This introductory session will help you identify your data protection needs, and strategically plan our services to ensure compliance and security. Join us to empower your business with the knowledge and tools necessary for effective data management.

The Ministry of Home Affairs (MHA) has notified amendments to the compounding framework under the Foreign Contribution (Regulation) Act (FCRA), 2010 through Notification S.O. 3287(E) dated 22 June 2026. The notification revises the quantum of penalties for certain offences and adds the option to compound for more offences. The current consolidated position on compounding specified offences under FCRA is detailed below: Consolidated Compounding Framework under the FCRA Violation Relevant Provision Penalty Accepting prohibited hospitality in contravention of Section 6 S. 35 ₹10,000 Sub-granting FC to another person in violation of Section 7—compoundable only once, ever S. 37 ₹1 lakh or 10% of FC transferred, whichever is higher Administrative expenditure exceeding 20% of FC received S. 37 ₹1 lakh or 5% of FC defrayed beyond the limit, whichever is higher [New, 2026] Using FC for speculative activities in violation of Section 8(1) read with Rule 4 S. 37 ₹1 lakh or 30% of amount invested in speculative activity, whichever is higher; plus 100% recovery of all returns earned [New, 2026] Using FC for purposes other than those for which it was received S. 37 ₹1 lakh or 30% of amount so misused, whichever is higher Accepting or utilising FC without registration or prior permission — Section 11 violation (scope expanded in 2026) S. 35 ₹1 lakh or 30% of FC received or utilised, whichever is higher [New, 2026] Using FC in a State or UT for which registration has not been granted — the geography violation under Rule 9(1B) S. 35 r/w Rule 9(1B) ₹1 lakh or 30% of FC used in that State/UT, whichever is higher Receiving FC in an account other than the specified FCRA account S. 37 ₹1 lakh or 5% of FC received in such account, whichever is higher Non-reporting of remittance amount, source, or manner by banks S. 37 ₹1 lakh or 3% of FC received or deposited, whichever is higher Depositing non-FC funds in the FCRA account S. 37 r/w S. 17 ₹1 lakh or 2% of such deposit, whichever is higher Non-furnishing of intimation of FC received under Section 18 S. 37 ₹1 lakh or 5% of FC received during the period of non-submission, whichever is higher Non-maintenance of accounts and records under Section 19 S. 37 ₹1 lakh or 5% of FC during the relevant period, whichever is higher Failure to intimate receipt of FC within prescribed time (Rule 6) S. 3, 11, 35 r/w Rule 6 5% of FC received in that financial year Failure to intimate opening of a utilisation account within prescribed time S. 37, 17, 19 r/w Rule 9 ₹10,000 per utilisation account Failure to intimate details within prescribed time under Rule 17A S. 37, 11, 17 r/w Rule 17A ₹10,000 per violation Failure to upload documents on website within prescribed time (Rule 13) S. 37, 19 r/w Rule 13 ₹10,000 per violation The competent authority for compounding is the Director or Deputy Secretary in charge of FCRA administration in the Ministry of Home Affairs for all notified offences. Applications for compounding under Section 41 are filed electronically at fcraonline.nic.in with a filing fee of ₹3,000. No physical copies are required. The concept of Compounding Section 41(5) of the FCRA explicitly states that where an offence is compounded before prosecution is instituted, no prosecution can subsequently be initiated for that offence. However, the MHA is entirely free to take administrative action on the same set of facts. The MHA retains the power to suspend or cancel FC registration even after compounding. Compounding only bars prosecution from occurring, it does not immunise the registration. The Three-Year Rule Section 41(2) imposes a cooling-off period: if the same offence is committed within three years of a previous compounding, it cannot be compounded again. It goes directly to prosecution. If the same offence recurs more than three years after a prior compounding, it is treated as a fresh first offence and can be compounded again. The sub-granting offence under Section 7 is a harder restriction: it is compoundable only once, ever, regardless of when a second violation occurs. Read more on the amendment to the Rules here: https://www.pacta.in/post/fcra-2026-amendments-what-changed-and-what-it-means

Introduction India’s Digital Personal Data Protection Act, 2023 (DPDP Act or Act), provides an exception to the application of the Act to processing of personal data1 necessary for research purposes, subject to fulfilment of certain conditions in the Act and Second Schedule of the Digital Personal Data Protection Rules, 2025 (DPDP Rules). Social sector entities frequently conduct research in varied subject matters such as social sciences, education, medicine and science, which are undertaken (broadly speaking) either as standalone or pure research studies or studies based on existing programmes (e.g., measuring long term impact of programmes or research-based interventions). As on date, the DPDP Act or the DPDP Rules do not define ‘research’ and there are no detailed practical or statutory guidance on when and how to avail the research exemption under the Act. In this article, we analyse what is likely to constitute a ‘research’ activity under the DPDP Act. In the absence of absolute legislative certainty, we also suggest some best practices and legally defensible procedures by which the research exemption can be availed by social sector entities. As Indian data protection law jurisprudence is yet to develop, we take guidance from committee reports, recent judgments and international data protection regulatory frameworks (where relevant) to set out some practical implementation measures. What is ‘Research’? Use in Indian legal context The DPDP Act and the DPDP Rules do not define “research” and Indian law offers no general definition to fall back on, instead the term occasionally appears in sector specific regulations. The context and descriptions that do exist share one idea - research is an activity directed at extending knowledge. The Income Tax Act, 1961 defines “scientific research” as “activities for the extension of knowledge in the fields of natural or applied science including agriculture, animal husbandry or fisheries”.2 The ICMR National Ethical Guidelines, define biomedical and health research as “studies on basic, applied and operational research designed primarily to increase the scientific knowledge about diseases and conditions (physical or socio-behavioral), their detection, cause and evolving strategies for health promotion, prevention, or amelioration of disease and rehabilitation including clinical research”.3 The B.N Srikrishna Committee Report on data protection, without defining the term, identified “the advancement of knowledge in public interest” as the thread linking research, archiving and statistics.4 More recently, the Hon’ble High Court of Delhi in ANI vs. OpenAI, in an interim order, referred to the dictionary meaning of ‘research’ i.e., “to study or investigate carefully” and “an investigation directed to the discovery of some fact by careful study of a subject; investigation, inquiry into things...”. The court ultimately held that training an LLM (large language model) is “a form of research”, the only limit being that it should be “at the behest of humans and for the benefit of humans”.5 International Frameworks One of the developed guidance comes from the United Kingdom (UK). There, ‘scientific research’ covers any activity that “can reasonably be described as scientific”, whether publicly or privately funded and whether commercial or not.6 UK’s Information Commissioner’s Office (ICO) describes research as work that aims to advance a field, add to human knowledge, support education, or produce findings that others can test and replicate. It may be fundamental, applied or experimental development.7 The ICO expressly includes research that informs policy without being published, the development of artificial intelligence, and the secondary use of data. It also acknowledges that charities and commercial bodies, and not only public bodies, can conduct research. The ICO identifies research by its methods and by one key standard. The methods include designing studies, sampling populations, conducting surveys, analysing data and drawing inferences. The standard is that findings “do not lead directly to decisions about individuals”.8 Other jurisdictions apply similar tests. The US Common Rule requires “a systematic investigation … designed to develop or contribute to generalizable knowledge”.9 The European Data Protection Board looks for a methodical approach, ethical standards, verifiability, independence and a contribution to knowledge. It judges an activity by how it is conducted, not by its label.10 The EU General Data Protection Regulations also state that “the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research.” and “Scientific research purposes should also include studies conducted in the public interest in the area of public health.11 Singapore looks at purpose - its research exception covers exploratory work “that may not have any immediate application”. It requires a “clear public benefit” and that results are not used for decisions about individuals. Work that improves an organisation’s existing products falls under a separate business improvement exception, which cannot be used for marketing. 12 For AI, the research exception extends to “commercial research to advance the science and engineering without a product development roadmap”. 13 Read together, these sources point to some basic elements – and an activity can reasonably be treated as research under the DPDP Act where these elements are present: (a) The activity must aim at extension of existing knowledge, generating insights capable of sector specific application and having a public interest or benefit. These elements apply to different areas of study such as social sciences, technological, historical, scientific, educational, economic, and medical research. (b) There must be a defined research question or hypothesis, a research methodology, a design for collecting and analysing data, and a defined scope and study period. This is what separates research from general analysis. (c) Research should be separate from routine operational processing – which does not become research automatically merely because it produces data or reports. Management information systems, programme monitoring and reporting to funders or government serve the operation and should be treated as operational processing. (d) Research is not used to make decisions about individuals – this aspect is discussed in detail below. We have sought to illustratively list some activities which will likely be (and not likely be) considered research for the purposes of DPDP Act in the Annexure to this article. Availing the Research Exemption under DPDP Act: Practical Tools Relying on research as a legitimate ground for processing of personal data provides considerable and wide-ranging exemptions from the DPDP Act and DPDP Rules (such as taking consent, issuing privacy notice, and rights of data principals) – therefore, it is important to ensure that the exemption is being availed in a compliant and legally defensible manner. (a) Compliance with DPDP Act and DPDP Rules Compliance with the provisions prescribed under the DPDP Act and DPDP Rules is a sine qua non to avail the research exemption legitimately. We discuss below the compliance requirements set out in the Act and Second Schedule of the DPDP Rules,14 their scope and address some practical challenges/queries which frequently come up: (i) Processing of Personal Data should not be used to take any decision specific to a data principal15 Research outcomes are frequently used to inform/substantiate programme design, formulate or influence organisational policies, assess long term programme impact and identify areas where programmatic interventions may be required. It is reasonable to presume that such practical applications of research/research outcomes (and other similar high-level or broad-based applications) will be viewed as legitimate research objectives and will be permitted.16 The restriction on taking any specific decision to a data principal will be triggered if the research outcome is used to provide specific/customised or individualised services or decisions with respect to a Data Principal – for e.g., if outcome of a learning assessment educational research study is used to provide individualised support or customised curriculum for children who were found to be lagging behind in studies or their learning levels. (ii) Personal data processing is carried out in a lawful manner This condition is broad in scope to ensure that each processing activity performed on the personal data as part of research study is in compliance with law. Note that ‘processing’ is widely defined under the DPDP Act and any action that is performed on personal data will most likely be considered processing (e.g., storage, retrieval, indexing, erasure, sharing). Therefore, if there are any other sectoral laws that are applicable to the personal data processing activity, then they must be followed – for example, ICMR guidelines must be followed for medical research studies or data localisation requirements under RBI regulations for payment data. Any IRB or ethics consent requirements also remain unaffected by the DPDP Act mandate. Organisations should assess the regulatory frameworks that will be applicable to their research activity upfront and put in place controls to ensure compliance. (iii) Processing is for research purposes We discussed above what activities will likely constitute research. It will be important to ensure that personal data originally collected for research is not subsequently used for other non-research or non-exempt purposes without going through the full DPDP compliance process. If there is likelihood of the same dataset being used for research and active operational/programmatic purposes or even individualised support, then it would be important to not rely solely on the research exemption and have the personal data processing be in compliance with DPDP Act and DPDP Rules. (iv) Processing is limited to such personal data as is necessary for such uses or achieving such purposes (as the case may be) This condition essentially imports the data minimisation principle into the research exemption. UK’s ICO provides a succinct guidance on data minimisation in the context of UK GDPR which is also helpful to consider in the context of the DPDP Act: It must be ensured that the personal data being processed is: - “Adequate – sufficient to properly fulfil your stated purpose; - Relevant – has a rational link to that purpose; and - Limited to what is necessary – you do not hold more than what you need for that purpose” Organisations must therefore, as a starting point, identify the minimum amount of data that they need to fulfil the research purpose, articulate and document the rationale as to why this data is required for the stated research purpose and only collect that data. Excessive, unrelated or irrelevant personal data collected, with or without consent, will result in research exemption being incorrectly applied. (v) Processing is done while making reasonable efforts to ensure the completeness, accuracy and consistency of personal data The DPDP Act or DPDP Rules do not elaborate on what measures may constitute “reasonable efforts” to ensure completeness, accuracy and consistency of personal data. In practice, this will likely mean: ensuring the source of data is reasonably reliable (appropriately using primary and secondary sources considering the outcomes/insights sought to be generated); pre-empt challenges to completeness, accuracy and consistency of data in the organisation’s research context and building safeguards around it upfront; and to consider whether it is necessary to periodically update or verify the personal data (this may be required where there is reliance on critical piece of personal data which is more susceptible to change than others). The measures that need to be put in place can vary from study to study and will depend on the specific research context, sensitivity and volume of data handled. (vi) Personal data is retained till required for such uses or achieving such purposes or for compliance with any law; The obligations on retention and deletion of personal data that are applicable to personal data on other grounds of processing continue to apply to personal data being processed for research. If organisations wish to retain the dataset post conclusion of the research study, they can do so by anonymising the data set. (vii) Reasonable security safeguards to prevent personal data breach to protect personal data in the possession or under control of the Data Fiduciary, including in respect of any processing undertaken by it or on its behalf by a Data Processor; Processing personal data for research purposes does not exempt fiduciaries and processors from obligation to adopt reasonable security safeguards which apply to personal data processing on another grounds/basis. Some measures which can be considered are: to carry out data protection impact assessment before commencing the research study; taking a ‘data protection by design and default’ approach in processing activities, adopt encryption measures, share data only through official channels like email (and not through informal messaging apps such as WhatsApp or Slack); and pseudonymise the data set ascribing unique IDs. The access to the ‘key’ with the link to personal data can be restricted to a limited group of people working on the study – and the larger group may be given access to the de-identified dataset. If there are field workers responsible for collecting data on ground, they should be trained in handling personal data and sign non-disclosure agreements with adequate data protection clauses. If the research finding is sought to be published, then the dataset should be stripped of personal data i.e., identifiable information before publication. (viii) Accountability of the person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, for effective observance of these standards. This provision ascribes accountability for data fiduciary or fiduciaries (if more than one) for the personal data that they process for research purposes. Organisations should ensure that data owners of the research study are defined and compliance of data processors is ensured through comprehensive data processing agreements. (b) Public interest/benefit of the research study While public interest as a condition for research is not explicitly built in the DPDP Act, where possible, articulating and documenting public interest/benefit of a research study builds legal defensibility for the purposes of the DPDP Act. Examples of public interest may include - developing knowledge-based policy, identifying correlations between socio-economic factors to make informed programmatic or policy interventions, advancing biological or medical research for preventing or curing diseases, improving quality of life, improving delivery or access of social services or technology to underserved sections of population, and technological advancement with broad based public interest applications. Providing an option to access the research dataset (on an anonymised basis) to independent or affiliated researchers who apply can also showcase an enduring public benefit. (c) Documentation as a compliance tool Organisations may formulate internal research guidelines or policies which will document: how the organisation differentiates between research activities and their usual programmatic or operational activities, including the rationale/reasoning it applies and the public interest/benefit expected from the research outcome; the review process – the personnel/group in the organisation who will review the research proposal and decide applicability of DPDP Act (ensuring that the data protection officer or in-house legal teams are part of the review process); the security and safeguard measures that are applied to data collected for research purposes; - anonymisation or pseudonymisation measures applied on the data; and - other measures that the organisation adopts to ensure compliance with the DPDP Act and DPDP Rules conditions discussed in (a) above. For each research study, it is important to document a statement on personal data protection (the format of which can be flexible) which will confirm that the organisation’s internal processes on collection of personal data for research were followed and articulate why the study was categorised as research under the DPDP Act and the grounds on which DPDP Act research exemption is being availed. Guidelines/policies such as these helps in standardising process and compliance for the organisation and builds legal defensibility. Organisations can start putting in place these policies and need not wait for the substantive provisions of the DPDP Act to come into force. Organisations should be mindful about selecting programmes that apply for the research exemption and it should not appear that the exemption is being exploited to avoid applicability of the DPDP Act. (d) Research in collaboration with partner organisations Collaboration for research purposes with partner organisations may be undertaken in different forms. It can be in form of commissioned research wherein the implementing organisation commissions research on its own programme. It can also be undertaken as independent research wherein an external organisation uses programme data but sets its own agenda and methods. In any such collaboration, organisations should first determine the fiduciary – processor relationship between entities which would depend on which entity is setting the means and purpose of personal data collection (i.e., the data fiduciary), whether entities have the flexibility to set their own agenda and data processing purposes (in which case both entities will be the data fiduciary) or does one organisation simply follow the instructions given by the other (the entity following the instruction will be the data processor and entity giving instruction, the data fiduciary). The relationship then informs the roles and responsibilities of entities under the data processing or sharing agreement. Going forward, it is important to enter into data processing or sharing agreements with research partners so that the scope of processing of personal data is limited to research purposes and the DPDP Act compliance (discussed in (a)) is adhered to by all entities involved. The scope of work under the service agreement (or any other agreement) entered into with the partner organisation should also be aligned with the data processing mandate under the data processing or sharing agreements. (e) Research under Government MOUs If the research study (or generally the programme) is being conducted in collaboration with the government or with the sanction of the government under an MOU or using data from government databases – note that it does not automatically exempt organisations from DPDP Act compliance. The compliance obligation (re data protection) must be determined basis the specific scope and wording of the MOU using the following indicative questions: does the MOU extend any exemptions/relaxations to the organisation (the exemption must be explicit and not presumed)? Is the MOU silent on data protection or contain a general clause on compliance with laws? In which case it is likely that the DPDP Act compliances continue to apply and must be followed as is. Annexure- Research Activities Activities that will likely constitute research (subject to other compliances discussed above) Activity Longitudinal study tracking the programme impacts of the same cohort/ beneficiaries over several years Baseline and endline surveys conducted as part of a time-bound evaluation study Process or implementation research on how a programme is delivered in different settings Validation of an assessment tool (for example, testing the reliability of a reading or arithmetic test) Secondary analysis of programme data to answer a defined research question Qualitative research such as interviews, focus group discussions or case studies with a defined research design Impact evaluation – whether conducted by donor or by organisation if broad based to identify socio-economic indicators impacting programme efficacy/delivery Activities that will not constitute research Activity Routine MIS, attendance records, programme dashboards and monitoring Reporting to donors, CSR partners or government, including utilisation and compliance reports Assessing a beneficiary’s information in order to decide the support they receive Case management, grievance handling Fundraising and donor profiling Beneficiary stories, photographs or testimonials used in communications and fundraising Notes Digital Personal Data Protection Act, 2023, § 2(t) (India). The Act defines “personal data” as any data about an individual who is identifiable by or in relation to such data. Income-tax Act, 1961, § 43(4)(i) (India). Note, however, that the defined term does not appear in the new Income-tax Act, 2025. Section 45 of the Income Tax Act, 2025 does provide the same deduction for scientific research but only defines it in limited contexts. It also leaves open the question of determining what amounts to “scientific research” to the Central Government or a designated authority. Indian Council of Medical Research. (2017). National ethical guidelines for biomedical and health research involving human participants (Glossary). https://ethics.ncdirindia.org/asset/pdf/ICMR_National_Ethical_Guidelines.pdf Committee of Experts under the Chairmanship of Justice B. N. Srikrishna. (2018). A free and fair digital economy: Protecting privacy, empowering Indians (Ch. 8, Pt. IV, pp. 137–138). Ministry of Electronics and Information Technology, Government of India. ANI Media Pvt. Ltd. v. OpenAI OpCo LLC, CS(COMM) 1028/2024 (Del. HC 24 July 2026), paras. 212–218. http://indiankanoon.org/doc/93327052/ Data (Use and Access) Act 2025, c. 18, § 67 (UK) (inserting a definition of scientific research into Art. 4 of the UK GDPR). https://www.legislation.gov.uk/ukpga/2025/18/section/67 Information Commissioner’s Office. (n.d.-b). What is research-related processing? In Guidance on the research provisions (section “What is scientific or historical research?”). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/the-research-provisions/what-is-research-related-processing/ The three forms of research follow the categories in OECD. (2015). Frascati manual 2015: Guidelines for collecting and reporting data on research and experimental development. OECD Publishing. Information Commissioner’s Office (n.d.-b), section “What are some indicative criteria for scientific or historical research?”. Protection of Human Subjects, 45 C.F.R. § 46.102(l) (2018). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.102 European Data Protection Board. (2026). Guidelines 1/2026 on the processing of personal data for scientific research purposes (adopted 15 April 2026). For a summary, see Ropes & Gray LLP. (2026, April). https://www.ropesgray.com/en/insights/alerts/2026/04/the-european-data-protection-board-releases-new-guidelines-on-the-processing-of-personal-data Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 1. https://gdpr-info.eu/recitals/no-159/ Personal Data Protection Act 2012, Second Schedule, Pt. 2, Divs. 2–3, and First Schedule, Pt. 5 (Singapore); Personal Data Protection Commission. (2021, February 1). Advisory guidelines on key concepts in the Personal Data Protection Act (Annex A). https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/AG-on-Key-Concepts/Annex-A--PDPAs-Framework-for-the-Collection-Use-and-Disclosure-of-Personal-Data-1-Feb-2021.pdf Personal Data Protection Commission. (2024, March 1). Advisory guidelines on the use of personal data in AI recommendation and decision systems (para. 4.2(b)). https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf Digital Personal Data Protection Act, 2023, § 17(2)(b) (India), read with Digital Personal Data Protection Rules, 2025, r. 16 and Second Schedule (India). A data principal is the individual (natural person) to whom the personal data relates. See Digital Personal Data Protection Act, 2023, § 2(j) (India). The Information Commissioner’s Office provides similar guidance in the context of the UK GDPR. See Information Commissioner’s Office. (n.d.-a). What are the appropriate safeguards? In Guidance on the research provisions. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/the-research-provisions/what-are-the-appropriate-safeguards/#individuals

The Foreign Contribution (Regulation) Amendment Bill, 2026 (“2026 Bill”) introduces an important shift in how India regulates foreign funding. At a high level, the message is simple: If your organisation loses (voluntarily or otherwise) Foreign Contributions Regulation Act, 2010 (“FCRA”) registration, the government now has a clear process to take over assets created from foreign funds. This idea is not entirely new but the way it is being implemented is. Indian law has long taken the view that: • Charitable assets don’t belong to founders • They are meant for public purposes Under the Income Tax Act,1961, if an NGO shuts down, its assets must go to another non-profit or be used for public benefit. Similarly, earlier FCRA (2020 amendment) already said that: assets created from foreign funding could go to the government if registration is cancelled. Existing Law on Asset Takeover: Section 15 of the FCRA allowed for a designated authority to manage the assets created out of the foreign contribution by an organisation whose FCRA certificate has been cancelled under Section 14 or surrendered under section 14A. The designated authority had the power to utilise the foreign contribution or dispose of the assets created out of it in case adequate funds are not available for running the organisation's activity. This law only applied if your FCRA registration was cancelled or surrendered, not if you allowed to let it lapse upon the certificate's expiry. The idea was for the designated authority to apply foreign assets towards public good and only dispose them if necessary. What has changed now: The law now clearly lays out how this takeover of foreign contribution and assets acquired under FCRA will happen. The Bill introduces a system where if your FCRA registration is: a) cancelled b) surrendered c) or even expires without renewal your foreign funds and related assets can be taken over by a government-appointed authority. If your registration is not restored in time: This takeover becomes permanent Assets can even be: - transferred to government bodies - or sold with proceeds going to the Consolidated Fund of India A Big Practical Concern: Mixed Funding Assets Many non-profits build assets with a mix of domestic and foreign funding. The 2026 Bill says: Assets created wholly or even partly using foreign funds shall be fully taken over. You can apply to recover the non-foreign portion but only if it is clearly seperable. In real life, funding is often mixed and ascertaining asset value based on source of funding is not straightforward. This creates uncertainty for organisations that have invested in infrastructure using foreign funds, even if partly. A common example is Land bought with domestic funds with buildings and infrastructure constructed using foreign funds. It is unclear how the designated authority will take over such assets. Another Tightening: Time Limits on Spending under Prior Permission route The Bill also allows the government to set: Deadlines for using foreign funds received under prior approval route. This means: Funds must be used not just for the right purpose But also, within a fixed time Together with asset rules, the signals: Foreign funding is being pushed down short-term, programmatic use, rather than long-term investments. Missed Opportunities While the Bill is very clear on how the government can take over assets, some everyday issues remain unclear. Why speaking orders are on FCRA applications (especially rejections) are not the default? Is a foreign share holder of a Section 8 company limited by share capital an FC transaction What is the appeal process for administrative rejections? Pacta's Take: This amendment reflects a consistent idea in Indian law: Assets created for public good is not private property. What's changed is the level of control. The government is now setting up a clear system to step in and manage those assets. For non-profits, this means: Pay close attention to FCRA renewals and compliance Be cautious about using foreign funds for infrastructure Think carefully about how assets are structured

DISABILITY BULLETIN DEVELOPMENTS IN DISABILITY LAW & POLICY The Disability Bulletin carries law and policy updates related to disability rights in India. SUBSCRIBE TO THE DISABILITY BULLETIN Edition 15 August-September 2026 Read More Edition 12 October-December 2025 Read More Edition 9 January-April 2025 Read More Edition 6 April-July 2024 Read More Edition 3 August 2023 Read More Edition 14 May-July 2026 Read More Edition 11 July-September 2025 Read More Edition 8 November-December 2024 Read More Edition 5 January-March 2024 Read More Edition 2 July 2023 Read More Edition 13 January-April 2026 Read More Edition 10 May-June 2025 Read More Edition 7 August-October 2024 Read More Edition 4 September-November 2023 Read More Edition 1 June 2023 Read More

RESEARCH REPORTS T H E M A T I C S Disability Education Gender Philanthropy Technology Pacta’s Comments on the Draft Rights of Persons with Disabilities (Amendment) Rules, 2026 READ REPORT Disability, Technology Pacta’s comments on the Draft Rights of Persons with Disabilities (Amendment) Rules, 2026 identify gaps in the proposed grievance redressal mechanism and recommend a clearer, convergence-based approach to accessibility complaints. The Landscape of Funding for Disability in India READ REPORT Disability This first-of-its-kind study maps the funding landscape for the disability sector in India, examining how resources currently flow, where gaps persist, and the structural factors shaping access to funding. It brings together insights from NPOs, funders, and intermediaries to identify opportunities for more equitable and sustained support. Disability-inclusive Budgeting - Key Recommendations for the Union Budget 2026-27 READ REPORT Disability A report outlining evidence-based recommendations for making the Union Budget 2026-27 more responsive to persons with disabilities, based on consultations convened in collaboration with the Politics and Disability Forum. Towards a Unified, Scalable Ecosystem for the Disability Sector READ REPORT Disability Pacta partnered with Tech Mahindra Foundation as the research partner for a pioneering initiative, The Ability Network (TAN). This report captures its development as a digital-first, collaborative ecosystem to bridge critical gaps in services, information, and support for persons with disabilities and their caregivers in India. Data Insights on Decisions of India’s Chief Commissioner for Persons with Disabilities in 2024 READ REPORT Disability A quantitative analysis of orders passed by India's Chief Commissioner for Persons with Disabilities in 2024. Disability Budgets in India 2021-2026 READ REPORT Disability A study tracking federal allocations and spending patterns for disability budgets in India from 2021 to 2026. CSR and Sports in India-The First Decade READ REPORT Philanthropy A report contouring trends and patterns in CSR funding for Sports in India from the year 2014-2023. Access to Justice for Persons with Disabilities: A Data-Informed Report READ REPORT Disability The report examines the systemic absence of disability-disaggregated data across the justice system. The absence of data serves as a proxy for the invisibility of persons with disabilities across the system’s four key pillars: police, judiciary, legal aid, and prisons. AI Adoption in Indian Social Sector Programs: Early Insights, Emerging Stakeholders and Future Directions READ REPORT Technology The report explores the motivations, models, risks, and practical realities of AI deployment in non-profit programmes. State of Unique Disability Identity Implementation in Uttar Pradesh and Madhya Pradesh READ REPORT Disability A study landscaping the state of challenges pertaining to UDID in Uttar Pradesh and Madhya Pradesh. Data Protection for Children–Pathways towards Implementing Intentions of the DPDP Act READ REPORT Technology An in-depth analysis of the legal, technical, and ethical challenges in protecting children’s personal data under the Digital Personal Data Protection Act, 2023. India Justice Report 2025: Ranking States on the Capacity of Police, Judiciary, Prisons and Legal Aid READ REPORT Disability 'Data Disabled', featured in the India Justice Report 2025 (pp. 164–172), examines the systemic absence of disability-disaggregated data in India’s justice system and calls for an urgent shift toward inclusive data practices. Verifiable Parental Consent: DPDP Act and Rules READ REPORT Technology A white paper on verifiable parental consent under the DPDP Act, 2023 exploring challenges in digital consent for children. State of Unique Disability Identity Implementation in Telangana READ REPORT Disability A study landscaping the state of challenges pertaining to UDID in Telengana. Kimaya's Home READ REPORT Disability A graphic novel inspired by a study on legal guardianship, offering a glimpse into Kimaya's life as a neurodiverse person, exploring autonomy and independence. State of Unique Disability Identity Implementation in Maharashtra READ REPORT Disability A study landscaping the state of challenges pertaining to UDID in Maharashtra. Strengthening the Implementation of India’s National Disability Pension Scheme READ REPORT Disability A policy memo analysing pathways to strengthen the implementation of India's National pension Scheme for Persons with Disabilities. Tracing the Budgetary Allocations for Disability Sector in India READ REPORT Disability A study scoping out disability budget allocations over nine years until 2024. Impact of Covid-19 on Inclusive-Education READ REPORT Disability, Education A research paper mapping the impacts of the Covid-19 Pandemic on the state of inclusive education for children with disabilities in rural and urban Karnataka. Delivering Justice Solutions to Persons with Disabilities through Online Dispute Resolution Platforms READ REPORT Disability An academic paper proposing a framework of an inclusive online dispute resolution (ODR) platform in service of persons with disabilities. Data Insights on Decisions of India's Chief Commissioner for Persons with Disabilities in 2022 READ REPORT Disability A quantitative analysis of 350+ orders passed by India's Chief Commissioner for Persons with Disabilities in 2022. State Of Special Educators in India READ REPORT Disability, Education A quantitative analysis of the state of inclusive education and special educators in India based on UDISE Data 2022-23, reflecting a significant shortage of special educators. Data Insights on Decisions of India's Chief Commissioner for Persons with Disabilities in 2023 READ REPORT Disability A quantitative analysis of 350+ orders passed by India's Chief Commissioner for Persons with Disabilities in 2023. Early Analysis of Disability Data Gaps READ REPORT Disability An overview of disability data gaps in India across federal level data sets such as census and other national statistical surveys. Disability Budgets in India: Tracking Allocations & Spending Patterns READ REPORT Disability A study scoping out disability budget allocations over eight years until 2023. Anti-Sexual Harassment Laws & Classical Arts READ REPORT Gender An examination of the implementation effectiveness of anti-sexual harassment laws in the classical arts in India. Implications of the Digital Personal Data Protection Act 2023 on Persons with Disabilities READ REPORT Technology An examination of the potential impact of India's Digital Personal Data Protection Act 2023 on persons with disabilities in India - based on a survey of ~100 persons with disabilities. Legal Guardianship for Persons with Intellectual and Developmental Disabilities READ REPORT Disability An exploratory study on lived experiences and challenges surrounding legal guardianship laws for persons with intellectual and developmental disabilities and their care-givers in India. State of Unique Disability Identity Implementation in Karnataka READ REPORT Disability A study landscaping the state of challenges pertaining to UDID in Karnataka. Towards Enhancing Data Utility and Accessibility for Schools READ REPORT Education, Technology A study mapping data practices in the school education sector in India to identify pathways that strengthen utility and accessibility of data to serve better student outcomes and moving away from data as a tool for oversight and punishment. Digitization and the Future of Work READ REPORT Technology Explores the impact of digitalisation, AI, and automation on labor, highlighting challenges, opportunities, and policy recommendations for an equitable future of work in the aftermath of Covid - 19 pandemic. Corporate Social Responsibility and Sexual and Gender Minorities READ REPORT Philanthropy, Gender Building the Bridge A Study of the Status of CSR in India for LGBTQ+ Initiatives. Data Driven Anti Competitive Practices of Food Services Aggregators in India READ REPORT Technology Study to address shifts in the digital food delivery economy, changes in Food Service Aggregators' strategies, and their anti-trust data practices, in the context on India's Competition Act. CSR and Sports in India: Emerging Trends and Implications READ REPORT Philanthropy A report contouring trends and patterns in CSR funding for Sports in India from the year 2014-2021. Evaluation of Public Parks in Bengaluru: Are They Inclusive for Children With Disabilities? READ REPORT Disability Assessment of accessibility and inclusiveness of 30+ public parks in Bengaluru for children with disabilities, providing evidence-backed findings to guide improvements in accessibility and thereof inclusivity. Tuberculosis and Disability - A Rapid Assessment Report READ REPORT Disability First ever systematic scoping of experience of persons with disability across the case cascade of tuberculosis treatment in India. Exploratory Study to Assess the Implementation of Laws on Promoting Gender Equality in the Corporate Sector in India READ REPORT Gender A report on the implementation effectiveness of three laws to strengthen gender equality in the Indian corporate sector.

OP-EDS IDR FCRA Amendment Bill, 2026: How does it affect nonprofits? 17 Apr 2026 Read More LSE Data Collection and Utilisation in India’s Educational Ecosystem 13 Aug 2025 Read More Medianama How India’s Data Protection Law Infantilises Persons with Disabilities 11 Feb 2025 Read More IDR Where India’s disability pension scheme falls short 5 Sept 2023 Read More IDR No budget for persons with disabilities in India 14 Apr 2023 Read More Economic Times An Exploratory Research Study on Implementation of 3 Gender Equality Laws in the Corporate Sector in India 20 Mar 2023 Read More IDR Platform co-ops: Democratising the digital economy 20 Jan 2023 Read More IDR Rethinking nonprofit compliance as strategy, not obligation 9 Apr 2026 Read More Sportanddev.org Corporate social responsibility in Indian sport: Moving from margins to mainstream 1 Jul 2025 Read More Scroll.in How the new digital data protection rules infantilise people with disabilities 17 Jan 2025 Read More IDR Dropping questions on disability from NFHS-6 is a mistake 23 Jul 2023 Read More Economic Times Board Rooms Need More Women 27 Mar 2023 Read More IDR Not all disabled students in India are treated equally 15 Mar 2023 Read More The Institute of Company Secretaries of India Chartered Secretary: The Journal for Governance Professionals 1 Sept 2021 Read More EPW When Data Meets Power: Why Indian NGOs Need Robust Data Governance before Embracing AI 21 Feb 2026 Read More The Hindu Why are PwDs worried about DPDP rules? | Explained 28 Feb 2025 Read More IDR What nonprofits need to know about Form 10BD 23 May 2024 Read More Economic Times How funding choices can lead to an oligopoly of non-profits, and how to avoid it 16 May 2023 Read More Economic Times India Inc, Game Face On 20 Mar 2023 Read More Economic Times How CSR funding in sports can accelerate change 8 Mar 2023 Read More IDR Inclusive education for children with disabilities during COVID-19 27 Apr 2021 Read More