Funders, partners and research

Who asks you for people's data

Funders, departments and partners all ask for data. Sharing is itself processing, so each flow needs a lawful ground, a clear purpose, and no more data than that purpose needs.

'Processing' includes sharing, disclosure and making available (s.2(x)). Consent covers only the specified purpose in your notice and the data necessary for it (s.6(1)), so a funder that was never mentioned is not covered. Data that cannot identify any individual is not personal data (s.2(t)), which is why totals and percentages are the simplest thing to report; take care with very small groups, where a person can still be picked out. Where data is likely to be disclosed to another fiduciary, you must ensure it is complete, accurate and consistent (s.8(3)).

Processor or separate fiduciary?

A partner that handles data only on your instructions is your Data Processor, and you stay responsible. A funder that uses the data for its own ends needs a ground of its own, usually consent.

s.8(1) makes the fiduciary responsible for processing done on its behalf 'irrespective of any agreement to the contrary', so a contract cannot shift that duty, and s.8(2) allows a processor only under a valid contract. The Act says a fiduciary may determine purposes 'in conjunction with other persons' (s.2(i)) but gives no further rules for shared projects, so in a consortium write down who decides what. If a funder wants named beneficiary data for its own audit or CSR communications, say so in the notice and get consent for that purpose, or agree on grouped or sample-based reporting instead.

What to put in partner agreements

The Act requires a valid contract with every processor, and the Rules require it to cover security safeguards. The other terms here help you meet your own duties.

Only two things are stated by the law: a valid contract (s.8(2)) and an appropriate provision on reasonable security safeguards (Rule 6(1)(f)). The rest follows from duties that stay with you: making processors stop on withdrawal (s.6(6)), making them erase (s.8(7)(b)), reporting breaches (s.8(6)) and retaining data and logs for at least one year (Rule 8(3)). When you are the processor for a department or a larger NGO, expect these clauses and ask for them if they are missing. A grant agreement is a good place to fix what data will and will not be reported to the funder.

Sharing with government departments

With government partners, check which role you are in. A legal duty to disclose information to the State is a legitimate use. An informal request for a list is not, by itself.

s.7(d) covers fulfilling an obligation under a law to disclose information to the State, in line with that law's own disclosure provisions. s.7(b) and s.7(c) are grounds for the State itself, to deliver prescribed benefits and to perform functions under law. The Act does not spell out what an NGO should do when an official asks informally for a beneficiary list; ask which law or scheme guideline the request is made under, and record the answer. Under s.11(1)(b), a person who gave consent can ask for the identities of all fiduciaries and processors her data was shared with, so keep a simple register of what went to whom.

Surveys and impact studies

The Act does not apply to processing necessary for research, archiving or statistics, if the data is not used for any decision about a specific person and the Second Schedule standards are met.

The Second Schedule standards include lawful processing, using only the data necessary, reasonable efforts at accuracy, keeping data only as long as needed, reasonable security safeguards, and accountability of the person who decides purpose and means. The Act does not define 'research' or say who may claim the exemption, so it is not limited to universities, but an NGO relying on it should be able to show a real study design. The exemption says nothing about research ethics; funders or other rules may still expect consent and ethics review.

Research: where the line falls

A survey used only for overall findings may qualify. Once the same data is used to select, exclude or follow up a specific person, the exemption no longer covers that use.

Keep research datasets separate from programme databases, and remove names, phone numbers and ID numbers as early as the study allows; this is good practice, and the Schedule itself does not use the word anonymise. Monitoring data is often mixed: the same household survey may feed both an evaluation and a beneficiary list, and the service-delivery use is ordinary processing that needs consent or another ground. The text does not say what happens if you later want to use exempt research data for individuals, so plan on asking for consent.

Sending data to funders abroad

Personal data may be sent outside India unless the Government restricts a country by notification. Sharing with a foreign funder is still sharing, so it needs a ground like any other.

s.16(1) lets the Central Government restrict transfers to notified countries or territories; the Act and Rules themselves name none, so check for notifications. Rule 15 makes transfers subject to requirements the Government may specify for making data available to a foreign State, or to a person or entity under the control of, or an agency of, such a State, which could matter for bilateral aid agencies. s.16(2) preserves any other Indian law that restricts transfers or gives higher protection. Storing files on a server outside India, or on a funder's overseas reporting portal, also moves the data abroad.

Donors are Data Principals too

Donors have the same rights as beneficiaries. Use their details for the donation they made, and ask before adding them to appeals, newsletters or published donor lists.

A donor who fills in a form to give is voluntarily providing data for a specified purpose (s.7(a)), which covers processing the gift and sending the receipt. Where a tax or other law obliges you to report donor details to the State, s.7(d) covers that disclosure, and s.8(7) lets you keep records a law requires; this guide does not list those laws. Fundraising appeals are a separate purpose, and the Act has no general 'legitimate interest' ground for marketing, so rely on consent and honour withdrawals (s.6(4)).

In one line

That is sharing and research. Last: keeping data secure, handling a breach, and a step-by-step plan.