For the benefit of PATTIC members, we share a 5-part series on DPDP Act and Rules and How NPOs need to get Ready for implementation in May 2027. This is Part I for today:
Why DPDP Act is crucial for NPOs
• An NPO collects, stores and processes personal data for programming/service delivery, research, advocacy or donor reporting
• Entities from which data collected: Beneficiary, Donor, Employee
• Examples of data collected: Name, Address, Contact no, Age, ID proof, Photograph, Profession, Caste, Religion, Health or Income data etc
Further illustration below of the category of beneficiary data which is mainly collected and processed by an NPO:
- Beneficiary Demographics and Identifiers
Basic Identity: Unique ID, full name, age/date of birth, gender, contact numbers.
Location Data (Village, ward, locality, or GPS coordinates of households).
Socio-Economic Details: Household size, income band, education level, caste, disability status, landholdings, livestock, cropping - Baseline and Endline Data
Baseline Data: Measures initial conditions, needs, indicators before project roll out.
Endline Data: Evaluates the indicators upon project completion to measure change and impact. - Activity and Output Data
Participation Records: Attendance numbers for training sessions, awareness camp/drive, or health camps.
Distributions: Records of physical inputs or relief items handed out (e.g., sheds, food/medical kits, educational materials) - Periodical Monitoring Data
Short-to-Medium Term Outcomes: Tracks progress over time, such as school retention rates, job placements, or health recovery milestones.
Qualitative Feedback: Stories, interviews, and survey responses capturing how beneficiaries perceive the program’s value. - Sensitive Program-Specific Data
Health and Clinical Data: Visual acuity, retina scans, treatment adherence rates, or disease tracking
Protection and Vulnerability Records:Domestic violence, displacement, minor safeguarding
• Source of personal data: surveys, beneficiary records, meeting/workshop records
• The DPDP Act 2023 is a foundational data privacy law and provides a framework for the processing of digital personal data. This framework covers following elements
a. Privacy Notice & lawful consent
b. Purpose limitation
c. Collection limitation (data minimization)
d. Retention limitation
e. Data security
f. Grievance redressal
g. Accountability
We will study each of the above elements of the framework in details as we proceed with our series on DPDPA
Implementation timelines
DPDP Act notified in Aug 2023 and DPDP Rules notified in Nov 2025
DPBI and definition clauses effective from Nov 2025
Registration and obligations of Consent Managers-Nov 2026
Full implementation from 13 May 2027
Tomorrow, we will see key Definitions under DPDPA as the foundation for its implementation.
CS Sharad Bhargava