# Commons Trust: DPDP compliance from wherever you are to fully compliant

> Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act.

Website: https://dpdp.commons.inc · Contact: hello@commons.inc · Bengaluru, India · Updated 25 October 2026

## What Commons Trust promises

Most organisations get one piece of DPDP help: an awareness session, a legal opinion, a consultant or a software licence. Each is useful, and each leaves the hard part to the organisation. Commons Trust signs up for the whole journey, run as one programme with one team, and every part is also available on its own.

| What it takes to be compliant | Awareness session | Legal consultation | Consent software | Commons Trust |
|---|---|---|---|---|
| Understand what the law asks of you | Yes | Yes | Some | Yes |
| Find what personal data you hold, and where | No | Some | No | Yes |
| Write policies and notices | No | Yes | Templates | Yes |
| Train every team and change how they work | One talk | No | No | Yes |
| Consent connected to all your systems | No | No | You integrate | We integrate |
| Clean old data and ask old users for consent | No | No | No | Yes |
| Stay until you are compliant | No | No | No | Yes |

## The compliance journey: four stages, one team

1. **Strategy**: a 67-question baseline across 11 areas of the law, gaps ranked by the penalty they carry, a map of every system and spreadsheet holding personal data, named owners and a dated roadmap.
2. **Design**: plain-language policies approved by the board, itemised notices in the languages people speak, processes for rights requests, breaches and deletion, and a change plan for every team.
3. **Technology**: the Commons Trust consent platform, connected to standard and custom systems through connectors, an API and an SDK. Our engineers work with your tech team and vendors.
4. **Change Management & Implementation**: role-wise training and handholding, embedding with programmes on the ground, data clean-up, re-consent drives for old users, and running the first requests and breach drill together. We don't leave until you are compliant.

## How long it takes

| Organisation size | Aggressive | Standard | Relaxed |
|---|---|---|---|
| Small (startup, one-programme NGO) | 1 month | 2 months | 3 months |
| Medium (several programmes, a dozen systems) | 3 months | 6 months | 9 months |
| Large (many entities or business units) | 6 months | 8 months | 12 months |

Small organisations on an aggressive or standard plan go straight to the platform with ready-made policies; medium and large organisations on an aggressive plan run all four stages in parallel.

## The Commons Trust platform

A consent management platform for the DPDP Act: purpose register, multilingual notices with audio, offline consent capture in the field, consent records with full history, rights requests and grievances from WhatsApp, helpline, web and field app in one queue, controls tied to the Act and Rules, vendor oversight, a public trust page to share with funders and customers, and an evidence vault with a one-click audit pack.

## Included by default

- A kickstarting workshop (Strategy)
- Readiness and gap register (Strategy)
- Systems and data map (Strategy)
- Policy and controls (Design)
- A compliance team and roadmap (Design)
- Consent management system (Technology)
- Integrations (Technology)
- Data principal portal (Technology)
- Trainings and workshops (Implementation)
- Requesting consent and sending notices (Implementation)
- Stakeholder oversight of vendors, partners and grantees (Governance)
- Public trust page (Technology)

## Who it is for

- Nonprofits and NGOs
- Foundations and CSR teams
- Startups
- Corporates, including likely Significant Data Fiduciaries

## Key DPDP dates and figures

- DPDP Rules notified 13 November 2025.
- Consent Manager provisions (Rule 4) apply from 13 November 2026.
- Most obligations apply from 13 May 2027.
- Penalties go up to ₹250 crore for failing to take reasonable security safeguards.
- A detailed breach report is due to the Data Protection Board within 72 hours.
- Children (under 18) need verifiable parental consent.

## Questions

### Is DPDP a legal problem or an operations problem?

Mostly operations. The Act is short and readable; its obligations land on intake forms, field apps, CRMs, vendor contracts and the habits of hundreds of people. Legal advice tells you what the law means. It doesn't change how a field worker enrols a family on a Tuesday afternoon. That is why we put strategy, design, systems and on-ground work in one programme. The organisations that struggle are usually the ones that bought the interpretation and assumed the implementation would follow.

### Should a nonprofit rely on consent for everything it does?

Not necessarily. Consent is the default, but Section 7 of the Act lists "certain legitimate uses" where you can process data without it, for example when a person has voluntarily given data for a specific purpose and hasn't objected. Leaning on consent for everything creates fatigue and brittle records. Leaning on exemptions without writing down why invites trouble. The real work is deciding, purpose by purpose, which basis applies, recording the reasoning, and designing notices that match. It's one of the first things we settle in a baseline.

### What does "verifiable" parental consent look like when a family shares one phone?

The Rules ask you to take due care that the person consenting is an identifiable adult, using reliable details you already hold or a virtual token such as one issued through DigiLocker. In a village that means designing the check into enrolment itself: an OTP to the guardian's number, a field worker's attestation, an ID reference recorded once. Some education, health and child-care uses are exempt for specific purposes. Knowing exactly which of your programmes qualify saves a great deal of unnecessary friction.

### What happens to the data we collected years before the Act?

For personal data processed on consent given before the Act commenced, you must give people a notice as soon as reasonably practicable, and they can withdraw. In practice that is a triage: delete what you can't justify keeping, and re-notify everyone else. This is usually the largest single piece of work in a programme and the most neglected, because it lives in old registers and spreadsheets rather than in any one system.

### Will we be classed as a Significant Data Fiduciary?

The government notifies Significant Data Fiduciaries based on factors such as the volume and sensitivity of data processed and the risk to people's rights. If you are notified, you need a Data Protection Officer based in India, an independent data auditor, and periodic impact assessments and audits. Large platforms, health and education networks and big employers should plan as if the label may arrive. Building the evidence trail now is far cheaper than reconstructing it later.

### Does compliance end on 13 May 2027?

No. The Rules arrive in phases: the Data Protection Board from November 2025, Consent Manager registration from 13 November 2026, and most obligations from 13 May 2027. That last date is when obligations begin, not when the work ends. You will launch new programmes, sign new vendors and hire new staff every month. The real test is whether a programme you start next year collects data correctly without us in the room. We measure our own success by that, and it's why change management sits inside the journey rather than after it.

### We're a very small NGO or an early startup with almost no budget. Can we still comply?

Yes, and you shouldn't wait. Start by asking for a consultation session with us. We'll look at what you actually hold and pick the few things that matter most for an organisation your size. Then deploy the Commons Trust software to look after your compliance needs day to day: notices, consent records, requests and evidence, without needing a dedicated privacy team.

## Guides

- [The DPDP Act and Rules: what they ask, and what you must be able to show](https://dpdp.commons.inc/dpdp-act-guide): A working guide to India's DPDP Act, 2023 and DPDP Rules, 2025: what is in force, who it covers, the evidence to keep, and a plan for 13 May 2027.
- [DPDP compliance deadline: 13 May 2027, and what 13 November 2026 changes](https://dpdp.commons.inc/dpdp-timeline): Every DPDP commencement date by provision, what 13 November 2026 changes, and dated plans to 13 May 2027 for small, large, SaaS and late-starting organisations.
- [DPDP compliance checklist: 40 controls to finish before 13 May 2027](https://dpdp.commons.inc/dpdp-compliance-checklist): 40 DPDP controls to finish before 13 May 2027, each with what done looks like, the section or rule behind it, the evidence to keep and the person who owns it.
- [DPDP penalties: what the ₹250 crore cap means, and how the Board decides](https://dpdp.commons.inc/dpdp-penalties): DPDP penalties explained: the Schedule's caps, when a breach is significant, the seven factors the Board weighs, undertakings, blocking, CERT-In and directors.
- [How to choose a DPDP consent management platform: 12 tests](https://dpdp.commons.inc/consent-management-platform): Twelve vendor-neutral tests for choosing a DPDP consent management platform in India, with a live demo script, a scoring sheet and contract terms to insist on.
- [DPDP for NGOs: beneficiary registers, WhatsApp groups and field teams](https://dpdp.commons.inc/dpdp-for-nonprofits): How the DPDP Act applies to NGOs: roles with funders and government, basis for services, children, WhatsApp and registers, breaches, and a plan for May 2027.
- [DPDP for CSR foundations: what you owe for data your implementing partners collect](https://dpdp.commons.inc/dpdp-for-csr-foundations): A CSR foundation that shapes a programme or receives named beneficiary data is a Data Fiduciary. Roles, partner questions, grant clauses and board reporting.
- [DPDP for SaaS startups: what your enterprise customers will ask you to prove](https://dpdp.commons.inc/dpdp-for-startups): DPDP for SaaS startups: processor or fiduciary by feature, DPA and questionnaire asks mapped to the Rules, consent and erasure engineering, a 90-day plan.
- [DPDP for a corporate group: one programme across many entities](https://dpdp.commons.inc/dpdp-for-corporates): DPDP for corporate groups: each entity a fiduciary, intra-group sharing, a group operating model, SDF readiness, M&A under s. 17(1)(e), audit evidence.
- [DPDP Act glossary](https://dpdp.commons.inc/dpdp-glossary): Plain-English definitions of 28 DPDP Act terms, from Data Fiduciary and Consent Manager to verifiable consent, DPIA, Third Schedule, nominee and TDSAT appeals.
- [DPDP and AI: training data, chatbots and staff using AI tools](https://dpdp.commons.inc/dpdp-and-ai): DPDP Act and AI: the basis for training on personal data, public data under s. 3(c)(ii), chatbots and children, a staff AI-tool policy, erasure from models.
- [Does the DPDP Act apply to you? Scope, exemptions and edge cases](https://dpdp.commons.inc/dpdp-applicability): Who the DPDP Act covers from 13 May 2027: a decision tree, what each exemption switches off, and ten worked cases, from NGOs and foreign SaaS to research.
- [Data breach under DPDP: the 72-hour Board report and CERT-In's six hours](https://dpdp.commons.inc/dpdp-breach-response): DPDP breach notification from 13 May 2027 and CERT-In's six-hour rule today: what counts, what to tell people and the Board, an hourly playbook and a drill.
- [Verifiable parental consent under DPDP: methods that work without a smartphone](https://dpdp.commons.inc/dpdp-childrens-data): How to verify a parent's identity and age under Rule 10, with methods for parents without smartphones, every Fourth Schedule exemption, and schools and edtech.
- [Consent Managers under DPDP: registration opens 13 November 2026. Do you need one?](https://dpdp.commons.inc/dpdp-consent-managers): What a DPDP Consent Manager is, Rule 4 registration conditions from 13 November 2026, how it differs from consent software, and a decision tree for fiduciaries.
- [How to write a DPDP consent notice: Rule 3, with examples you can copy](https://dpdp.commons.inc/dpdp-consent-notice): What a DPDP consent notice must say under s. 5 and Rule 3, the language rules, layering, and sample notices for web, app, SMS, IVR, paper, parents and donors.
- [DPDP data mapping: find every record in four weeks, paper and WhatsApp included](https://dpdp.commons.inc/dpdp-data-mapping): A four-week DPDP data mapping method: team interview questions, an inventory template, finding WhatsApp, phone and shared-drive data, and what the map feeds.
- [Employee data under DPDP: hiring, payroll, CCTV and exit](https://dpdp.commons.inc/dpdp-employee-data): How the DPDP Act treats employee data: the s. 7(i) employment ground and its limits, candidates, background checks, CCTV, biometrics, payroll vendors and exit.
- [The data you already hold: re-notice, re-consent or delete before May 2027](https://dpdp.commons.inc/dpdp-existing-data): DPDP section 5(2) and the data you already hold: triage by legal basis, a notice campaign by SMS, WhatsApp, IVR and field visit, and what to erase by May 2027.
- [Informed consent from beneficiaries: oral, assisted and low-literacy consent under DPDP](https://dpdp.commons.inc/dpdp-field-consent): How NGOs take informed DPDP consent from low-literacy beneficiaries: spoken and thumbprint consent, dialect audio, parents without phones, scripts and records.
- [Ten questions a board should ask management about DPDP](https://dpdp.commons.inc/dpdp-for-boards): Ten DPDP questions for boards and trustees before 13 May 2027: why each matters, what a good answer looks like, red flags, evidence and a quarterly report.
- [DPDP gap assessment: what it covers, how long it takes, what you get](https://dpdp.commons.inc/dpdp-gap-assessment): What a DPDP gap assessment covers, how long it takes by size, sample gap register rows and a heat map, and whether any official DPDP certification exists.
- [When you don't need consent: section 7 of the DPDP Act, ground by ground](https://dpdp.commons.inc/dpdp-legitimate-uses): When you can process personal data without consent under section 7 of the DPDP Act: a test for each ground, who may use it, and which duties and rights remain.
- [The DPDP data processing agreement: fiduciary or processor, and the contract you need](https://dpdp.commons.inc/dpdp-processor-contracts): What a DPDP data processing agreement must contain, how to tell a data fiduciary from a processor, joint fiduciaries, and an illustrative addendum with annexes.
- [DPDP vs GDPR: the differences that change what you build](https://dpdp.commons.inc/dpdp-vs-gdpr): DPDP vs GDPR, article by section: no legitimate interests or contract ground, children at 18, breach notice to all, a transfer blacklist, and what to reuse.

## Get in touch

Readiness check and contact form: https://dpdp.commons.inc/#start · Email: hello@commons.inc