At a roundtable for NGO CEOs and CTOs hosted by Tech4Dev in September 2025, we heard several attendees raise questions about what the upcoming Digital Personal Data Protection (DPDP) Act would mean for how NGOs work with their beneficiaries.
In November 2025, the government notified the Rules, setting 13 May 2027 as the date by which most substantive compliance requirements will take effect. By then, we at Tech4Dev had already begun to think about how we could help NGOs prepare for the Act.
DPDP compliance requires more than technology. It involves changes to how organizations collect, use, store and manage personal data. Nevertheless, we felt that helping NGOs prepare for compliance was a natural extension of the work we already do.
Different Organizations, Different Levels of Support
As we considered how best to help NGOs, we identified three types of engagement.
Some organizations have the people and resources to manage compliance themselves. They need guidance, access to information and perhaps some templates to help them through the process.
A second group needs help understanding what work is required. For these organizations, we can conduct an initial assessment, prepare a data catalog and identify gaps in their existing practices. Their teams can then take responsibility for implementing the necessary changes.
The third group has more complex requirements. They may run multiple programs, use several systems or have internally developed applications that need to be modified to bring their data collection and processing practices into compliance. These organizations need more extensive support.
In early 2026, we deployed a web-based self-assessment tool that NGOs could use to get an initial understanding of their DPDP preparedness and the work ahead. While a few organizations scored well, indicating a high level of readiness, the results suggested that many had considerable work to do.
In addition to the initial three engagement models, we also began considering how we could support more organizations without having to work with each one individually. This led us to develop a cohort-based model, in which a group of NGOs would receive the information, training and resources needed to undertake the compliance work themselves.
By the middle of the year, we had developed our engagement approaches and started planning our first cohort. Our Fractional CXO (fCXO) team was working with two organizations on their compliance reviews. Additional organizations were approaching us for more extensive support. We had also begun publishing resources for organizations that wanted to prepare for compliance independently.
Our First DPDP Cohort Workshop
Our first cohort workshop was held in Bangalore in early October. Representatives from eight NGOs attended the two-day in-person program.
We began with the core requirements of the DPDP Act and then examined the practical implications for organizations, including consent, purpose limitation, data use and sharing, governance and security.
The workshop combined discussions of the requirements with group activities to help participants understand the concepts. Participants then worked individually on how they would apply what they had learned within their own organizations. Tech4Dev’s fCXO mentors were available throughout to answer questions and provide guidance. We had also partnered with the legal firm Pacta to provide legal guidance, particularly for organizations that encounter more nuanced questions about their obligations under the Act.
Participants had many questions about the Act’s impact on their NGOs, which Pacta and Tech4Dev addressed. Most of them clustered around what to do with data collected in the past, how to collect consent for existing beneficiaries and how to collect parental consent for children.
At the end of the workshop, participants reported that they had a better understanding of the work required and a roadmap for taking it forward.
Compliance Requires Organization-Wide Participation
One point we stressed throughout the workshop was that DPDP preparedness requires the involvement of the entire organization with changes to existing processes across different functions. Human resources and finance teams must review how they collect and store employee data. Program teams need to gain consent before the collect and process beneficiary data.
These changes cannot be made by the technology team alone. Each function needs to understand its responsibilities and participate in the work.
Looking Ahead
Over the next ten weeks, we will continue working with the participating NGOs as they put their plans into practice. Participants will have opportunities to ask questions, and we will review their progress and provide assistance where needed.
The workshop was the beginning of the process. The next ten weeks will be about helping participating organizations make progress on the changes they have identified and move towards DPDP compliance.
We are also planning workshops for foundations and ecosystem organizations that themselves work with many NGOs.
We will be starting another cohort in January for organizations that were not able to join us in October.
Beneficiaries entrust NGOs with their personal data, and the DPDP Act establishes requirements for how organizations collect, use and protect that data. Helping NGOs put those requirements into practice is an important part of the work ahead, and one where we believe Tech4Dev can make a useful contribution.
