Beneficiary Privacy and Consent Policy

To set how beneficiary personal data, collected through the Apply page and during programme delivery, is used and protected.

Key provisions

Public facing beneficiary profiles, such as those on the Sponsor a Student page, are anonymised by default
A beneficiary's full name, address, identity documents and contact details are visible only to authorised reviewers, not published
Consent is obtained in plain language at the point of application, stating what will and will not be made public
A beneficiary may withdraw consent for public display at any time without affecting their continued participation in a programme already underway

Escalation

Beneficiary privacy concerns go to the Program Manager, then to the Data Protection contact.

Policy record

Classification	Operationally necessary, and conditionally required under the Digital Personal Data Protection Act 2023
Applicable legal references	Digital Personal Data Protection Act 2023
Responsible role	Program Manager
Approval authority	Board of Trustees, Dev's Foundation Trust
Status	Draft, not yet approved by the Trustees
Version	0.1, draft
Review schedule	Annually, or on a relevant change in law

Current law status, checked October 2026: the Digital Personal Data Protection Act 2023 was brought into force with the Digital Personal Data Protection Rules 2025 notified on 13 November 2025. Board related provisions took effect immediately; consent manager registration phases in from 13 November 2026, and the core obligations most relevant here, including notice and consent, security safeguards, breach reporting, data principal rights and verifiable parental consent for minors, phase in by 13 May 2027. A website that collects donor and beneficiary data is very likely a data fiduciary under the Act's broad definition, and the household purposes exemption does not apply to an organisation. This Trust should build the practices below now, ahead of the deadline, rather than waiting for it. Verify this against the final Rules and any later notification before publishing, since this area is still phasing in. Source.

This is a draft policy template written for site structure purposes. It has not been reviewed by a lawyer. Please have it checked against applicable Indian law, including the Digital Personal Data Protection Act 2023 where relevant, before publishing it as the Trust's actual policy.