Login
Introduction:
With the Digital Personal Data Protection Rules now notified and full enforcement set for 13 May 2027, every company running a CSR programme under Section 135 faces a question that has not yet been tested: where does responsibility for beneficiary data actually sit? CSR programmes are, by their nature, data-intensive at the individual level — names, phone numbers, identity-linked records, photographs, financial disbursement details — most of it collected on the ground by implementing partners. Yet the Board’s monitoring duty under the Companies Act does not stop at the cheque.
This session brings together a leading authority in Indian philanthropy governance and a compliance- infrastructure practitioner to map this intersection clearly, and to help member companies understand what prudent preparation looks like while there is still runway.
Objective :
To equip Boards, CSR leadership, and compliance functions with a clear, practical understanding of how the DPDP Act intersects with their existing CSR governance obligations — and to enable informed decisions on data governance, partner contracts, and Board documentation ahead of the May 2027 enforcement deadline.
Topics Covered:
• The DPDP Act and Rules in brief: the three-phase enforcement timeline, the substantive obligations activating on 13 May 2027, and the penalty regime (up to ₹250 crore).
• The unsettled question: when a Company’s Section 135 monitoring duty meets the DPDP Act’s “determines the purpose” and “on its behalf” language, does the funder become a Data Fiduciary — even when it receives only aggregates?
• Why common assumptions may not hold: aggregate-only reporting, independent M&E partners, and contractual liability-shifting to NPOs — and the limits of each under Section 8.
• The cascade-liability picture: how an implementing partner’s exposure can flow back to the corporate funder reputationally and operationally.
• What “Data Fiduciary” actually means for NPO partners — and why each implementing organisation is an individual Data Fiduciary, not part of any “joint” arrangement.
• Practical readiness: consent quality, data security, breach notification, Data Principal rights, retention and erasure, and the Board documentation that demonstrates the monitoring duty was met.
• Building compliant infrastructure across a multi-partner ecosystem without disturbing arm’s- length governance — and the role of unified compliance platforms.
• Open Q&A with both speakers.
Key Takeaways:
• A clear grasp of the DPDP timeline, and why a 10-month implementation runway makes this a present-day Board decision, not a 2027 one.
• The ability to frame the Data Fiduciary question for their own organisation, rather than waiting for regulatory clarity that may arrive only after enforcement begins.
• A working sense of where corporate CSR programmes are most exposed, and what to ask of implementing partners now.
• An understanding of how proper data governance produces stronger monitoring, deduplication, and verification — as a by-product, not an optional add-on.
Target Audience:
Board members and Directors with CSR oversight; CSR Heads and programme leadership; Company Secretaries and Legal / Compliance functions; CFOs and risk officers; and senior teams at corporate foundations and M&E partners.
Taking This Forward:
Attendees who wish to assess their Company’s DPDP exposure can initiate a confidential CSR data-governance gap analysis — a structured diagnostic jointly offered by the Centre for Advancement of Philanthropy and Blue Pencil Strategies. The review benchmarks an organisation’s programmes and partner contracts against the May 2027 obligations, identifies where exposure sits across the funder– partner chain, and sets out what the available runway allows. It is offered as an orientation step, not a
commitment.
Speaker Profiles :
Noshir H. Dadrawala | Chief Executive Officer, Centre for Advancement of Philanthropy Noshir H. Dadrawala has a career spanning 40 years in the nonprofit sector, working with a diverse range of organisations — from large, established national and global institutions, to corporate and family grant-makers, to start-ups. His main role at the Centre for Advancement of Philanthropy involves simplifying the confusing and complex maze of laws governing the sector. His legal expertise is widely recognised, as is his deep understanding of compliance within philanthropy. He serves as a member on the advisory board of
the International Center for Not-for-profit Law (ICNL). Earlier, he served on the Board of Worldwide Initiatives for Grantmaker Support (WINGS), Resource Alliance, and the Asia Pacific Philanthropy Consortium (APPC). He is a trustee of numerous foundations in India, has authored several books, and is an active commentator on NPO-related issues in India.
Debasis Ghosh | Director, Blue Pencil Strategies
Debasis Ghosh is Director at Blue Pencil Strategies, a Mumbai-based company providing unified compliance and programme-monitoring infrastructure for India’s social sector. Blue Pencil’s platform has tracked over ₹1.75 billion in CSR and programme funds across 474,000+ beneficiaries, identifying ghost enrolments and preventing duplicate and fraudulent disbursement at scale. Its work sits at the
