Does it apply to me
Are NGOs and charities exempt from DPDP?
- Short answer
- No. There is no non profit exemption in the DPDP Act. An NGO holding donor records or beneficiary data is a Data Fiduciary with the full baseline. Beneficiary data is often more sensitive than commercial data, not less.
The Act is drafted around what is done with personal data, not around whether the organisation distributes profit. Not being commercial does not reduce the risk to the individual.
Beneficiary records frequently include health information, caste or community data, information about children, or details of people in vulnerable circumstances. That is exactly the data whose misuse causes the most harm.
Donor data brings its own issue, because it is often shared with fundraising platforms and agencies without any contract governing what those parties may do with it.
Where this comes from
- Section 4 and Section 8, DPDP Act 2023
The mistake people make
Relying on registration under a charity or trust statute as though it created a data protection exemption. It does not.