ImpactMojoThe Digital Personal Data Protection Act, 2023 — annotated for the development sector
The statute itself, reproduced word-for-word from the authoritative India Code text — and beside each provision, a plain-language reading and a development-sector practitioner's note: what the law means when the "personal data" is your beneficiary lists, consent forms, photographs and children's records.
PDF · 9 pages · 7 core sections · delivered to your inbox within 24 hours of payment.
Why an annotated bare Act?
The DPDP Act is not written for NGOs — it's written for "Data Fiduciaries." But if your organisation holds beneficiary lists, runs consent forms, photographs the people you serve, or works with children, you are a Data Fiduciary, and this law is now yours to comply with.
This guide keeps the two things cleanly separated. The statute is exact — transcribed verbatim from the authoritative India Code version, illustrations and all. The annotations are ours: a plain-language gloss and a practitioner's note written for the development sector — what "consent" means for a thumbprint on a field form, why bundled consent for photos-and-data no longer works, the verifiable parental consent you now need before collecting a child's data, and the erasure duty that turns old beneficiary databases into a liability. It's the difference between reading the law and knowing what to change on Monday.
What's inside — the seven sections you actually use
- § 4 — Grounds for processing. The only two lawful bases — consent, or a defined legitimate use — and why every MIS field needs one.
- § 5 — Notice. What your consent form must now tell people, in the language they actually read.
- § 6 — Consent. Free, specific, withdrawable — and why "bundled" consent for data-plus-photos-forever is dead.
- § 8 — Obligations of a Data Fiduciary. Vendor contracts, security, breach notification, and the duty to erase.
- § 9 — Children's data. Verifiable parental/guardian consent, no harmful processing, no tracking or targeted ads — the section most likely to catch NGOs.
- § 11 — Right to access. Beneficiaries can ask what you hold and who you shared it with — and you must answer.
- § 33 — Penalties. The Schedule's numbers, what the Board weighs, and the realistic risk for a small NGO.
Each section: the verbatim statutory text (with the Act's own illustrations), a one-line plain-language reading, and a development-sector practitioner's note.
Sample
A watermarked preview of the format. The file you receive is clean, print-ready and fully yours.
This is the section most likely to catch development NGOs — school programmes, child sponsorship, adolescent health and child protection all process children's data. You now need verifiable parental or guardian consent before collecting a child's data. Donor-sponsorship models that circulate a child's photo and details need a hard rethink under 9(1)–9(2).
Buy it — ₹350
Pay by UPI
Scan the code, or pay to the UPI ID below (amount ₹350).
Add your email in the payment note, or fill the form so we know where to send it.
Confirm your order
Paid? Tell us where to send the PDF. Delivered within 24 hours.
How delivery works
- Pay ₹350 by UPI (scan the QR or use impactmojo@ibl), or order on WhatsApp.
- Fill the short form with your email and the UPI reference number.
- We confirm the payment and email you the clean, print-ready PDF — within 24 hours, usually much sooner.
Questions? Contact us. Refunds per our refund policy.
Pair it with the free Ethics & DPDP checklist
This annotated Act tells you what the law says; the checklist helps you act on it — consent, data minimisation and breach readiness for your own programmes. And see the free plain-English Law Guides for the social sector.
FAQ
Is the statutory text reliable?
Yes. The Act is reproduced verbatim from the authoritative India Code version (Act 22 of 2023), illustrations and all. Nothing is paraphrased. The annotations are clearly marked as ImpactMojo's own commentary.
The Act mentions "as may be prescribed" a lot — is it fully in force?
The Act is passed, but several provisions operate through the Digital Personal Data Protection Rules, which govern operational detail (e.g. how "verifiable consent" is obtained). The guide flags this; check the current Rules for the mechanics. The obligations and principles here are the Act's own.
Is this legal advice?
No. The annotations are practitioner commentary to help you understand and apply the Act in development work — they are not legal advice, and do not create a lawyer–client relationship. For a specific matter, consult a lawyer.
What exactly do I get?
A single print-ready A4 PDF (9 pages) with seven core sections of the DPDP Act — §§ 4, 5, 6, 8, 9, 11 and 33 — each with the verbatim text, a plain-language reading, and a development-sector practitioner's note.
How fast is delivery?
Within 24 hours of confirming payment, usually much sooner. We verify the UPI reference, then email you a private download link.
Can I print it and use it with my team?
It's licensed for your own and your organisation's learning and field use — print it, annotate it, take it into a training. Please don't resell or post it publicly.