Draft, pending trustee approval
Data Retention and Deletion Policy
To set how long different categories of personal data collected through this website are kept, and how they are deleted.
Key provisions
- Donation and receipt records are retained for the period required under applicable tax recordkeeping rules, currently understood to be several years from the relevant assessment year, to be confirmed with the Trust's Chartered Accountant
- Beneficiary application records are retained for the review and programme period plus a reasonable period for reporting, after which identifying details are anonymised or deleted unless consent covers longer retention
- Volunteer and contact form submissions not converted into an active relationship are deleted after a defined period, to be set by the Trustees
- A data subject may request earlier deletion of their own data, subject to the Trust's statutory recordkeeping obligations, which may override the request for specific records such as donation receipts
Escalation
Deletion requests go to the Trust Admin, then to the Data Protection contact if not actioned within a reasonable time.
Policy record
| Classification | Conditionally required, under the Digital Personal Data Protection Act 2023 once its retention related provisions take effect |
| Applicable legal references | Digital Personal Data Protection Act 2023, Income tax Act 1961 recordkeeping requirements |
| Responsible role | Trust Admin |
| Approval authority | Board of Trustees, Dev's Foundation Trust |
| Status | Draft, not yet approved by the Trustees |
| Version | 0.1, draft |
| Review schedule | Annually, or on a relevant change in law |
Current law status, checked October 2026: the Digital Personal Data Protection Act 2023 was brought into force with the Digital Personal Data Protection Rules 2025 notified on 13 November 2025. Board related provisions took effect immediately; consent manager registration phases in from 13 November 2026, and the core obligations most relevant here, including notice and consent, security safeguards, breach reporting, data principal rights and verifiable parental consent for minors, phase in by 13 May 2027. A website that collects donor and beneficiary data is very likely a data fiduciary under the Act's broad definition, and the household purposes exemption does not apply to an organisation. This Trust should build the practices below now, ahead of the deadline, rather than waiting for it. Verify this against the final Rules and any later notification before publishing, since this area is still phasing in. Source.
This is a draft policy template written for site structure purposes. It has not been reviewed by a lawyer. Please have it checked against applicable Indian law, including the Digital Personal Data Protection Act 2023 where relevant, before publishing it as the Trust's actual policy.