NGOs and Non-Profits: A DPDP Act Impact Study

Executive summary

Non-profits collect some of the most sensitive personal data in India, from people with the least power to refuse: a survivor's account of abuse, a child's photograph in a shelter, a patient's diagnosis on a fundraising page. They also hold donors' PAN numbers and foreign donors' addresses.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) treats a charity like any other data fiduciary, the organisation that decides why and how personal data is processed. There is no exemption for public-benefit work or for small organisations; the Centre's power to exempt startups and other classes (s.17(3)) has not been used. The main obligations commence on 13 May 2027.

Headline rating: Overall impact High. Five of the twelve areas in the Trayambic scorecard are rated High.

The three biggest changes:

1. 1.Consent from people you help must be genuinely free. Stories and photographs used in fundraising need consent that a beneficiary can refuse without losing help, and the organisation must be able to prove it (s.6(10)).
2. 2.Children and adults under guardianship need verifiable consent from the right person, and child-protection laws already bar identifying many children in care.
3. 3.Funders, partners and platforms need defined roles. CSR companies, implementing partners, fundraising agencies and crowdfunding platforms each touch the data; contracts must say who is responsible.

Background

This study covers public charitable trusts, registered societies, companies licensed under s.8 of the Companies Act, 2013, CSR implementing agencies, and donation and crowdfunding platforms.

The data principals (the individuals the data is about) are:

• Donors: individuals giving online, by cheque or through payroll, in India and abroad.
• Beneficiaries: children, persons with disability, patients, women in shelters, migrant workers, farmers and students.
• Volunteers, staff and key functionaries: trustees, directors and office bearers whose identity documents go to regulators.

The data ranges from names, PAN and payment details to case files, health and disability records, photographs and testimonies.

A typical flow: a donation page and payment gateway feed a donor database, which produces receipts and the annual statement of donations to the income-tax department; foreign donations are reported to the Ministry of Home Affairs. Field teams record beneficiary data in apps or registers. Reports, photographs and stories go to CSR funders, foreign grant-makers, social media and annual reports.

Legal framework

The DPDP provisions that matter most

• Who is a fiduciary. "Person" includes a company, an association of persons or body of individuals, and every artificial juristic person (s.2(s)). A fiduciary is anyone who decides purpose and means "alone or in conjunction with other persons" (s.2(i)), so two organisations can share the role.
• Consent (ss.5, 6; Rule 3). Consent must be free, specific, informed, unconditional and unambiguous, with an itemised notice in English or an Eighth Schedule language; withdrawal must be as easy as giving consent; and the fiduciary must prove notice and consent (s.6(10)). People who consented before commencement must be sent a notice as soon as reasonably practicable (s.5(2)).
• Legitimate uses (s.7). The grounds most relevant here are data voluntarily provided for a specified purpose (s.7(a)), legal duties to disclose information to the State (s.7(d)), compliance with an order under Indian law (s.7(e)), medical emergencies (s.7(f)), and help during a disaster or breakdown of public order (s.7(h)). The employment ground (s.7(i)) covers staff. The State's grounds (s.7(b), (c)) are not available.
• Children and persons with disability (s.9; Rules 10, 11). Verifiable consent of a parent or lawful guardian is needed; as amended by the Removal of Difficulties Order, 2026, s.9(1) speaks "of a child or of a person with disability". Processing likely to harm a child's well-being is barred (s.9(2)), as are tracking, behavioural monitoring and targeted advertising directed at children (s.9(3)). Rule 11 requires reasonable checks that a guardian was appointed by a court, a designated authority or a local level committee under the applicable law. The Fourth Schedule exempts educational institutions, crèches and healthcare providers for limited purposes, and functions under law in a child's interest.
• Duties and penalties (s.8; Rules 6, 7; s.33). Responsibility for processors, accuracy, security safeguards with a year of logs, breach notice to the Board and each affected person, and erasure when the purpose ends unless law requires retention. Penalties reach ₹250 crore, though the Board must weigh a penalty's likely impact on the person (s.33(2)(g)).

Sector instruments

Two developments stand out. On 30 June 2026 the Karnataka High Court, in Girish Patil v State of Karnataka, refused to quash a prosecution under s.74, holding that the bar covers children in need of care and protection and child victims, and that acting in the child's interest is no defence. And the 2026 FCRA rules make recipients collect ultimate-donor details from foreign intermediaries.

For platforms, the Consumer Protection Act, 2019 defines e-commerce as "buying or selling of goods or services" (s.2(16)); the IT Rules, 2021 require intermediaries to use reasonable efforts against content "invasive of another's privacy" (r.3(1)(b)(ii)).

How sections 38 and 16(2) fit together

Section 38 makes the DPDP Act additional to these laws and decisive in a conflict. FCRA returns and donation statements are legal duties to disclose information to the State (s.7(d)), and the records they require may be kept under s.8(7). The child-protection and health statutes apply alongside the Act. Section 16(2) preserves stricter transfer rules, but none of these instruments restricts sending data abroad.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Stories and photographs: consent from people you help

Fundraising runs on faces and stories. The DPDP Act asks whether the consent behind them is free and unconditional, and for many beneficiaries the honest answer is uncertain: a woman receiving rations, a family whose child's surgery is being funded.

In our view three things make it defensible:

• Separate it from the service. Ask after help has been given or agreed, in a separate conversation, and record that refusal changes nothing. A consent line inside an intake form signed to receive aid is weak evidence.
• Make it specific. An annual report, social media and a television appeal are different audiences; ask for each, say how long the material will be used, and show the person the image.
• Make withdrawal real. Withdrawal must be as easy as consent (s.6(4)) and stops future use. Keep a register linking each image and story to its consent so material can be pulled from the website, the image library and partners' decks.

For an adult who cannot read, record spoken or thumbprint consent after the notice is read in her language. Remove identifying details where the story works without them.

Breach notices need the same care. Rule 7 requires telling each affected person without delay, but for a survivor whose phone an abuser can see, a careless SMS is itself a harm. Ask at intake which channel is safe, record it, and use it.

Children, guardians and children in care

Any organisation working with children needs verifiable consent from a parent or lawful guardian (s.9(1); Rule 10), and nothing it does may be likely to harm the child's well-being (s.9(2)).

• Schools, crèches and clinics run by non-profits may use the Fourth Schedule's class exemptions for core activities. Fundraising and publicity are outside them.
• Children in child care institutions often have no parent available. Identify the lawful guardian for DPDP purposes, a question the Child Welfare Committee may need to settle, before relying on anyone's consent. In our view a registered institution acting on a Committee's placement order can rely on s.7(e), compliance with an order under Indian law, for the care it is ordered to provide; the Fourth Schedule's exemption for functions under law in a child's interest then removes the parental consent requirement for that care.
• Publicity is the hard line. A child is placed in care after a Committee inquiry, so in our view an appeal that identifies her risks falling within s.74 of the Juvenile Justice Act, even with the institution's consent; the Karnataka High Court has held that good intentions are no defence.
• Persons with disability under guardianship. Check the guardian's appointment (Rule 11); where an adult with disability can decide for herself, ask her.

Trayambic's schools and ed-tech studies cover verifiable consent mechanics.

Donors: receipts, returns and research

Statutory data. Donor PAN, name, address and amount go to the income-tax department in Form 113; foreign donors' details go to the Ministry of Home Affairs in Form FC-4. Those disclosures rest on s.7(d), and the donor provided the data for her receipt and deduction, which fits s.7(a). Ask only for what the forms need, and explain why PAN is requested.

Ultimate donors. Money arriving through an escrow account or other intermediary (in our view, including a donor-advised fund) now requires the ultimate account holder's name, address, email and amount in Form FC-4. Write this into grant agreements so the intermediary obtains its donors' agreement to share, and hold the data only for the return.

Prospect research and marketing. Profiling donors' wealth, scraping their social media or buying lists is a new purpose needing consent; s.7(a) covers the donation, not a wealth profile built around it. Appeals by email, SMS or phone need withdrawable consent. Trayambic's ad-tech study covers campaign tools.

Foreign donors. The Act applies to processing in India whatever the donor's residence (s.3(a)). The partial exemption in s.17(1)(d) covers non-residents' data processed under a contract with a person abroad, such as a back office serving a foreign charity, not an Indian non-profit's own donors.

Funders, partners, platforms and volunteers: who is the fiduciary

CSR funders. The company funds a project; the implementing agency runs it and collects the data. In our view the agency is usually the fiduciary for beneficiary data and the company a separate fiduciary for anything it receives. The CSR Rules require utilisation certification and, for larger companies, impact assessments, not beneficiary identity data. Send aggregates; share names, Aadhaar numbers or photographs only with consent.

Partners and agencies. Sub-grantees, community organisations, fundraising agencies, telecallers, CRM providers and payment gateways are processors or separate fiduciaries. Each contract should say which, with security terms, incident notice and erasure at the end (s.8(1), (2)); Trayambic's vendor contracts checklist sets out the clauses.

Crowdfunding platforms. A medical campaign may expose a patient's diagnosis, hospital estimates and photographs. The campaigner, often a relative, decides to publish; the platform decides how campaigns are verified and displayed. Under s.2(i) both can be fiduciaries. In our view a donation is not "buying or selling", so donation platforms are unlikely to be e-commerce entities, but as hosts of user content they carry intermediary duties. Get the patient's or guardian's consent; do not rely on the medical-emergency ground (s.7(f)) to publish; and delist pages after closure.

Volunteers. In our view unpaid volunteers fall outside the employment ground (s.7(i)). Use s.7(a) for onboarding data they provide, and consent for photographs and background checks (Trayambic's article on background checks covers screening). Volunteers who handle beneficiary data need confidentiality undertakings and staff device rules.

Key functionaries. FCRA and DARPAN filings need trustees' and office bearers' Aadhaar and PAN. Keep copies encrypted, limit access and mask numbers in internal records.

Worked example (illustrative): a child-education charity

A Section 8 company runs after-school centres for 6,000 children in three States, with 250 volunteers. It is FCRA-registered, receives funds from two CSR donors and a foreign donor-advised fund, and raises money online and through a crowdfunding campaign.

• Children. Enrolment now collects verifiable parental consent through a call-back to a registered number; the charity checks whether its centres meet the Fourth Schedule's definition of an educational institution before relying on it.
• Publicity. Appeals use images of children living with parents who consented, never children placed by the Child Welfare Committee, and no image carries a full name and centre.
• CSR reporting. One funder asks for a spreadsheet of names, Aadhaar numbers and photographs for its impact assessment. The charity sends attendance and learning outcomes by centre, and named case studies only with fresh parental consent.
• Donors. The donation page asks for PAN with an explanation, a separate tick for appeals, and a link to the notice. The foreign fund's grant letter now covers ultimate-donor details.
• The incident. A volunteer's unencrypted laptop holding 400 children's assessment files is stolen. The charity reports to CERT-In within six hours, tells the Board without delay, files the 72-hour report and phones each parent in their language. Devices are then encrypted and files move to a system with access logs.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map; take down risky child images; name a DPDP lead (in a small organisation, a trustee or the finance head).
• January to March 2027: consent rebuild; guardian consent; contracts; device encryption.
• April to May 2027: breach plan and drill; rights process; notices to existing donors.
• Ongoing: FCRA form changes; Board guidance; consent checks before each campaign.

Recommendations

1. 1.Ask beneficiaries for story and image consent separately from the help they receive, and honour refusal and withdrawal.
2. 2.Treat children in care as off limits for identifying publicity, whatever the fundraising pressure.
3. 3.Give CSR funders and foreign grant-makers aggregates, not identity data.
4. 4.Collect donor PAN and foreign donor details only for the returns, and keep marketing on separate consent.
5. 5.Put every partner, agency and platform under a contract that names its role.
6. 6.Secure the basics even if small: encrypted devices, no case files on messaging apps, one breach plan.

Key takeaways

• There is no DPDP exemption for charities or small organisations; s.17(3) has not been used.
• Consent for beneficiary stories and photographs must be separate from the help given, specific to each use and easy to withdraw.
• Juvenile Justice Act s.74 bars identifying children in care; the Karnataka High Court held in June 2026 that good intentions are no defence.
• FCRA and income-tax returns rest on s.7(d), and the 2026 FCRA rules add ultimate-donor details for money routed through intermediaries.
• CSR funders should receive aggregates, not beneficiary identity data.