The DPDP Act for communities: what organisers need to know

Who the DPDP Act calls responsible

The Act applies to digital personal data, which includes a phone number in a WhatsApp group or a row in a spreadsheet. It names three roles. The data principal is the person the data is about: your member. The data fiduciary decides why and how the data is processed. A data processor processes it on the fiduciary's behalf.

For a community's member data, the fiduciary is usually the community itself, acting through its owner or committee. You decide which details to collect, which groups people join and what the data is used for. That stays true whatever tools you use. A form builder, a spreadsheet host or a platform such as Milvao processes the data for you, but the decisions, and the duties that come with them, remain yours.

When a community uses Milvao, the community is the data fiduciary for its members' data and Milvao is its data processor, under a contract. Our DPDP compliance page sets out how that works and maps each duty to the feature that supports it, and the data processing agreement is published in draft.

Notice and consent, purpose by purpose

Consent under the Act has to be free, specific, informed and unambiguous, and given after a clear notice. The government's summary of the DPDP Rules, released when they were notified on 14 November 2025, says consent notices must be standalone, clear and simple, and must explain the specific purpose for which data is collected. People can withdraw consent at any time, and it should be as easy to withdraw as it was to give.

For a community, the useful habit is to think purpose by purpose. Being added to a group, being listed in a directory, being introduced to another member and receiving offers of paid services are different uses of the same phone number. A member who agreed to one hasn't agreed to the others. Each new purpose deserves its own short notice and its own yes.

Milvao is built this way. Members join by sending a message themselves from a join link, and the first message links to the community's privacy notice. Receiving introduction requests is off until a member turns it on. A member who asks for help chooses separately whether their number may be shared for that request, and the member who is asked gives their consent by accepting that one introduction. Each consent and withdrawal is recorded with its purpose and time. Our guide to double opt-in introductions explains the thinking behind asking both people.

Collect less, and say why

Two principles of the Act shape what you collect: purpose limitation, using data only for the purpose you stated, and data minimisation, collecting only what that purpose needs. Both are easier to follow if you decide the purpose first and the fields second.

• A directory for introductions rarely needs more than a name, a city, what someone offers and the cities they serve.
• Ask for anything extra only with a reason members can read, and make it optional where you can.
• Avoid sensitive topics such as health, religion or finances unless the community genuinely needs them, and take advice if it does.
• Don't copy numbers out of a WhatsApp group into a list for a new purpose without telling members and asking them.
• The Act has extra protections for children's data. If your community has members under 18, get advice before collecting anything about them.

Members' rights under the DPDP Act for communities

The framework gives people the right to access a summary of their data, to have it corrected, completed and updated, to have it erased, to withdraw consent, to raise a grievance and to nominate someone to act for them. The government's press release on the Rules says organisations must respond to requests within 90 days at most. The table below shows what each right can look like in a community, and how Milvao supports it.

Keeping data safe, and deleting it on time

The Act asks fiduciaries to protect personal data with reasonable security safeguards and to erase it once it is no longer needed for its purpose. For a community, that usually means three things: limit who can see members' details, keep data in places with sensible access controls, and remove what you no longer need.

Spreadsheets shared by link are the most common weak point. So are old event lists, exported group member lists and forms nobody closed. Decide how long each kind of data is useful, write it down, and delete on that schedule. When a member leaves, remove them from your lists as well as the group.

Milvao keeps each community's data separate and encrypts phone numbers. Numbers are masked to the last 4 digits on every operator screen, and only the owner can export full numbers, with a reason recorded in the activity log. Retention periods are fixed: message text is kept for 90 days, raw delivery data for 7 days and audit and security logs for 1 year. The full list is in Your data and how long we keep it.

The government's summary of the Rules lists penalties of up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹50 crore for other violations. The Rules came with an 18-month phased timeline for compliance, which makes now a sensible time to tidy up.

If something goes wrong, and a checklist

A personal data breach in a community can be as simple as a member list sent to the wrong group or a shared sheet left open to anyone with the link. Under the DPDP framework, a breach is to be reported to the Data Protection Board of India and to the people affected. Write down who on your team decides what to do, contain the problem first, record what happened and when, and take advice on the notifications. Milvao follows a set breach process for the data it processes, described on the security page.

A short checklist to work through with your team:

1. 1Write down what member data you hold, where it lives and who can see it.
2. 2Write one sentence on the purpose of each kind of data, and drop what has no purpose.
3. 3Give members a clear notice for each purpose and ask for consent before a new use.
4. 4Make it easy for members to see, correct and delete their data, and answer requests well within 90 days.
5. 5Limit access, close old shared links and set how long each kind of data is kept.
6. 6Agree who handles a breach and how you would tell members and the Data Protection Board.
7. 7Check your setup with an adviser, especially if you handle a lot of member data.