DPDP Act's Impact on CSR, Simplified - Your questions, answered

Question 1

Need clarity on a case where an NGO is collecting the data but the company (Funder) has not asked for the entire data set. Who is the responsible party if there is a data leak/privacy breach?

Accepted Answer

Responsibility follows the role, not simply who physically holds the spreadsheet. If the NGO independently decides why and how the beneficiary data is processed, it is a Data Fiduciary for that processing and is responsible for the relevant obligations. If the funder also determines the purpose or means of processing, it may also be a Data Fiduciary. If the NGO is processing the data only on the funder's instructions, the funder remains responsible for processing carried out on its behalf. A contract should clearly document the roles, permitted data, purpose, access, security, breach handling and deletion.

Question 2

Do we have some guidance for donor organisations who are working with multiple programme organisations and NGO partners? Where can we place them in the different parties?

Accepted Answer

Do not classify organisations by title alone. Map each party against the actual decisions it makes: who decides why the data is collected, which fields are collected, who receives it, how it is used, how long it is retained and when it is deleted. A donor that determines these purposes and means may be a Data Fiduciary. An NGO or vendor acting only on documented instructions may be a Data Processor. An NGO that independently decides the purpose and means of its own programme data may itself be a Data Fiduciary. Where two parties jointly determine the purpose and means, both should be assessed as Data Fiduciaries for that processing.

Question 3

For larger corporates where the beneficiary numbers are in lakhs/millions, will they have to get consent of everyone if they are the Data Fiduciary?

Accepted Answer

Scale does not remove the consent requirement. If the corporate is processing personal data on the basis of consent, consent must be obtained from the relevant Data Principals; for children, the applicable parental/guardian consent requirements also apply. The Act does not create a blanket exemption simply because the beneficiary population is in lakhs or millions. The better approach at scale is to minimise the data collected, use a practical consent mechanism, and avoid collecting individual-level data where aggregate reporting is sufficient. If the corporate genuinely receives only anonymised/aggregated information, individual beneficiary consent for that reporting may not be necessary under the DPDP framework.

Question 4

There have been discussions around avoiding the use of front-facing photographs of children, even though the NGO has obtained valid consent for their use. Guidance on balancing consent with child dignity, privacy and safeguarding?

Accepted Answer

Valid consent is important, but it is not the only consideration when children are involved. For CSR and social-sector communications, the safer practice is to use identifiable photographs of children only where there is a clear purpose, appropriate parental/guardian consent and a genuine need for the image. If a front-facing photograph is not necessary, use a non-identifying image, crop the image, photograph activities rather than faces, or use aggregated/group imagery where appropriate. Child dignity and safeguarding should be treated as a higher practical standard than simply asking whether a consent form exists.

Question 5

How does an organisation working for education, children, teachers, community education etc. handle photographs/data used in reports, presentations and other purposes for prolonged periods?

Accepted Answer

For photographs, videos, testimonials and other personal data used in reports or presentations, the organisation should define the purpose and retention period upfront. Programme participation consent should not automatically be treated as consent for future public communications, case studies or unrelated uses. Where the purpose changes materially, fresh consent should be considered. Keep only what is necessary, restrict access, document the consent and set a deletion/review date. The slides specifically recommend purpose-specific consent for photos and case studies and deletion once the programme purpose is fulfilled.

Question 6

In a CSR project where an NGO collects beneficiary data, a corporate funds the project, an impact assessor evaluates outcomes, and a technology vendor hosts the data, how would Data Fiduciary and Data Processor roles be allocated?

Accepted Answer

The answer depends on who decides the purpose and means of each processing activity. If the corporate decides what beneficiary data must be collected and why, it may be a Data Fiduciary; the NGO may be its Data Processor if it acts only on those instructions. The impact assessor may be a Data Processor if it evaluates outcomes using data on the fiduciary's instructions. The technology vendor is generally a Data Processor where it merely hosts or processes the data on instructions. If any of these parties independently decides the purposes and means of processing, that party may instead be a Data Fiduciary for that activity. The contracts should reflect the actual arrangement, not just the labels.

Question 7

What about taking consent from Headmasters and teachers when photographing kids for a programme at school? Do we have to get parents' consent only?

Accepted Answer

For children, the DPDP framework requires verifiable consent of the parent or lawful guardian before processing their personal data, subject to any applicable statutory exemption. A Headmaster or teacher's permission to conduct a programme or take photographs at the school is not, by itself, a substitute for the required parental/guardian consent for the child's personal data. The school may also require its own institutional permission, but that is a separate issue from the child's data-protection consent.

Question 8

Can an NGO give consent on behalf of children and families they are working with if a donor wants it?

Accepted Answer

No. An NGO cannot simply give consent on behalf of a child or family because it is the implementing partner or because the donor has requested the data. For a child, verifiable parental consent is the relevant requirement, subject to applicable exemptions. The NGO can facilitate the consent process and maintain the consent record, but it should not represent its own institutional approval as the beneficiary's consent.

Question 9

As part of the six DPDP principles, data storage is a key principle. If an impact assessment is conducted one year after project closure, how should the data be managed?

Accepted Answer

The key is to separate the data needed for the programme from the data needed for the later assessment. Personal data should not be retained indefinitely just because an impact assessment may happen later. If a one-year post-closure assessment is genuinely part of the stated programme purpose, that retention period should be documented before collection and reflected in the relevant agreement and notice. During the interim, keep access restricted and use programme IDs or de-identified data wherever possible. If the assessment can be done from aggregated or de-identified information, there is no reason to retain the full identifiable dataset.

Question 10

What about group photos? Is consent required from each and every person in the group photo?

Accepted Answer

A photograph of an identifiable person is personal data. Therefore, where a group photograph is being taken and used for a stated programme or communication purpose, the safest approach is to obtain appropriate consent from the identifiable participants, or from the parent/guardian where a child is identifiable. A crowd being present at an event should not automatically be treated as consent. Where practical, use photography zones, signage plus an affirmative consent mechanism, or take non-identifying crowd shots where individual identification is not required.

Question 11

What are the modalities under the DPDP Act if a software company is involved in creating an app to collect data?

Accepted Answer

If a software company builds or provides the app and processes beneficiary personal data on behalf of the organisation, it should normally be engaged under a written data-processing arrangement. Before onboarding it, define the fields collected, purpose, access rights, hosting arrangements, security measures, breach reporting, subcontracting, retention and deletion. The organisation should also check whether the vendor is acting only on its instructions. The DPDP Rules prescribe reasonable security safeguards, including access controls, encryption/obfuscation/masking where appropriate, logging and measures for continuity and breach response.

Question 12

Why would I collect Aadhaar or a phone number? Can't we use a unique ID for the beneficiary?

Accepted Answer

Yes. A unique programme ID is generally the better design where the purpose is verification rather than identification. The slides recommend assigning each beneficiary a programme ID and keeping the ID-to-name mapping securely with the NGO/M&E lead. The funder can then verify attendance, outcomes or other indicators without receiving names or Aadhaar numbers. Aadhaar or a phone number should be collected only where there is a clear, documented purpose and it is genuinely necessary; they should not be collected simply because they are convenient identifiers.

Question 13

If organisations use beneficiary datasets to train AI models for impact prediction, programme design or operational efficiency, does consent that mentions AI model training suffice, or is fresh consent required?

Accepted Answer

If AI training is a genuine, specific purpose stated before collection and the notice and consent clearly explain that the beneficiary's personal data will be used for that purpose, the original consent may cover that processing. However, a vague statement such as 'for AI and future purposes' would be difficult to treat as specific and informed consent. If the AI use is materially different from the original purpose, involves a new recipient, or was not reasonably covered by the original notice, fresh consent should be obtained. For public AI tools, the slides take a conservative position: do not upload identifiable beneficiary data; use anonymised or aggregated data instead.

Question 14

If consent is required when communities at large are present during handing over of projects and photos are clicked as group photos of beneficiaries, what is the implication on the funder?

Accepted Answer

Yes. The same principle applies to photographs taken at a project handover or other public programme. If beneficiaries are identifiable and the photograph is going to be used by the NGO, funder or another organisation for reports, websites or social media, treat it as personal data and obtain appropriate, purpose-specific consent. For children, use the required parent/guardian consent. For a general crowd photograph where individuals are not reasonably identifiable, the risk is lower; however, the safest practice is still to avoid relying on attendance as implied consent. For the funder, the key issue is its role: if it decides the purpose or means of the photographic processing, it has Data Fiduciary responsibilities; if it merely receives an aggregated report and does not process identifiable images, its exposure is correspondingly lower.

Question 15

Impact assessment needs beneficiary-level validation, while DPDP emphasises purpose limitation and data minimisation. How can organisations balance rigorous validation with collecting the least amount of personal data necessary?

Accepted Answer

The practical solution is to separate 'verification' from 'identification'. The funder does not normally need names, Aadhaar numbers or full contact details to verify every outcome. Use a unique programme ID, share the minimum fields needed for the indicator, and keep the ID-to-name mapping with the NGO. For audits or sample verification, the assessor can verify selected records under controlled access without receiving the complete beneficiary database. This approach supports rigorous assurance while following data minimisation and purpose limitation.

Question 16

Under the DPDP Act, if an individual or entity publishes photos/videos through personal social media, corporate handles or print media, does this processing fall within the Act? How does the personal/domestic exemption work, and what are the compliance implications?

Accepted Answer

Yes, this processing can fall within the DPDP Act. The Act excludes personal data processed by an individual for a purely personal or domestic purpose, and it also contains a specific rule concerning personal data made publicly available by the Data Principal or by a person legally obliged to publish it. That does not mean that a corporate, NGO or professional communications team can freely publish someone else's photograph merely because it was available online. For corporate handles, NGO pages, CSR reports and print media, treat identifiable beneficiary photographs/videos as personal data and obtain purpose-specific consent unless another lawful basis clearly applies. For children, apply the additional child-data requirements.

Question 17

If there is a breach at a third party after the end of an agreement, will the funder still be accountable? Do you see misuse/overlap of funds due to non-collection of specific IDs?

Accepted Answer

An agreement ending does not automatically erase accountability for processing that occurred during the engagement. If the funder was the Data Fiduciary, the Act places responsibility on it for processing undertaken on its behalf by a Data Processor. A contract should therefore require the third party to report incidents, cooperate with investigation, return/delete data and maintain appropriate safeguards. On the question of misuse or overlapping funds, unique programme IDs are useful because they reduce duplicate counting and make beneficiary-level verification possible without requiring the funder to hold excessive identity data. They are a data-governance control, not a substitute for proper financial controls.

Question 18

For group photos featuring 50–100 beneficiaries, is a collective consent form acceptable instead of individual ones? Does consent need to be a physical hard copy?

Accepted Answer

A collective form can be workable for a group event, but it should not mean that one person gives consent for everyone else. The form or process should clearly identify the purpose and capture an affirmative indication from each consenting participant, with parental/guardian consent for identifiable children where required. A physical hard copy is not inherently the only valid format: consent can be recorded through other appropriate methods, including a clear digital or recorded verbal affirmative action, provided the organisation can demonstrate what was agreed, for what purpose and when. For a large floating crowd, a controlled photography area with a simple consent mechanism is more defensible than treating mere attendance as implied consent.

Question 19

As a Data Fiduciary, can you reiterate the responsibilities vis-à-vis the Data Processor, where the funder is the Data Fiduciary and NGO is the Data Processor?

Accepted Answer

The Data Fiduciary must remain accountable for processing carried out on its behalf by a Data Processor. It should appoint the processor under a valid contract, give clear instructions, limit the processing to the agreed purpose, establish security and access controls, define retention and deletion, and have a breach-response process. The processor should not use the data for its own purposes merely because it has access to it. In the specific funder–NGO example, the funder is the Data Fiduciary only if it actually determines the purpose and means; the NGO is a Data Processor if it acts only on the funder's instructions.

Question 20

Most of the time, I see people posting photos on social media, like LinkedIn.

Accepted Answer

Posting a photograph on LinkedIn does not automatically make the photograph free for anyone else to use. A person may have rights in relation to their own image, and the DPDP Act's personal/domestic exemption is narrow. A professional or corporate post made for CSR communication is not the same as an individual's private family post. For NGO and corporate communications, the safer approach is to obtain purpose-specific consent for identifiable beneficiary images, especially children, and maintain a record of that consent.

Question 21

What precautions should be taken when an assessor collects data through software available in the market?

Accepted Answer

Before an assessor uses a market-available software platform, check who owns the account and who determines the purpose, what personal data is uploaded, where it is hosted, who can access it, whether the vendor uses the data for its own purposes or model training, how subcontractors are used, how long data is retained, and how deletion is confirmed. Put the required controls in the contract and avoid uploading more personal data than the assessment actually needs. Where possible, use programme IDs or anonymised data instead of names and government identifiers.

Question 22

Please guide us through the process for retrospective projects: completed projects or ongoing multi-year projects where initial beneficiaries may not continue next year.

Accepted Answer

For completed or ongoing multi-year projects, first conduct a data inventory: what data exists, why it was collected, where it is stored, who has access, what consent was obtained and whether the original purpose is still active. Data that is no longer needed should be deleted. For an ongoing project, do not automatically carry forward every field and every beneficiary record into the next year. Reassess the purpose and continued need, update notices/consents where the purpose or sharing changes materially, and use programme IDs so that beneficiaries can be managed without repeatedly exposing identity data. The slides also recommend assessing legacy data and considering re-consent where ongoing use continues without adequate historical consent.

Question 23

If an NGO shares beneficiary data with other NGOs after a joint programme, who is responsible for the data?

Accepted Answer

Responsibility should be allocated according to the actual processing arrangement. If the NGOs jointly decide the purpose and means of using the beneficiary data, each may have Data Fiduciary responsibilities for that processing. If one NGO simply processes data on another's instructions, it may be a Data Processor. If data is shared for a new purpose that was not covered by the original notice or consent, that new use should be assessed before the sharing occurs. A written data-sharing or processing agreement should specify the purpose, permitted fields, access, security, retention, deletion and breach handling.

Question 24

Can stating 'Supporting Documents' mask the beneficiary data requirement from the funder?

Accepted Answer

No. The label 'Supporting Documents' is not a compliance mechanism. If the funder receives a document containing personal data, that data is still subject to the DPDP framework. If the funder does not genuinely need beneficiary-level identity data, the preferred approach is to use programme IDs, redact unnecessary identifiers, or provide aggregated evidence. The slides specifically recommend identity masking so that the funder can verify programme delivery without receiving real names or Aadhaar numbers.

Question 25

Group consents during public programmes, especially with a floating crowd: how do we collect consents?

Accepted Answer

For a floating crowd, do not rely on mere presence or silence as consent. A practical approach is to define a photography/filming area, display a short notice in the relevant local language, provide a simple affirmative mechanism for people who agree, and avoid photographing people who do not consent. For children, use a parent/guardian consent process rather than trying to obtain consent from the child through crowd participation. If individual consent cannot realistically be obtained, use wide or non-identifying shots where individuals are not reasonably identifiable, or reconsider whether the photograph is necessary at all.

DPDP Act & CSR Webinar: What Every CSR Professional Needs to Know

What this webinar covers

Your questions, answered