Phase 1
13 Nov 2026
Consent Managers
From this date, Rule 4 applies: registration and duties of Consent Managers, the platforms people can use to give and withdraw consent.
Complimentary · No obligation
DPDP readiness review for associations, nonprofits and CSR foundations
Member renewals, donor PANs, beneficiary records, children's photos. A Bluelupin reviewer looks at what your live website, forms and tools actually do with personal data, then gives you a scored gap report and a 60-day fix list your board can read.
- Screen-share call
- 45 min
- Report after the call
- 5 working days
- Scored in your report
- 10 areas
Dates from the gazette
Two dates to plan around
Source: DPDP Rules 2025 (G.S.R. 846(E)) and the Act's commencement notice (G.S.R. 843(E)), both notified on 13 Nov 2025. Dates checked 1 Nov 2026.
Phase 2
13 May 2027
Core duties
Notice, consent, security safeguards, breach reporting, children's data, rights requests and retention apply to every organization that handles digital personal data.
What the Act asks
Where DPDP shows up in your organization
There is no general exemption for nonprofits. Here is where its duties reach member, donor and beneficiary systems.
Rule 3 · Sec 5 & 6
A clear notice and specific consent
Membership forms, event registration, donation pages and volunteer sign-ups
Sec 9 · Rule 10
Verifiable consent from a parent or lawful guardian
Education, nutrition and child-protection programs, and photos used in fundraising
Sec 8 · Rule 6
Reasonable security safeguards and processor contracts
CRMs, member portals, payment gateways, field survey apps and implementing partners
Rule 7
Breach notice to people and the Data Protection Board
Any leak of member, donor or beneficiary lists, with a detailed report within 72 hours
Rule 8
Erasure when the purpose ends, with 48 hours' notice
Lapsed members, one-time donors and closed programs; logs kept for one year
Rule 9
A published contact for data questions
Your website footer and privacy notice
Live systems
A person checks what your systems do with personal data
A self-assessment asks what you believe happens. In a review, your reviewer watches it happen: what a donation form collects, where a member's details go after sign-up, and who can see them.
- Website and its forms
- Donation and payment pages
- Member portal or app
- CRM and email lists
- Event registration
- Field survey apps and shared drives
10 areas, each scored
SCORECARD- 01Data inventory
- 02Notice
- 03Consent
- 04Children and persons with disability
- 05Security safeguards
- 06Vendors and implementing partners
- 07Breach response
- 08Retention and erasure
- 09Rights requests
- 10Contact for data questions
How it works
Four steps from request to report
- 01
Tell us about your organization
Fill in the short form below.
- 02
We reply within 2 working days
Your reviewer emails you with times for the call, or tells you if the review isn't the right fit.
- 03
45-minute screen-share call
You show us your live website, forms and tools. We copy no data, and we sign an NDA if you ask.
- 04
Report within 5 working days
We send the scored gap report and walk you through it in a 30-minute readout.
What your report contains
- A score for each of the 10 areas
- Each finding linked to the section of the Act or the Rule it relates to
- A 60-day fix list, in order
- A one-page summary for your board or CSR funder
- A list of what we did not review
Who it's for
Associations, chambers, nonprofits, trusts, societies and CSR foundations in India that hold at least 1,000 personal data records about members, donors, beneficiaries or volunteers.
What it is
This is a technical review of your systems. It gives no legal advice, certification or audit opinion; your legal counsel confirms legal positions.
Who reviews
Engineers who build public platforms
Bluelupin has built software since 2013, including the IndiaAI national AI portal for MeitY. Your review is run by a named Bluelupin reviewer from start to finish.
- Building software since
- 2013
We copy no data, and sign an NDA if you ask
Questions
Before you request a review
Is the review really complimentary?
Yes. There is no fee and no obligation. We take on 20 complimentary reviews a month, subject to availability.
Is this legal advice or a compliance certificate?
No. It is a technical review of your live systems. It gives no legal advice, certification or audit opinion, so ask your counsel to confirm legal positions. We found no certification scheme in the DPDP Act or Rules.
Do you need copies of our data or access to our systems?
No. The review happens on a 45-minute screen-share call, and we copy no data. We sign an NDA if you ask.
What happens after I send the form?
We reply by email within 2 working days to book the call. Within 5 working days of the call, you get a scored gap report, and we walk you through it in a 30-minute readout.
Who can request a review?
Associations, chambers, nonprofits, trusts, societies and CSR foundations in India that hold at least 1,000 personal data records about members, donors, beneficiaries or volunteers. If you hold fewer, write to sales@bluelupin.com and we'll suggest where to start.
Does the DPDP Act apply to nonprofits?
Yes. The Act has no general exemption for nonprofits. The core duties (notice, consent, security safeguards, breach reporting, children's data, rights requests and retention) apply from 13 May 2027.
What if this month's reviews are full?
We offer you the first available slot next month.
Request a review
Tell us about your organization
We reply by email within 2 working days to book your call.
We take on 20 complimentary reviews a month, subject to availability. If this month is full, we offer you the first slot next month.
- 01You fill in the short form
- 02We email times within 2 working days
- 0345-minute screen-share call
- 04Scored report within 5 working days
Fewer than 1,000 records? Write to sales@bluelupin.com and we'll suggest where to start.