India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set out how organisations must handle personal data. Here is how NPPA meets each requirement, in plain words.
A clear Privacy Policy says what we collect and why. You agree to it when you register, and we keep a record of that.
Download your data, correct it, stop news emails, name a nominee or delete your account yourself in the Privacy Centre.
Every request gets a reference number. We answer complaints within 90 days and other requests within 30 days.
| What the law asks | What NPPA does |
|---|---|
| A clear noticeAct s.5, Rules r.3 | Our Privacy Policy lists every kind of data we collect, why, who handles it for us, how long we keep it, and how to exercise your rights or complain. It is available in English and, on request, in any language of the Eighth Schedule. |
| Free, specific consentAct s.6 | When you register, you tick a box to agree to the Privacy Policy; it is never ticked for you. We record when you agreed and which version you saw. Analytics cookies are used only if you choose “Accept analytics”. |
| Withdrawing consent as easily as giving itAct s.6(4) | One form in the Privacy Centre withdraws your consent and deletes your account (confirmed with a code sent to your email). News emails stop with one click. |
| Using data only for its purposeAct s.4, s.8 | We use your data only to run your membership and NPPA’s activities, and to send NPPA news. We never sell it or use it for advertising. |
| Your rights: access, correction, erasureAct s.11–12, Rules r.14 | In the Privacy Centre you can download your data, correct it (Manage Profile), and delete it. Anyone can also send a request there or by email. |
| Nominating someoneAct s.14 | You can name a nominee in the Privacy Centre, who can act for you if you die or are unable to act yourself. |
| Grievance redressalAct s.13, Rules r.14 | Complaints are answered within 90 days, with a reference number and a reply-by date. If you are not satisfied, you can go to the Data Protection Board of India. |
| A named contact personAct s.8(9), Rules r.9 | Grievance Officer: Prof. Kamlesh Singh, Secretary & Treasurer, NPPA, admin@nppassociation.org, IIIrd Floor, A-87, Naraina Vihar, New Delhi 110028. |
| Reasonable security safeguardsAct s.8(5), Rules r.6 | Encryption (HTTPS), two-step login for every member and administrator, protection against common attacks, monitoring and nightly backups. See Security & Your Account. |
| Keeping logsRules r.8(3) | Sign-in records are kept for one year to detect and investigate misuse, then deleted automatically. |
| Deleting data that is no longer neededAct s.8(7), Rules r.8 | Accounts are deleted 3 years after a membership ends (or 3 years after registering, if you never became a member), after a 48-hour warning email. Payment records are kept only as long as accounting law requires. |
| Reporting a data breachAct s.8(6), Rules r.7 | If personal data were ever leaked, we would tell the Data Protection Board without delay, send it a full report within 72 hours, and tell every affected member what happened and what to do. |
| Services that handle data for usAct s.8(2) | Only Razorpay, HostGator, Cloudflare and Google, each under their standard data-processing terms, and only as far as they need. They are named in the Privacy Policy. |
| Children’s dataAct s.9, Rules r.10 | Online membership is for people aged 18 and over, confirmed at registration. We do not track children’s behaviour or show them advertising. |
| Telling existing membersAct s.5(2) | Everyone who registered before the new Privacy Policy receives an email explaining it and their rights. |
Download your data, change your choices, or send us a request or complaint. Our Grievance Officer, Prof. Kamlesh Singh, answers every one.
Open the Privacy CentreRead our Privacy Policy, Security & Your Account and Terms and Conditions.
