Information Security Policy

To set baseline expectations for protecting donor, beneficiary, volunteer and financial data handled by the Trust's website and backend systems.

Key provisions

No card or bank account details are stored by the Trust; payment data is handled exclusively by the payment gateway
Access to beneficiary and donor records in any future admin system is role based, limited to what each role needs
A security incident involving personal data is reported internally within 24 hours of discovery and assessed for notification obligations under applicable law
Passwords, admin credentials and API keys for any backend system are not stored in source code or shared over unencrypted channels

Escalation

Suspected security incidents go to the Trust Admin immediately, then to the Managing Trustee.

Policy record

Classification	Recommended governance practice
Applicable legal references	Information Technology Act 2000, SPDI Rules 2011, where still applicable, Digital Personal Data Protection Act 2023
Responsible role	Trust Admin
Approval authority	Board of Trustees, Dev's Foundation Trust
Status	Draft, not yet approved by the Trustees
Version	0.1, draft
Review schedule	Annually, or on a relevant change in law

This is a draft policy template written for site structure purposes. It has not been reviewed by a lawyer. Please have it checked against applicable Indian law, including the Digital Personal Data Protection Act 2023 where relevant, before publishing it as the Trust's actual policy.