registers someone later typed up or photographed, it is a Data Fiduciary (s. 2(i), s. 3(a)); where it acts only on a funder's or department's instructions, it may be that party's processor instead (s. 2(k)). Most duties start on 13 May 2027. The legal work is small next to the operational work: settling roles in writing, choosing a basis for each purpose, getting data off personal phones and WhatsApp, verifying parents, and being able to report a breach to the Board within 72 hours (Rule 7(2)(b)).

Like the Act (s. 2(y)), we say "she" and "her" for every person.

Jump to what you need:

• Programme heads: Basis for each purpose, WhatsApp and phones, Children.
• Directors and COOs: Roles, Breach plan, Plan for a team under 50.
• Government-scheme partners: Schemes.
• Funders and CSR foundations: Funder asks and a data annex, and DPDP for CSR foundations.

Most of the Act and Rules start on 13 May 2027 (G.S.R. 843(E), Rule 1(4)), except the Consent Manager provisions (s. 6(9), s. 27(1)(d), Rule 4), which start on 13 November 2026; the full calendar is in DPDP deadlines. Penalties go up to ₹250 crore, but only after an inquiry finds a significant breach and a hearing (s. 33(1)); how the Board sets the figure is in DPDP penalties.

Fiduciary or processor: decide it per programme, in writing

The fiduciary is whoever "alone or in conjunction with other persons determines the purpose and means of processing" (s. 2(i)). The test is who decides what the data is for. The fiduciary is responsible for what its processors do on its behalf, whatever the contract says (s. 8(1)), and may use a processor only under a valid contract (s. 8(2)).

The Act has no clause telling two fiduciaries how to split their duties. Each carries all of its own. Each party stays liable for its own duties whatever the agreement says.

Roles attach to purposes. The same NGO can be a department's processor for scheme enrolment and a fiduciary for the same families' stories in a fundraising appeal. The moment you decide a purpose of your own, you need your own basis for it.

A basis for every purpose: service, extras and emergencies

You may process personal data only with consent or for one of the "certain legitimate uses" in section 7 (s. 4(1)). There is no general "legitimate interests" ground.

Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the data the purpose needs (s. 6(1)). Every consent request must carry the contact details of a person who can respond to her about her rights (s. 6(3)). For a woman whose ration, scholarship or treatment depends on you, consent to the core service is hard to call free, and bundling extras into it fails the "unconditional" test.

Section 7(a) gives no room to reuse data for something she has not heard about. For each activity run without consent, write down the clause and why it applies.

The Act has no "sensitive data" category. Tier your controls anyway for caste, religion, health, disability, HIV status, survivors of violence and children, because the type of data affects the penalty (s. 33(2)(b)) and the harm to these people is real.

Two sibling guides carry the detail. Consent in the field covers spoken, thumbprint and assisted consent and photo consent. How to write a DPDP notice covers Rule 3 and sample text. The language rule bites in tribal districts: notices and consent requests must be available in English or an Eighth Schedule language (s. 5(3), s. 6(3)). Santali is Scheduled; Ho, Kurukh and Bhili are not. Offer Hindi or the relevant Scheduled language in writing, and play audio in her dialect.

Government schemes: the State's ground, under its MoU

Section 7(b) lets the State and its instrumentalities process data to provide a prescribed subsidy, benefit, service, certificate, licence or permit, where she earlier consented to State processing for such benefits or the data comes from a notified State database. The State must follow the Second Schedule standards (Rule 5), including telling her about the processing and how to exercise her rights (Second Schedule, para (g)).

The ground belongs to the State. A private NGO delivering a scheme does not rely on 7(b) in its own right. Our position: when you enrol, survey or serve beneficiaries on a department's instructions and for its purpose, you act as its processor. In practice:

• Treat the MoU as your processing contract. Read it for purpose limits, sharing bans, security, retention and breach notice. If it is silent, ask for terms (s. 8(2)).
• Add no purposes. Using scheme data for your own fundraising, research or product makes you a fiduciary for that use, with no basis, and almost certainly breaches the MoU.
• Do not borrow the State's exemptions. The State's processing is relieved of the erasure duty (s. 8(7)), the erasure right (s. 12(3)) and, where no decision affecting her is made, the correction right (s. 12(2)) (s. 17(4)). Your MoU sets when you must delete.
• Children in schemes. The Fourth Schedule lifts parental consent and the tracking ban for providing a benefit or service in a child's interest under 7(b), restricted to the extent necessary (Rule 12(2), Fourth Schedule Part B, item 2). The duty not to harm her well-being still applies (s. 9(2)).

Departments are writing this down. In March 2026 MediaNama reported a letter from Uttarakhand's Samagra Shiksha State Project office asking partner NGOs for a DPDP affidavit within 15 days (MediaNama). As reported, it bars using project data to train AI or machine-learning models, for profiling or commercial analytics without the state government's prior written approval, limits retention to the project, and warns of MoU termination and "strict legal action" after any future complaint.

Getting beneficiary data off WhatsApp, phones and open sheets

A register in a cupboard is outside the Act. A photo of one page of it, sent to a WhatsApp group so the MIS team can enter it, is inside it (s. 3(a)), and so is the spreadsheet made from it. The personal-use exclusion (s. 3(c)(i)) covers a field worker's own contacts and family photos; when she holds beneficiary data on her phone for your programme, she is processing on your behalf.

Rule 6(1) sets the minimum: encryption or masking, access control, logs to detect and investigate misuse, continuity measures such as backups, a year of logs and personal data for investigations, security terms in processor contracts, and the organisational measures that make it work. For a 30-person NGO most of that is access control and discipline; the encryption is already in the tools you pay for, if you use the organisation's account.

A sample WhatsApp rule, illustrative, for field teams:

• WhatsApp is for scheduling, logistics and alerts.
• Never post ID documents, Aadhaar, health details, case notes or anything about a child.
• Never post a photo of a register or form. Use the app.
• Group admins are named staff. They remove anyone who leaves on her last day.
• Turn off chat backup to personal cloud on any phone used for work.
• If something is posted by mistake, delete it for everyone and tell the accountable person within the hour.

Finding every store is the first real task. The data you already hold has the triage: re-notice, re-consent, keep under another basis, or delete before May 2027.

Aadhaar copies: collect fewer, mask the rest

Many NGOs photocopy or photograph Aadhaar cards for enrolment. The Aadhaar Act bars publishing, displaying or posting Aadhaar numbers publicly except as regulations allow (Aadhaar Act s. 29(4)). The Aadhaar (Sharing of Information) Regulations, 2016 require anyone holding Aadhaar numbers to keep them and any database containing them secure and confidential, and bar making such records public unless the numbers are redacted (regulation 6(1)–(3)), and no one may require a person to send her Aadhaar number over the Internet unless the transmission is secure (regulation 6(4)), which is one more reason to keep Aadhaar images off WhatsApp. Under DPDP, holding a full copy where you only needed to check identity also fails the "limited to such personal data as is necessary" test for consent (s. 6(1)).

We recommend: check the card and record that you checked; where a copy is genuinely required by a scheme, keep a masked copy showing only the last four digits; never let Aadhaar images sit in WhatsApp or phone galleries.

Front-line workers who are not your staff

Much field data is collected by people outside your payroll: community volunteers on an honorarium, self-help group leaders, and ASHA or anganwadi workers who share data with your programme.

• Volunteers and community mobilisers collecting for you process on your behalf, so you answer for them (s. 8(1)). Give them the same rules as staff: a short written undertaking, training in the notice and consent script, the WhatsApp rule, and an exit step that recovers data.
• ASHA and anganwadi workers collect for the State. If they pass you beneficiary lists, find out on what basis the department shares that data with you, and get it in the MoU. A list handed over informally at a block meeting has no basis you can point to.

Donors, volunteers, staff and consultants: which basis covers each

Donors. Our view: appeals beyond what she signed up for need consent, which she can withdraw as easily as she gave it (s. 6(4)). Records the law makes you keep are the clearest "law requires it" cases (s. 8(7)). Institutions approved for donors' tax deductions file an annual statement of donations with donor details with the income-tax department (Form 10BD; confirm the current form under the Income-tax Act, 2025 with your CA). Organisations registered under the FCRA file annual returns that include donor-wise details of foreign contributions (FCRA s. 18, FCRA Rules 2011, rule 17). Processing for these returns falls under section 7(d). Bought or borrowed lists are the weak point: if you cannot show where a contact came from, stop mailing it before May 2027.

Volunteers. When volunteers collect beneficiary data, they act on your behalf, as above; here they are the people the data is about. They are not employees, so section 7(i) does not reach them. Our view: details given in order to volunteer sit under section 7(a) for that purpose; moving last year's flood-relief volunteers into this year's donor drive needs consent.

Staff. Section 7(i) covers employment purposes, including protecting the organisation from loss or liability. Field staff are also the likeliest cause of an accidental breach, so phone and WhatsApp rules belong in induction.

Consultants and contractors. They are not employees either. Our view: use section 7(a) for what the engagement needs, and consent for anything more.

Children: verify the parent, read each exemption closely

A child is anyone under 18 (s. 2(f)); there is no self-consent at 16 or 17. Before processing a child's data you need the verifiable consent of a parent or lawful guardian (s. 9(1)); you must not process in a way likely to harm her well-being (s. 9(2)); and you must not track, behaviourally monitor or target advertising at children (s. 9(3)). For a person with a disability who has a lawful guardian, check that a court, a designated authority or a local level committee appointed the guardian (Rule 11).

"Verifiable" means due diligence that the person consenting as a parent is an identifiable adult, using reliable identity and age details you already hold, or details she provides, including a DigiLocker token (Rule 10(1)). Our view: where few parents use DigiLocker, a ration card or school record you already hold for eligibility is the realistic route, provided it shows the parent's identity and age; a record carrying only her name does not meet Rule 10. Record how you checked. Consent in the field has scripts for parents without smartphones.

The Fourth Schedule lifts parental consent and the tracking ban only for named classes and purposes, each "restricted to" a stated extent (Rule 12):

The education row lifts only tracking and monitoring, and only for the school's own processing; our view is that an NGO running its own programme inside a school cannot borrow it. An NGO running a child care institution registered under the Juvenile Justice Act may be able to rely on Part B item 1 for processing that Act requires of it; see the unclear-law section below. Photos of children for reports and social media need their own parental consent. A village, a school and a photograph can identify a child without her name.

A breach plan that fits on one page

A personal data breach is any unauthorised processing, or accidental disclosure, sharing, use, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability (s. 2(u)). There is no size threshold. In an NGO the likely ones are a phone lost on a bus, a list posted to the wrong group, a sheet left open to anyone with the link.

On becoming aware, tell each affected person without delay through her account or a channel she registered (Rule 7(1)); give the Board a first intimation without delay and a detailed report within 72 hours (Rule 7(2)). If you fall within the CERT-In Directions, certain cyber incidents must also reach CERT-In within six hours.

Many beneficiaries share a phone with family, so an SMS about a breach can itself disclose something; where the data is sensitive, tell her in person through a trusted field worker as well, and record it. Whether a partner's or vendor's knowledge counts as yours for the 72 hours is unsettled, so contracts should require a phone call within hours.

A one-page skeleton, illustrative:

Templates and a drill script are in the breach guide.

A retention schedule you can defend

Erase personal data when consent is withdrawn or the purpose is no longer served, whichever is earlier, and make your processors erase it, unless a law requires you to keep it (s. 8(7)). NGOs set their own periods; the fixed three-year periods apply only to large platforms (Third Schedule). Rule 8(3) also sets a one-year minimum for personal data and processing logs, explained in the DPDP Act and Rules guide.

These periods are an illustration; adjust them to your grant agreements and tax and FCRA obligations.

What funders will ask, and a data annex that answers them

Funders that receive named beneficiary data are fiduciaries for their own use of it. We expect grant agreements and due-diligence forms from CSR foundations, international donors and departments to start asking, during 2027, for a named accountable person, the basis and notice for each purpose, consent records for photos in funder reports, the processors and sub-grantees touching the data, a breach contact, retention and erasure at grant end, and a bar on AI training of the kind reported in Uttarakhand.

Answer them once, at the start, with a one-page annex to the grant agreement. An illustrative version:

CSR foundations will find the funder's side in DPDP for CSR foundations.

Where the law is unclear

These are our positions until the Board or the courts say otherwise.

Does section 7(a) cover services to people who depend on them? Yes, for the service itself, used as she would expect. Why: she gave the data for a specified purpose, and consent from someone who would lose a benefit by refusing is weak. Would change if: the Board treats "voluntarily provided" as failing where she had no real choice. Confidence: medium.

Is a CSR foundation that sets data fields and receives named lists a fiduciary? Yes, for that programme. Why: it determines purpose and means "in conjunction with" the NGO (s. 2(i)). Would change if: the Board treats funders who only receive reports as outside the definition. Confidence: medium.

Does the 7(b) child exemption cover an NGO working for the State? Only when it processes strictly as the State's processor for that benefit. Why: the exemption attaches to a purpose only the State can pursue. Would change if: guidance extends it to implementing partners or excludes processors. Confidence: low.

Can a registered child care institution rely on Part B item 1? For processing the Juvenile Justice Act requires of it, probably. Why: the item covers duties discharged in a child's interest under any law. Would change if: guidance confines it to public authorities. Confidence: low.

Is tracking a child's learning levels "behavioural monitoring" (s. 9(3))? Recording assessment scores to teach her better is unlikely to be; profiling her behaviour over time comes closer. Why: neither term is defined, and the education exemption implies some school tracking would otherwise be caught. Would change if: rules define the terms. Confidence: low.

Do the CERT-In Directions reach trusts and societies? It depends on structure. Why: the Directions name service providers, intermediaries, data centres, body corporates and government organisations, and "body corporate" under IT Act section 43A Explanation (i) includes an association of individuals engaged in commercial or professional activities. Non-compliance can lead to action under s. 70B(7) of the IT Act. Would change if: CERT-In clarifies scope for non-company entities. Confidence: low.

The minimum version for a team under 50 people

Planning assumptions, from a 1 November 2026 start. Budget the accountable person about four to six hours a week until May 2027, more during the notice campaign.

Commons Trust can run this plan with your team, or provide the software for notices, consent records and requests if you would rather run it yourselves.

The fuller programme for larger NGOs and networks

For several programmes, many districts or a network of sub-grantees, the same steps become workstreams. Effort is in weeks from a 1 November 2026 start.

Measure progress by the records produced each week: consent entries, closed requests, erasure runs, drill notes. The checklist version is the DPDP compliance checklist.

How we wrote this guide. We worked from the Digital Personal Data Protection Act, 2023, the commencement notification G.S.R. 843(E), the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) and the DPDP (Removal of Difficulties) Order, 2026 of 5 October 2026, which corrects the wording of s. 9(1) and s. 10(2)(c)(ii) and adds no duty. We also used the Aadhaar (Sharing of Information) Regulations, 2016 and the linked reports, last checked 25 October 2026. The Uttarakhand letter is described as MediaNama reported it; we have not seen the letter. Positions marked as ours are our judgement. This guide explains the law; it is not legal advice.