Does the Act apply to your NGO?
Who is covered, which role you play, and when it starts
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
No charity exemption
Doing good work does not change the rules. A trust, society or Section 8 company has the same duties under the Act as a business.
A Data Fiduciary is any person who alone or with others determines the purpose and means of processing personal data (s.2(i)). 'Person' includes a company, an association of persons or body of individuals, whether incorporated or not, and every artificial juristic person (s.2(s)). Nothing in the Act turns on profit, turnover or size.
Whose data do you hold?
Most NGOs hold more personal data than they realise. Each of these people is a Data Principal, with rights over the data you hold about them.
Personal data is any data about an individual who is identifiable by or in relation to it (s.2(t)). The Act has no separate 'sensitive' category, so health, caste or income details get the same baseline protection as a phone number. They can cause far more harm if leaked, and the Board looks at the type and nature of the data when it sets a penalty (s.33(2)(b)). For a child, the Data Principal includes the parents or lawful guardian (s.2(j)).
Digital records, and paper you digitise
The Act covers personal data in digital form, and paper records once you digitise them. A register that stays on paper is outside it, until someone types it up or scans it.
s.3(a) applies the Act to personal data collected in digital form, or collected on paper and digitised later, and 'processing' means a wholly or partly automated operation on digital personal data (s.2(x)). The Act does not define 'digitised'; typing a register into a spreadsheet or scanning it clearly fits, and it is safest to treat a phone photo of a register the same way. s.3(c) excludes data made public by the person herself or under a legal obligation, and data an individual processes for personal or domestic purposes.
Fiduciary or processor?
For your own programmes you are the Data Fiduciary. When you only handle data for a government department that decides the purpose and means, you may be its Data Processor.
A Data Processor processes personal data on behalf of a Data Fiduciary (s.2(k)). The fiduciary stays responsible for its processor (s.8(1)) and must engage it under a valid contract (s.8(2)), so ask for the roles to be written into your MoU. The label on paper does not settle it: if you add your own data fields, or reuse scheme data for your own reports or fundraising, you are a fiduciary for that use. Many NGOs are a fiduciary for some data and a processor for other data.
It starts in three phases
For NGOs the date that matters is May 2027. That is when the duties on notice, consent, security, breach reporting, children's data and people's rights begin.
Rule 1 brings Rules 1, 2 and 17 to 21 into force on publication, Rule 4 one year later, and Rules 3, 5 to 16, 22 and 23 eighteen months after publication. Sources differ by a day on the exact dates, so this guide gives only the month. In January 2026 MeitY proposed shortening the eighteen months to twelve. As of November 2026 no amendment has been notified, so check the Gazette before relying on May 2027.
Possible relief by notification
The Government can exempt notified classes of Data Fiduciaries from a few duties, based on the volume and nature of their data. Do not plan around this unless a notification clearly covers your NGO.
s.17(3) names startups as an example but is not limited to them; the provisions that can be switched off are s.5, s.8(3), s.8(7), s.10 and s.11. Separately, s.17(5) lets the Government, within five years of commencement, declare that any provision does not apply to a class of fiduciaries for a set period. The Act and Rules themselves contain no such notification for NGOs, so check the Gazette and MeitY's website for the current position.
Four questions to answer first
Before any policy or form, answer four simple questions. They tell you which data is covered and which role you play for each programme.
Write the answers in a simple table: programme, whose data, what data, where it is stored, who it is shared with, and whether you are the fiduciary or a processor. The Act does not require this record in so many words, but s.8(4) requires appropriate technical and organisational measures to observe the Act, and every later chapter builds on this list.
In one line
That is who the Act covers. Next: how to ask for consent properly in the field.