# The DPDP Act for communities: what organisers need to know

> The DPDP Act for communities comes down to a few duties. If you decide why and how members' personal data is used, you are usually its data fiduciary. Give a clear notice for each purpose and get consent, collect only what that purpose needs, let members access, correct and erase their data, keep it safe, delete it when it is no longer needed and handle breaches properly. This is general information, not legal advice.

Source: https://milvao.com/dpdp-act-for-communities · Updated 2026-11-06

Running a community means holding personal data: names, phone numbers, the city someone lives in, what they do for a living, sometimes photos and answers to your own questions. Most organisers collect it without much thought, in a group, a form or a spreadsheet. India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 give that everyday work a legal frame.

What follows is the DPDP Act for communities in plain terms, for the people who run business networks, founder communities, associations and alumni groups: who is responsible, what consent and notice involve, members' rights, keeping and deleting data, and what to do if something goes wrong, with a checklist at the end. It is general information to help you think about your community, not legal advice. Check your own duties with an adviser, especially if you handle a lot of member data.

## Who the DPDP Act calls responsible

The Act applies to digital personal data, which includes a phone number in a WhatsApp group or a row in a spreadsheet. It names three roles. The data principal is the person the data is about: your member. The data fiduciary decides why and how the data is processed. A data processor processes it on the fiduciary's behalf.

For a community's member data, the fiduciary is usually the community itself, acting through its owner or committee. You decide which details to collect, which groups people join and what the data is used for. That stays true whatever tools you use. A form builder, a spreadsheet host or a platform such as Milvao processes the data for you, but the decisions, and the duties that come with them, remain yours.

When a community uses Milvao, the community is the data fiduciary for its members' data and Milvao is its data processor, under a contract. Our [DPDP compliance](https://milvao.com/dpdp-compliance) page sets out how that works and maps each duty to the feature that supports it, and the [data processing agreement](https://milvao.com/dpa) is published in draft.

## Notice and consent, purpose by purpose

Consent under the Act has to be free, specific, informed and unambiguous, and given after a clear notice. The government's summary of the DPDP Rules, released when they were notified on 14 November 2025, says consent notices must be standalone, clear and simple, and must explain the specific purpose for which data is collected. People can withdraw consent at any time, and it should be as easy to withdraw as it was to give.

For a community, the useful habit is to think purpose by purpose. Being added to a group, being listed in a directory, being introduced to another member and receiving offers of paid services are different uses of the same phone number. A member who agreed to one hasn't agreed to the others. Each new purpose deserves its own short notice and its own yes.

Milvao is built this way. Members join by sending a message themselves from a join link, and the first message links to the community's privacy notice. Receiving introduction requests is off until a member turns it on. A member who asks for help chooses separately whether their number may be shared for that request, and the member who is asked gives their consent by accepting that one introduction. Each consent and withdrawal is recorded with its purpose and time. Our guide to [double opt-in introductions](https://milvao.com/double-opt-in-introductions) explains the thinking behind asking both people.

## Collect less, and say why

Two principles of the Act shape what you collect: purpose limitation, using data only for the purpose you stated, and data minimisation, collecting only what that purpose needs. Both are easier to follow if you decide the purpose first and the fields second.

- A directory for introductions rarely needs more than a name, a city, what someone offers and the cities they serve.
- Ask for anything extra only with a reason members can read, and make it optional where you can.
- Avoid sensitive topics such as health, religion or finances unless the community genuinely needs them, and take advice if it does.
- Don't copy numbers out of a WhatsApp group into a list for a new purpose without telling members and asking them.
- The Act has extra protections for children's data. If your community has members under 18, get advice before collecting anything about them.

In Milvao, every custom [profile question](https://milvao.com/help/community/profile-questions) needs a purpose members can read, and the owner decides who can see each answer. Profile answers are never sent to the AI model, and government ID numbers are refused. Our guide on [how to create a member directory](https://milvao.com/how-to-create-a-member-directory) covers field choices in more detail.

## Members' rights under the DPDP Act for communities

The framework gives people the right to access a summary of their data, to have it corrected, completed and updated, to have it erased, to withdraw consent, to raise a grievance and to nominate someone to act for them. The government's press release on the Rules says organisations must respond to requests within 90 days at most. The table below shows what each right can look like in a community, and how Milvao supports it.

Members' rights under the DPDP Act and how a community can meet them

| Right | What it means for a community | How it works in Milvao |
| --- | --- | --- |
| Access | A member can ask what you hold about them and how it is used | The member sends MY DATA; the owner exports their data from Settings, Data requests |
| Correction and updating | A member can fix wrong or old details | The member sends PROFILE for a private link to edit their profile |
| Erasure | A member can ask you to delete their data | The member sends DELETE MY DATA; offers stop at once and the owner completes it |
| Withdrawing consent | A member can stop a use of their data as easily as they agreed to it | PAUSE, STOP, or switching introduction requests off |
| Grievance | A member needs someone to complain to | Members contact the community's team or Milvao; each request is tracked with a due date |
| Nomination | Someone can act for a member who can't | A nominee contacts the team or Milvao, and the request is logged for the owner |

In Milvao, each request gets a 30-day due date and is marked overdue after that, well inside the outer limit. [Handling members' data requests](https://milvao.com/help/privacy-and-security/data-requests) walks owners through each step.

## Keeping data safe, and deleting it on time

The Act asks fiduciaries to protect personal data with reasonable security safeguards and to erase it once it is no longer needed for its purpose. For a community, that usually means three things: limit who can see members' details, keep data in places with sensible access controls, and remove what you no longer need.

Spreadsheets shared by link are the most common weak point. So are old event lists, exported group member lists and forms nobody closed. Decide how long each kind of data is useful, write it down, and delete on that schedule. When a member leaves, remove them from your lists as well as the group.

Milvao keeps each community's data separate and encrypts phone numbers. Numbers are masked to the last 4 digits on every operator screen, and only the owner can export full numbers, with a reason recorded in the activity log. Retention periods are fixed: message text is kept for 90 days, raw delivery data for 7 days and audit and security logs for 1 year. The full list is in [Your data and how long we keep it](https://milvao.com/help/privacy-and-security/data-and-retention).

The government's summary of the Rules lists penalties of up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹50 crore for other violations. The Rules came with an 18-month phased timeline for compliance, which makes now a sensible time to tidy up.

## If something goes wrong, and a checklist

A personal data breach in a community can be as simple as a member list sent to the wrong group or a shared sheet left open to anyone with the link. Under the DPDP framework, a breach is to be reported to the Data Protection Board of India and to the people affected. Write down who on your team decides what to do, contain the problem first, record what happened and when, and take advice on the notifications. Milvao follows a set breach process for the data it processes, described on the [security](https://milvao.com/security) page.

A short checklist to work through with your team:

1. Write down what member data you hold, where it lives and who can see it.
2. Write one sentence on the purpose of each kind of data, and drop what has no purpose.
3. Give members a clear notice for each purpose and ask for consent before a new use.
4. Make it easy for members to see, correct and delete their data, and answer requests well within 90 days.
5. Limit access, close old shared links and set how long each kind of data is kept.
6. Agree who handles a breach and how you would tell members and the Data Protection Board.
7. Check your setup with an adviser, especially if you handle a lot of member data.

## Questions

### Does the DPDP Act apply to a WhatsApp group?

The Act applies to digital personal data, which includes phone numbers in a group. How it applies to your community depends on what you collect and why, so check with an adviser. Using numbers from a group for a new purpose generally needs a clear notice and consent.

### Is there a DPDP certificate a community or tool can get?

No. There is no DPDP certification. Look for what a tool does to support your duties, such as separate consents, data requests and set retention periods. Milvao's DPDP compliance page lists what it does.

### Who is the data fiduciary when a community uses Milvao?

Usually the community, through its owner, because it decides why members' data is collected and used. Milvao acts as the community's data processor for members' data, under a contract.

### How quickly must we answer a member's data request?

The government's press release on the DPDP Rules says within 90 days at most. Milvao gives each request a 30-day due date so owners answer well inside that.

## Sources

- [Press Information Bureau: Government notifies DPDP Rules to empower citizens and protect privacy (14 November 2025)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014) (checked 2026-11-05)
- [Press Information Bureau: DPDP Rules, 2025 Notified (17 November 2025)](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf) (checked 2026-11-05)

## Related pages

- [DPDP compliance at Milvao](https://milvao.com/dpdp-compliance)
- [Who sees what](https://milvao.com/privacy-and-consent)
- [How to export WhatsApp group members](https://milvao.com/how-to-export-whatsapp-group-members)
- [Your data and how long we keep it](https://milvao.com/help/privacy-and-security/data-and-retention)