DPDP readiness for the social sector
Your beneficiary data deserves better than a spreadsheet. And now, the law agrees.
The DPDP Act applies to every organisation in India that handles personal data digitally, including nonprofits. Know exactly where you stand in 15 minutes.
Built by EdZolaZoho Advanced Partner100+ social-sector organisations150+ systems built
Every system. Every flow. One clear picture.
The everyday reality
These habits look normal. The law sees them differently.
Children's data, no consent trail
Collected through apps, forms and paper, without verifiable parental consent records to show for it.
Records kept for 8–10 years
With deletion handled manually, if at all. Old data is quiet risk that compounds every year.
Sharing without agreements
Data flowing to government departments, partners and vendors, with no signed data protection agreements behind it.
Not negligence. Normality. These are the everyday habits of our entire sector, and from May 2027 they carry penalties of up to ₹250 crore.
DPDP, in plain words
What the law actually asks of you.
The Digital Personal Data Protection Act, 2023 is India's data privacy law. If your organisation keeps any personal information digitally (beneficiary records, donor lists, volunteer details, student data), it applies to you. Here's what it expects, translated for the social sector.
Ask before you collect
You need informed consent, or another valid legal basis, before collecting personal data. For anyone under 18, that means verifiable consent from a parent or guardian. A student filling in a form is not consent from their parent.
Tell people why
Every collection point (a field app, a paper form, a website) must carry a clear notice: what you're collecting, why, and who to contact. In language your beneficiaries actually understand.
Use it only for that purpose
Data collected for attendance can't quietly become a fundraising list. Collect the minimum you need, use it for the stated purpose, and nothing more.
Honour people's rights
Beneficiaries, donors and volunteers can ask to see their data, correct it or have it erased, and raise a grievance if you don't respond. You need a working way to receive and answer these requests, not just good intentions.
Guard it, and let it go
Reasonable security safeguards are mandatory, data breaches must be reported, and data must be deleted once its purpose is served. "We keep everything forever, just in case" is now a liability, not diligence.
Own what you share
Sharing with government departments, funders, vendors or tech providers? You remain responsible. That means written agreements and oversight for everyone who touches your data on your behalf.
Who enforces this? The Data Protection Board of India, with penalties of up to ₹250 crore per instance for serious failures. There is no exemption for nonprofits. But compliance isn't really about avoiding penalties. It's about being worthy of the trust your communities already place in you.
How it works
A 15-minute conversation. Not a 200-question form.
Talk.
A voice AI interview asks only what's relevant. It adapts its path based on your answers, like a good consultant, not a survey.
See.
Your complete data map, every system and every flow from field apps to WhatsApp groups, with each type of data rated by risk.
Act.
A prioritised action plan spanning 30 to 180 days, with owners, timelines and effort estimates for every fix.
All personal data stays within your organisation. We never hold your beneficiary or donor data.
Pilot results · June 2026
Three NGOs looked. Here's what they found.
In June 2026, U&I Trust, Adhyayan Quality Education Foundation and Auroville Language Laboratory completed the ZolaShield pilot.
Well-run organisations, everyday habits. Every one of them scored in the high-risk band.
Every system and flow made visible, from field apps in government schools to WhatsApp coordination groups.
Prioritised fixes with owners, timelines and effort estimates. Compliance turned into a to-do list.
The assessment didn't just show us the gaps. It made compliance feel achievable.
A pilot organisation, June 2026
U&I Trust on getting DPDP-ready
What the assessment surfaced, and what they're fixing first.
Auroville Language Laboratory, from zero to DPDP-ready
Mita, Co-Director, on turning compliance into a clear, prioritised roadmap.
What we offer
Three tiers. One journey. Start where you are.
Assess
₹10,000–20,000, by team size
Delivered in two weeks
| 1–50 members | ₹10,000 |
| 51–100 members | ₹15,000 |
| 101–200 members | ₹20,000 |
| 200+ members | Talk to us |
- 15-minute voice assessment
- Scored risk report
- Complete map of your data: every system, every flow
- Prioritised 180-day action plan
- Fee credited against Comply if you continue within 60 days
Comply
Pricing on request
3–6 months
- Everything implemented, not just documented
- Consent systems across web, WhatsApp, field and paper
- A rights portal for your beneficiaries
- Policies written in plain language
- Staff and field-team training
Sustain
Pricing on request
Ongoing, annual
- Annual re-assessment and re-scoring
- Regulatory updates, translated into actions
- Refresher training for your team
- Support on call when questions come up
No lock-in. The assessment report is yours regardless of whether you continue.
Why EdZola
Built by people who've lived your problems.
75% of our work is with the impact sector
We understand programme cycles, funder expectations, and what data collection actually looks like at the last mile.
We implement systems, not just policies
Working consent records, a way to handle rights requests, and audit trails. Not a binder that sits on a shelf.
Your data never leaves your organisation
Everything runs inside your organisation. We manage the tools; we never hold beneficiary or donor data.
150+ social-sector systems built
Assessed and delivered by the team behind 150+ working systems for 100+ organisations across India.
DPDP's core obligations apply from May 2027. A full compliance journey takes 4–6 months. The window is open, but it is closing.
Start your assessmentQuestions we hear most
Straight answers, in plain words.
Does DPDP really apply to small NGOs?
Yes. The Act applies to every organisation in India that handles personal data digitally, whatever its size or legal form. There is no exemption for nonprofits. If you keep beneficiary records, donor lists or volunteer details on a computer, a phone or in the cloud, it applies to you.
What happens in the 15-minute assessment?
A voice AI interview asks about the systems you use, the data you collect and how it moves: field apps, paper forms, spreadsheets, WhatsApp groups and partners. It only asks what's relevant to your answers. Within two weeks you get your data map, a scored risk report and a prioritised 180-day action plan.
Who sees our data during the assessment?
The assessment asks how you handle data, not for the data itself. We never see or hold your beneficiary or donor records, and all personal data stays within your organisation. The report is yours.
What if we can't afford the full compliance work?
Start with Assess, from ₹10,000 based on your team size. Your action plan is prioritised, so you'll know which fixes matter most and which your own team can take on. There's no lock-in, and if you do continue to Comply within 60 days, the assessment fee is credited.
What do funders actually ask for?
More funders and CSR partners now ask grantees how they protect the personal data of the people they serve: consent, retention, data-sharing agreements and who has access. A scored assessment and an action plan with owners and timelines give you a clear, documented answer.
The only difference between the prepared and the exposed is who chose to look first.
Fifteen minutes of conversation. Two weeks to a complete picture. From ₹10,000, based on your team size.