Security, breaches and your plan
Safeguards, retention, breach steps, requests and a plan
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Security on a small budget
The Rules set a minimum: protect the data, control access, keep logs, keep backups and bind your processors. For a small NGO this starts with phones, spreadsheets and messaging habits.
Rule 6 also requires logs and personal data to be retained for one year to detect and investigate unauthorised access, a security provision in processor contracts, and organisational measures to make the safeguards effective (Rule 6(1)(e) to (g)). The standard is 'reasonable': encryption, obfuscation, masking and virtual tokens are named as examples, and the Rules set no different standard for small organisations. Failing to take reasonable security safeguards carries the highest penalty in the Schedule, up to ₹250 crore. The habits listed are practical suggestions, not text from the Rules.
How long to keep data, when to erase
Erase personal data when consent is withdrawn or the purpose is over, unless a law requires you to keep it. The Rules also require data and logs to be kept for at least one year from processing.
s.8(7) requires erasure when consent is withdrawn or as soon as it is reasonable to assume the purpose is no longer served, and requires you to make processors erase too. The fixed three-year periods in the Third Schedule apply only to very large e-commerce, gaming and social media platforms, so an NGO must judge for itself when a programme's purpose has ended. Rule 8(3) separately requires every fiduciary to retain personal data, traffic data and logs for at least one year from the date of processing, for the purposes in the Seventh Schedule, and then erase them unless another law requires longer. The Rules do not explain how this minimum fits with a request to erase sooner, and grant, audit or tax rules may require longer retention.
A breach: two reporting tracks
A lost field phone or a beneficiary list sent to the wrong group can be a personal data breach. Tell each affected person and the Board without delay, then send the Board details within 72 hours.
A personal data breach includes unauthorised processing and accidental disclosure, sharing, alteration, destruction or loss of access to personal data (s.2(u)), and Rule 7 applies to 'any' breach, with no threshold for size. The 72 hours run from when you become aware, and the Board may allow longer on a written request. The detailed report covers the facts and causes, mitigation, findings about who caused it, steps to prevent recurrence, and a report on the intimations given to affected people. Failing to notify can cost up to ₹200 crore (Schedule, item 2), so bind your processors by contract to tell you immediately.
What to tell affected people
The message to affected people must be concise, clear and plain. It goes through their user account or any mode of communication they registered with you.
Rule 7(1) says the intimation is given 'to the best of its knowledge', so you can send what you know and update later. The Rule assumes a user account or a registered mode of communication, such as a phone number, and does not say what to do for beneficiaries who have no phone or cannot read. Reaching them in person through field staff, in their language, is a reasonable approach, but that is not written in the Rule. Prepare a short template now, in your working languages.
Requests, grievances and a contact
People can ask to see, correct or erase their data, and can raise a grievance. Publish how to make requests, name a contact person, and answer grievances within 90 days at most.
The rights to access (s.11) and to correction and erasure (s.12) belong to people whose data you process on consent, including data voluntarily provided under s.7(a). Rule 14 requires you to publish on your website or app how to make requests, and the period, not exceeding ninety days, within which your grievance system responds; the Rules set no separate deadline for access or correction requests. Rule 9 requires the contact details of a person who can answer questions to be published prominently on your website or app and included in every response to a rights request; a Data Protection Officer is needed only by Significant Data Fiduciaries (s.10). The Rules do not say how an organisation with no website should publish these details, so notice boards, forms and receipts are sensible additions.
Maximum penalties in the Schedule
The Schedule sets maximum penalties, not fixed fines: up to ₹250 crore for weak security, ₹200 crore for breach-reporting or children's data failures, and ₹50 crore for other breaches.
A penalty can be imposed only where the Board, after an inquiry and a hearing, finds a breach that is 'significant' (s.33(1)), and there is no lower scale for non-profits or small organisations. The Schedule also provides up to ₹150 crore for Significant Data Fiduciary duties, and up to ₹10,000 for a Data Principal who breaches the duties in s.15, such as registering a false or frivolous complaint. Penalties are credited to the Consolidated Fund of India (s.34); the Act contains no provision for compensation to affected people.
How the Board decides
The Board must consider how serious the breach was, the type of data, repetition, any gain, what you did to reduce harm, proportionality, and the likely impact of the penalty on you.
These seven factors are listed in s.33(2)(a) to (g). They do not exempt small NGOs, but they are the reason good records matter: a dated notice, a consent log, a breach register and proof that you told people quickly all speak to gravity and mitigation. Orders of the Board can be appealed to the Appellate Tribunal within sixty days (s.29).
Your NGO's 10-step plan
Start with one owner and a list of where your data lives. The main duties begin in May 2027, and the Government has proposed bringing that date forward.
Begin with the highest-risk data: children's records, health and case files, and anything shared outside the organisation. Train field staff and volunteers, because most notices, consents and device losses happen in the field, not at head office. As of November 2026, MeitY's January 2026 proposal to shorten the timeline to twelve months has not been notified. This series is a simplified guide and not legal advice; take advice for decisions specific to your organisation.
In one line
That is the end of the NGO track. Treat the data people give you with the same care as the help you give them.