Facts of the case Practo Technologies Pvt Ltd (Practo) offers an online platform that enables online booking for medical consultations at over 9,000 hospitals. It also delivers services like enabling online medicine delivery by a network of pharmacies. A Complaint was filed by Rahul Bajaj (Complainant) a visually impaired lawyer against Practo. The grounds of the complaint was that the Practo app is not accessible for a person with visual impairment and that the Complaint faced the following challenges: a) The home screen is unorganized and inaccessible with a screen reading software; b) The second page is unlabelled and inaccessible, c)  Results obtained after providing inputs are inaccessible, and d)  The app randomly crashes of its own accord The Complainant contended that Practo has failed to comply with the provisions of Section 46 of the Rights of Persons with Disabilities Act, 2016 (RPwD Act) read with RPwD Rule 15. Practo denied the allegations in the complaint but expressed willingness to make the app accessible to people with special needs within 9 months’ time. Order The Court of Chief Commissioner analysed  Section 40 and 46 of the RPwD Act read with Rule 15. Section 40 of the RPwD Act provides that appropriate government shall formulate rules laying down standards of accessibility for Divyangjan on various kinds of services and infrastructure which is provided to public, which is inclusive of 'information & technology including appropriate technologies and systems. Section 46 of the RPwD Act provides that service providers have to provide services in accordance with government rules made under Section 40 of RPwD Act, 2016 relating to accessibility. Rule 15 of the RPwD Rules imposes responsibility on every establishment to comply with the standards relating to physical environment, transport and ‘information & communication technology’. Further Clause (3), Sub rule (1) elaborates information and communication technology as: a) Website standard as specified in the guidelines for Indian Government websites, as adopted by Department of Administrative Reforms and Public Grievances, Government of India; b) Documents to be placed on websites shall be in Electronic Publication (ePUB) or Optical Character Reader (OCR) based pdf format. On consideration of the above provisions, Court of Chief Commissioner observed that: a) Private establishments like Practo providing information & technology services are bound to make their services and infrastructure accessible for Divyangjan in accordance with the provisions of the RPwD Act and respective Rules. b) There are government guidelines such as Guidelines for Indian Government Websites ("GIGW') and Bureau of Indian Standards notifications o n the matter of accessibility of website, apps and other technology platforms which must be complied by Practo. The Court of Chief Commissioner recommended that: (i) Practo should comply with the law and make necessary modifications to its Application within six months and not later than nine months (ii) Other technology platforms must be accessible for the disabled people, and Directorate General of Health Service, to ensure that Practo complies with the law Court of Chief Commissioner has also scheduled another hearing on September 20, 2022 by taking cognizance under Section 75 (1) (h) of RPwD Act which enable him to monitor the implementation of the provisions of this Act and schemes, programs meant for PwD. Pacta’s Analysis on the Impact of the Order a.  On State Commissioners . The Order passed by the Court of Chief Commissioner in this case will be binding on all other State Commissioners. Section 88 of the RPwD Act vests with the State Commissioners the power to monitor the implementation of the RPwD Act. Therefore, the State Commissioners can take suo motu steps to oversee the implementation of the Act by various establishments including online platforms and take appropriate actions in case of noncompliance. Advocacy organizations can also leverage this decision to obtain accessible websites and web-applications in other states. b. On Other Online Services . Section 46 imposes a duty on all service providers whether governmental or private to provide services in accordance with the rules on accessibility formulated by the Government. By extension, all service providers which provide consumer products and services online would be expected to comply with RPwD rules to make their User Interface accessible to people with disabilities. This includes banking and finance apps ( BHIM , Paytm , YONO) , mobility solutions ( Uber , Ola ), Food Delivery ( Swiggy , Zomato ), medicine delivery ( Apollo Pharmacy , 1MG ), marketplace apps ( Amazon , Flipkart ) , ed-tech solutions ( Byjus , Khan Academy ) and even government services such as application for Aadhar card/passport and other government services. Several apps such as  Uber, Swiggy, Amazon, Khan Academy are already accessible to Divyangjan. Conclusion Towards enabling inclusion of Divyangjan, for enabling them to participate fully and effectively in society, the Government has been taking several law and policy initiatives. Recently, the Government has released a new Draft Policy for Persons with Disabilities (Divyangjan), 2021 which identifies various areas for intervention, such as, early identification and prevention, education, skill development, social security, disaster management etc. The Draft policy stresses the need to create a barrier free environment for Divyangjan and envisages that all local building bye-laws, passenger buses, railway and metro coaches, airports, etc. should have accessibility features available for Divyangjan. Further the draft policy also envisages setting up a common online platform for registering complaints with an automatic forwarding mechanism to respective Commissioners. Once this feature is available, it will enable PwD to obtain speedy grievance redressal.

Facts of the case The Payment of Gratuity Act, 1972 (the “ Gratuity Act ”) mandates payment of gratuity to an employee after he/she has rendered continuous service for not less than 5 years, on his/her superannuation, retirement or resignation or on his/her death or disablement due to accident or disease. Initially, the Gratuity Act applied only to establishments like factory, oil field, mine, oilfield, plantation, port and railway company, shops and other establishment notified by the Central Government where 10 or more persons are employed, on any day of the preceding twelve months. On, 08.01.1982, the Central Government vide Notification No. S.O. 239 extended the benefit of the Gratuity Act to “local bodies”. As a result, the schools under the local bodies with 10 or more employees became liable to pay gratuity to their employees. However, the said notification did not apply to private schools. Further, the Ministry of Labour and Employment vide Notification No. S-42013/1/95-SS.(II) dated 3.4.1997 , extended the applicability of the Gratuity Act to educational institutions with 10 or more employees. As a result, private schools being educational institutions also became liable to pay gratuity to their employees under the Gratuity Act. However, some private schools raised a dispute stating that teachers in educational institutions or schools are not “employee” as defined in Section 2(e) of the Gratuity Act. This contention was accepted by the High Court of Gujarat in the case of Shantiben L. Christian v. Administrative Officer, Ahmedabad Municipal School Board . The judgment in Shantiben L. Christian was challenged before the Hon’ble Apex Court in the case of Ahmedabad Private Primary Teachers’ Association v. Administrative Officer and Others, [2] .  The Apex Court held that the expression “employee” as defined under Section 2 (e) of the Gratuity Act is restrictive and hence the teachers who impart education to students does not qualify to be an “employee” as they do not perform any kind of skilled, unskilled, semiskilled, manual, supervisory, managerial, administrative, technical or clerical work. Later in 2009, Section 2(e) was amended and Section 13A was inserted to the Gratuity Act which in turn extended the benefit of gratuity to the teachers with retrospective effect from 03.04.1997, i.e.from the date of Notification No. S-42013/1/95-SS.(II). The constitutional validity of these amendments was challenged by various schools before the High Courts of Allahabad, Gujarat, Delhi, Bombay, Punjab and Haryana, Chhattisgarh and Madhya Pradesh who in turn refused to interfere with the amendments and dismissed the petitions. Being aggrieved by these High Court orders, the schools have filed appeals before the Apex Court. Further, some schools have directly approached the Apex Court by way of writ petitions filed under Article 32 of the Indian Constitution challenging the constitutional validity of 2009 amendments. The appeals and writ petitions challenge the 2009 amendments on the following grounds namely: a) That the legislature vide the Amendment Act 2009 overrules the judicial decision in Ahmedabad Private Primary Teachers' Association ; and b) That the retrospective amendments are unreasonable and unconstitutional. Order Amendment Act 2009 overrules the judicial decision in Ahmedabad Private Primary Teachers' Association The Apex Court held that the legislature cannot overrule a judicial decision, it can only amend the language of the provision that was the subject matter of the judicial decision. Hence, even after a court ruling, when the legislature acts within its power to usher in a valid law and rectify a legal error, it only exercises its constitutional power to enact the law and does not overrule the earlier court decision. The Court further observed that in Ahmedabad Private Primary Teachers' Association , this Court only interpreted the law as then existed in the statute and further even prompted the legislature to enact a legislation granting the benefit of gratuity to teachers who are denied the benefit due to a legal flaw. Therefore, the Court held that the legislature vides 2009 amendment, only rectified the infirmities and defects pointed out by this Court in the Ahmedabad Private Primary Teachers' Association , and effectuated the object and purpose of the Notification No. S-42013/1/95-SS.(II). Retrospective amendments are unreasonable and unconstitutional The Apex Court held that the power to amend a statute is a constitutional power vested with the legislature and the same cannot be confined and restricted to any particular type of statutes. The Court further held that the power to amend also includes the power to amend with retrospective effect. It was observed that the constitutional validity of the amendment is to be examined in the light of the relevant circumstances which prompted the legislature to make the retrospective amendment. In the instant case, the amendment enforces and gives effect to what was intended by the Notification No. S-42013/1/95-SS.(II) and seeks to bring equality and give fair treatment to the teachers. Hence, the amendment can hardly be categorised as unreasonable and unconstitutional. Therefore, in the light of aforesaid findings, the Hon’ble Supreme Court: a) upheld the validity of the Amendment Acts, and b) directed the private schools to make payment along with the interest to the employees/teachers in accordance with the provisions of the Gratuity Act within a period of 6 weeks. In case of default, the employees/teachers were asked to move the appropriate forum to enforce payment in accordance with the provisions of the Gratuity Act. Impact of the Order to Private Schools The aforesaid order impacts private schools having 10 or more employees to implement and enforce payment of gratuity to its teachers and other employee staff. However, this is not the first judgment that mandates payment of gratuity for teachers. The High Court of Karnataka in 2017 has made the payment of gratuity to private school teachers compulsory. Although, this may pose a financial burden on private schools, it cannot be a reason for non-implementation of gratuity benefit to the teachers and other staff.

The Central government has recently introduced several changes to the FCRA regulations to provide greater clarity and flexibility to organizations receiving foreign contributions. These amendments were made through a combination of Public Notice dated 31st December 2024 and the Foreign Contribution (Regulation) Amendment Rules, 2024 (FCRA Rules), which came into effect on January 1, 2025. The following are the key amendments to the FCRA rules: 1.     Extension of Pending Renewals:  FCRA certificates expiring on December 31, 2024, have been extended until March 31, 2025, or until the renewal application is decided, whichever comes first. Certificates expiring between January and March 2025 remain valid until March 31, 2025, if a renewal application is submitted before expiry. 2.     Handling of TDS Refunds: If TDS refunds are received in a non-FCRA account, the portion related to FCRA must be transferred back to the FCRA bank account. This transfer will not be considered an FCRA violation. The TDS deducted can be treated as utilization of FCRA funds, and the refund received in the FCRA account should be treated as other income. The refund in the FCRA account must be reported in Form FC-4. 3.     Carry Forward of Unspent Administrative Expenses:  Associations can now carry forward unspent allowable administrative expenses from one financial year to the next. Reasons for the carry forward must be specified in Form FC-4. Carry forward under 4(3)(iv) requires the following additional details: SI. No. Particulars Amount (Rs) A. Brought forward unspent part of allowable administrative expenses B. Total foreign contribution received during the year C. Allowable administrative expenses of current financial year [20 per cent. of B] D. Total administrative expenses incurred during the current year E. Administrative expenses of current year utilised out of A above F. Administrative expenses of current year utilised out of C above G. Unspent part of C above available to be carried forward. H. Out of G above, amount to be carried forward to next financial year. I. Reason for carry forward of unspent part of allowable administrative expenses to next financial year. Reporting Requirements in Form FC-4:  New clauses in Form FC-4 require reporting on: Transfer of FC-related TDS refunds. Unspent administrative expenses brought forward, current year's contributions, expenses, and carry forward amounts. Reasons for carrying forward unused funds. 5. Chartered Accountant (CA) Certification:  Form FC-4 must now include the CA's name, address, registration number, email, and date of certificate. The CA must confirm compliance with FCRA regulations or report any violations with details. These amendments  aim to streamline the FCRA compliance process, provide greater flexibility to organizations and enhance transparency in the utilization of foreign funds. By allowing the carry forward of unspent administrative expenses and clarifying the treatment of TDS refunds, these regulations aim to create a more conducive environment for organizations engaged in charitable activities.

The not-for-profit sector in India operates within a fast paced regulatory landscape shaped by various laws, notifications, and announcements issued by multiple governing bodies. Ensuring compliance with these regulations is essential for organizations to function effectively and maintain transparency.   This article decrypts a guidance note ( https://www.icai.org/post/15771 ) issued by the Institute of Chartered Accountants of India (ICAI) under which Accounting Standards prescribed by the ICAI shall henceforth be applicable to “financial statements of non-corporate entities” with effect from 1st Apr 2024. i.e. Financial statements beginning from  1st Apr 2024 to 31st Mar 2025. This means that non-profits trusts and societies must adopt the ICAI’s accounting standards for this financial year 2024 – 25. The ICAI’s accounting standards are already applicable to Section 8 companies. The guidance note also proposes the format of Financial Statements in accordance with the Accounting Standards.   A key reason to extend the applicability of ICAI’s accounting standards to non-corporate entities i.e Trusts, Societies, Hindu Undivided Families, etc is to promote comparability, transparency  and standardisation of financial statements. The ICAI’s accounting standards are already applicable to Section 8 companies.   Financial Statements Includes ✤    Balance sheet ✤    A statement of profit and loss ✤    A cash flow statement (wherever applicable) ✤    Notes and other statements and explanatory material that are integral part of the financial statement ✤    Significant Accounting Policies   What Are Accounting Standards (AS) Accounting standards prescribes the recognition and measurement principles as well as presentation and disclosure requirements of events, transactions and various elements of the financial statements. Currently there are three sets of AS: 1.     Indian Accounting Standards (Ind AS) for specified class of companies. 2.     Accounting Standards (AS) notified under Companies (Accounting Standards) Rules, 2021, for companies other than those following Ind AS; 3.     Accounting Standards (AS) prescribed by ICAI for entities other than companies*   *This article and the “Guidance note on Financial Statements on Non-Corporate entities” pertains to the third category above.   Applicability of the AS The Guidance Note classifies entities into four levels of applicability. Entities should assess their respective level and identify the compliances accordingly. Level I Level II Level III Level IV Full compliance Medium Small Micro   Entities whose securities are listed or are in the process of listing on any stock exchange, whether in India or outside India     Banks (including co-operative banks), financial institutions or entities carrying on insurance business   All entities engaged in commercial , industrial or business activities , whose turnover (excluding other income) exceeds rupees two-fifty crore in the immediately preceding accounting year.   All entities engaged in commercial , industrial or business activities having borrowings (including public deposits) in excess of rupees fifty crore at any time during the immediately preceding accounting year   Holding and subsidiary entities of anyone of the above     All entities engaged in commercial , industrial or business activities , whose turnover (excluding other income) exceeds rupees fifty crore but does not exceed two-fifty crore in the immediately preceding accounting year.       All entities engaged in commercial , industrial or business activities having borrowings (including public deposits) in excess of rupees ten crore but does not exceed fifty crore at any time during the immediately preceding accounting year     Holding and subsidiary entities of anyone of the above     All entities engaged in commercial , industrial or business activities , whose turnover (excluding other income) exceeds rupees ten crore but does not exceed fifty crore in the immediately preceding accounting year.       All entities engaged in commercial , industrial or business activities having borrowings (including public deposits) in excess of rupees two crore but does not exceed ten crore at any time during the immediately preceding accounting year     Holding and subsidiary entities of anyone of the above   Non corporateentities which are not covered under Level I, Level II and Level III are considered here               List of AS applicable to each levels NO DESCRIPTION LEVEL I LEVEL II LEVEL III LEVEL IV AS   1 Disclosure of Accounting Policies Yes Yes Yes Yes AS   2 Valuation of Inventories Yes Yes Yes Yes AS   3 Cash Flow Statements Yes No No No AS   4 Contingencies and Events Occurring After the Balance Sheet Date Yes Yes Yes Yes AS   5 Net Profit or Loss for the Period, Prior Period Items and Changes in Accounting Policies Yes Yes Yes Yes AS   7 Construction Contracts Yes Yes Yes Yes AS   9 Revenue Recognition Yes Yes Yes Yes AS  10 Property, Plant and Equipment Yes Yes Yes Yes AS  11 The Effects of Changes in Foreign Exchange Rates Yes Yes Yes Yes AS  12 Accounting for Government Grants Yes Yes Yes Yes AS  13 Accounting for Investments Yes Yes Yes Yes AS  14 Accounting for Amalgamations Yes Yes Yes No AS  15 Employee Benefits Yes Yes Yes Yes AS  16 Borrowing Costs Yes Yes Yes Yes AS  17 Segment Reporting Yes No No No AS  18 Related Party Disclosures Yes Yes No No AS  19 Leases Yes Yes Yes Yes AS  20 Earnings Per Share Yes No No No AS  21 Consolidated Financial Statements Yes No No No AS  22 Accounting for Taxes on Income Yes Yes Yes Yes AS  23 Accounting for Investments in Associates in Consolidated Financial Statements Yes No No No AS  24 Discontinuing Operations Yes Yes No No AS  25 Interim Financial Reporting Yes No No No AS  26 Intangible Assets Yes Yes Yes No AS  27 Financial Reporting of Interests in Joint Ventures Yes No No No AS  28 Impairment of Assets Yes Yes Yes Yes AS  29 Provisions, Contingent Liabilities and Contingent Assets Yes Yes Yes Yes The accounting standards issued by ICAI, are designed to ensure transparency, consistency, and reliability in financial reporting. Non-compliance with a mandatory standards of accounting may result in penalties and fines as per companies act, scrutiny by authorities, and audit qualifications. This will not only have implications on reputation and goodwill but may also  impact the confidence of stakeholders such as donors, lenders, creditors etc.,  which will ultimately impact the financial stability of organisation.

Now, goods or services which are sold through digital means like websites, marketplace, e-commerce platforms will be regulated by the Consumer Protection Act.  Organisations selling handicrafts/ handloom products online, online artisan collectives/marketplaces, educational or other learning platforms are all impacted by this new law. Let us look at some of the implications this new law on online sales by such organisations – both for profit and not-for profit. Key Changes Brought About By CPA Definition of consumer widened to include e-commerce consumers  Applies to online transactions, direct selling, tele-shopping & multi-level marketing – on retail & market-place model Does not apply to services of a person carried out in personal or professional capacity Complaints   consumer can file complaints at consumer forum at their place of residence/work; earlier complaints could be filed only at the place of seller’s registered office; complaints can be filed electronically; hearings through video-conferencing allowed.  Pecuniary limits of Consumer Forums Increased District forums - complaints upto INR 10 million; State forums - complaints from INR 10 million - INR 100 million;  National forum - complaints exceeding INR 100 million.   Central Consumer Protection Authority set up as a nodal authority for consumer protection. Product liability ·   imposed on product manufacturer, product service provider & product seller. liable under product liability action. no liability if the product has been misused, altered or modified,  Unfair Trade practices  includes sharing of personal information given by consumers in confidence robust data protection measures necessary  Punishment for misleading advertisements monetary fine up to INR 1 million on a product manufacturer/endorse  imprisonment for up to 2 years Consumer Protection (E-Commerce Rules), 2020 Provides certain obligations of e-commerce entity (discussed in next section) Obligations of E-Commerce Entities under the Consumer Protection (E-Commerce Rules), 2020 E-commerce entities to be a company under the Companies Act  Legal name of the entity, headquarters, contact details etc.to be displayed. Explicit consent of consumer for buying goods/services to be recorded. Automatic consent in the form of pre-ticked boxes would not suffice. No manipulation of prices can be done.   Prohibition on discrimination between consumers of the same class.   Grievance redressal (direct online sale or through marketplace) A dedicated officer for grievance redressal to be appointed Contact details needs to be prominently displayed. Grievance Officer to acknowledge receipt within 48 hours & close compliant within a month Ticketing system for tracking complaints to be adopted.   Marketplace e-commerce entities to obtain an undertaking from the online sellers that the information regarding their product/service displayed on the platform is genuine and accurate and corresponds to the actual good or service.  Restrictions imposed on cancellation charges FAQs 1. Can Non-profits (Trust/Society/Co-operative Society/Sec 8 company/Liaison Office of Foreign Charity) be a consumer? Yes - One important feature of the applicability of consumer protection law is that one has to be a `consumer’. It is essential that goods are being `sold’ for a consideration, in order to qualify as a consumer. Therefore all non-profit entities that purchase goods or services for  its own consumption or use are entitled to protection as consumers under the CPA.  2. Can Non-profits (Trust/Society/Co-operative Society/ Sec 8 company/Liaison Office of Foreign Charity) be an e-commerce entity? If a non-profit online seller/e-commerce entity, provides goods or services free of cost, then the same shall not be covered under the consumer protection act. A non- profit company selling goods of handicraft/handloom workers, online whether independently or on an e-commerce marketplace should comply with applicable provisions under the CPA.  To engage in providing e-commerce, the seller must be a company. This is to be noted by handicraft/handloom collectives selling online. 3. Are educational institutions like schools liable to comply with the CPA? Yes. Courts have time and again held that pre-schools, schools, colleges and universities are amenable to the jurisdiction of consumer courts. However there are nuances or specific aspects of education that are not necessarily a service and therefore, it is best to consult a lawyer to understand applicability. 4. Are ed-tech companies providing online learning solutions an e-commerce entity? Yes – any entity providing services online will have to comply. An EdTech platform which engages external faculties or a school which engages guest faculties to offer courses on their platform, should have written arrangement with the service providers to do the same.   5. What are the obligations of e-commerce entities under the CPA? They are liable for the quality of the product/service Must appoint a grievance officer & display mechanism for redressal of complaints Personal information of customers collected should be protected against leakage Misleading advertisements to be avoided 6. I am an individual providing personalised services/products through my website/ social media page. Am I an e-commerce entity under the Act?  That depends - activities carried out by a natural person in personal capacity not being part of any professional or commercial activity undertaken on a regular or systematic basis. Therefore, if the services or products are sporadic and not conducted in a systematic or organised manner, you are not covered by the rules. However if it is an organised trade in your name, then you will be bound to comply. Do consult a lawyer for answers on compliances and obligations specific to your situation. Remember that non-compliance under the CPA attract monetary fines as well as imprisonment.

The second wave of COVID-19 saw an unprecedented number of deaths. Particularly, the social sector lost many prominent social and human rights activists to the pandemic. People engaged in social sector do not enjoy the same financial security and the additional compensations/perks that are provided to employees working in government/PSUs positions or MNCs. Even health/accident insurance plans offered by NGO employers often do not offer an adequate life cover. So, it becomes more important for social workers to have a good insurance policy.    Term insurance is the purest form of   life insurance   policy which is for a fixed period of time. If the policyholder passes away before the end of the policy term, it provides their family with a death benefit. Typically, term plans do not pay if the insured outlives the term.   Why should you get a Term insurance? If you’re the primary provider i.e sole earning member of the family If you have a significant amount of debt  Ensures financial protection against death due to critical illness Covers against accidental death Ensures tax benefits Allows multiple payment options What is the Insured Amount Under Term Insurances? Financial experts suggest that the amount of life insurance should be 15 to 20 times the income of insured in order for it to be efficient and most helpful.   Types of Term Insurance Policies Level Term Plans: This is the common type of term insurance plan. Under this plan, the premium varies according to your age. The lower your age while buying a level term plan the lower will be your premium. Increasing Term Insurance: Under this plan, the insured can increase the sum assured at specific points in the policy term. The rate of this increase is predetermined. Decreasing Term insurance: In this case, the sum assured decreases at a predetermined rate as your age increases. Return of Premium Term Insurance: This policy provides that in the event that the insured outlives the policy term, all paid premiums till the maturity date is returned to the insured.  Convertible Term Plans: This plan can be converted into another type of insurance plan at a later stage; for example, a whole life plan or an endowment plan.  Does Term Insurance Covers Death Due To Covid-19?  The answer is yes. If an individual passes away due to Covid-19 and had a term life insurance policy, the nominee will get the sum assured as death benefit. We found that for an insured who wants a 2.5 Crore life cover, premiums can be as low as INR 25000 annually. Tools such as those offered by  Policy Bazaar  allow you to compare plans and choose the most suitable one. If you are planning to buy a term life insurance policy now, you should keep in mind that insurers determine the premiums of your insurance policy based on medical history. And always,  read the fine-print  before you buy the plan! This edition is contributed by our summer intern Ashwin Jain

Social Stock Exchange The Social Stock Exchange (“ SSE ”) was created as a platform to enable social enterprises to access a variety of funds and funding organizations discover social enterprises that require funding. The SSE is governed by Securities and Exchange Board of India (“ SEBI ”). Entities that are eligible to get listed on the SSE are called Social Enterprises. Prerequisites to become a Social Enterprise  These prerequisites are listed under   SEBI (Issue of Capital and Disclosure Requirements), (“ SEBI (ICDR) ”)2018 : A Social Enterprise can be a  for profit or a not for profit entity . ANY of the following entities are eligible for listing on the SSE: a. A Company or Body Corporate operating for profit  b. A Section 8 Company c. A Charitable Society under Societies Registration Act d. A Charitable Trust under Indian Trust Act/ any State’s public trust legislation. Entities that are  not eligible  to become a social enterprise are those that engage in the following activities:  a. political or religious organizations or activities,   b. professional or trade associations,   c. infrastructure and housing companies, except affordable housing. Eligible entities can choose to engage in one or more of 16 activities mentioned under the SEBI (ICDR) 2018 to qualify for listing under the SSE. Examples of activities enumerated are - eradicating hunger, poverty, malnutrition, and inequality, promoting education,employability, and livelihoods, and bridging the digital divide in internet and mobile phone access, addressing issues of misinformation and data protection. To be eligible for listing on the SSE, entities must also show that at least  67%  (average of the immediately preceding three years) of their revenue and/or expenditure and/or customer base comes from under-deserved or less privileged segments of development priorities under the Central and State governments. Social Audit After listing on the SSE, the Social Enterprise is expected to make certain disclosures which are listed under   the SEBI (Listing Obligations and Disclosure Requirements) Regulations, (“ SEBI (LODR) ”)2015 . This includes getting their annual impact report audited by a Social Auditor(SEBI (LODR), 2015: Regulation 91 E.  Additional disclosures of fund utilization are also required on a quarterly basis from Social Enterprises who are not for profit entities (SEBI (LODR), 2015: Regulation 91 F. Social Auditors  Social Auditors (for auditing the annual impact report under Regulation 91 E above) are required to be registered with the ICAI (Institute of Chartered Accountants of India) or any other agency specified by SEBI and hold a valid certificate of qualification from National Institute of Securities Management. In the interim period till the certification exams are conducted, the ICAI has appointed Social Auditors through a   public call for applications   on January 13, 2023.  The job description for the position emphasized that applicants must have at least three years of experience in social impact assessment. This initial empanelment of Social Auditors will be valid for six months or till the certification exam is conducted whichever is later. The ICAI has also notified a   Framework for Social Audit Standards  for each sector. It is unclear whether SEBI has specifically notified ICSI (Institute of Company Secretaries of India) as an agency for empaneling social auditors. The ICSI has set-up the ICSI Institute of Social Auditors which has released   the draft ICSI Social Audit Standards . Impact of Social Audit on the Social Sector Impact measurement is a means for social enterprises to demonstrate palpable, measurable impact of their work. This helps to foster the credibility of the social sector and keeps it accountable to the outcomes social enterprises often adopt in their mission and vision statements. The social audit standards are likely to transcend the context of the SSE and percolate to being adopted by the social sector at large. Here’s how: On Funds Raised on SSE . Though the social audit norms are intended to audit the impact reports and impact reported by social enterprises listed on the SSE, this is the first time a framework is being recommended under statute to measure impact. On CSR .  A January 2021 amendment to India’s CSR law , made it mandatory for companies with a CSR budget of INR 10 crore or more in any fiscal year and all projects with outlays of INR 1 crore or more to conduct impact assessments by an independent impact agency. However, the Companies Act or Rules did not notify any framework for social auditors or impact audit. Thus the social impact reporting norms can get easily adopted by CSR donors. On Philanthropic Grants . Philanthropic donors usually have outcomes frameworks that are tailor made to each grantee and its programs. It is likely that philanthropies too will adopt social audit norms notified under the SSE framework, which will reduce the need to re0invent the impact assessment framework for each grantee. However this will also prejudicially affect non-profits where outcomes are relatively slower to manifest.  Eventually, we believe that non-profits would be compelled to identify an impact measurement framework and get their impact reports audited. This will become a common requirement for eligibility towards all forms of philanthropic capital.

The Digital Personal Data Protection Act, 2023 (the DPDP Act ) is India’s first comprehensive legislation governing personal data protection. It establishes a legal framework for the collection, storage, and processing of personal data while ensuring transparency, accountability, and security. The DPDP Act applies to all entities processing personal data, including government bodies, private organizations, and research institutions and NGOs , which frequently handle sensitive information. To operationalize the DPDP Act, the Ministry of Electronics and Information Technology (MeitY) introduced the Digital Personal Data Protection (DPDP) Rules, 2023. These rules define obligations for Data Fiduciaries and rights for Data Principals to ensure privacy protection. Since research institutions and NGOs process personal data for policy analysis, healthcare programs, and social impact initiatives, adherence to these rules is crucial. In this edition, we examine how the DPDP Act and the Rules apply to research-based institutions and organizations collecting health data. Summary of the DPDP Rules The DPDP Rules regulate how Data Fiduciaries collect, store, and process personal data. Key principles include: Lawful Processing : Personal data must be processed in compliance with applicable laws and for clearly defined purposes. Purpose Limitation : Data should only be used for the specified purpose and not repurposed without explicit authorization. Data Minimization : Organizations should collect only the minimum amount of data required to fulfill their objectives. Data Security : Strong safeguards must be implemented to prevent unauthorized access, modification, or misuse. Rights of Data Principals : Individuals have the right to access, correct, and request deletion of their personal data. Applicability of DPDP Act and Rules to Research-Based Institutions Rule 15 and Its Provisions for Exemptions Rule 15, read with the Second Schedule, introduces exemptions for research, archiving, and statistical analysis. These provisions are relevant for NGOs and research institutions that manage data for social research, education, and healthcare. Key conditions under Rule 15 include: Lawful Processing : Personal data must be processed in compliance with laws and for permitted purposes. Purpose-Specific Processing : Data processing must align with Section 7(b) of the DPDP Act, requiring consent-based purposes. Processing must meet criteria under Section 17(2)(b), allowing exemptions for research, public interest, or statistical analysis. Data Minimization : Only strictly necessary data should be processed. Accuracy of Data : Reasonable efforts must be made to ensure accuracy, particularly for research impacting policy. Retention and Deletion : Data should only be retained as long as necessary and securely deleted thereafter. Security Measures : Organizations must implement: Encryption of sensitive data. Access controls to prevent unauthorized access. Security measures for third-party Data Processors. Accountability : Research institutions and NGOs must ensure compliance throughout the data lifecycle. Health Data and the DPDP Rules Health data, while not explicitly categorized as Sensitive Personal Data, demands high levels of protection. Part B of the Fourth Schedule defines relevant terms, including healthcare professionals, clinical establishments, and health services . NGOs working in the health sector may not function as direct healthcare providers but often engage in health-related initiatives, making them Data Fiduciaries under the DPDP Rules. Rule 15 and Health Data Exemptions Rule 15 provides specific exemptions for processing health data under defined conditions: Public Health Initiatives : Processing is allowed without explicit consent for activities like vaccination drives or disease prevention campaigns. Medical Research : Anonymized health data can be used for research, provided privacy safeguards are maintained. Emergencies : Health data can be processed during crises such as pandemics or natural disasters. Anonymization is critical to ensure that individuals are not identifiable when health data is used for research or statistical analysis. Compliance Requirements for NGOs in the Health Sector Organizations handling health data must adhere to key obligations: Data Security : Implement encryption, access controls, and regular audits to prevent breaches. Consent Management : When consent is required, it must be informed, specific, and revocable. Transparency : NGOs must inform individuals about the purpose of data collection and their rights under the DPDP Act. Retention Policies : Data should only be retained as long as necessary and securely deleted afterward. Accountability : NGOs must appoint a Data Protection Officer (DPO) to oversee compliance and audits. Pacta’s View on the DPDP Rules and Research-Based Institutions & Health Data The DPDP Rules, particularly Rule 15, provide a balanced framework for NGOs and research institutions. These provisions enable them to conduct crucial health and social sector initiatives while safeguarding individual privacy. Compliance is both a legal and ethical imperative. By implementing robust security measures, ensuring transparency, and upholding privacy safeguards, organizations can build trust, ensure accountability, and continue making meaningful contributions to public health and welfare. Your Voice Matters! The draft Digital Personal Data Protection (DPDP) Rules 2025 are open for public feedback until February 18 . As covered in this three-part series, these rules will shape data handling in India for individuals, businesses, and organizations alike. The Ministry of Electronics and Information Technology (MeitY) is actively seeking public input. Let us know your thoughts on the new Data Protection Rules! Your insights can help shape the future of data privacy in India.

The Digital Personal Data Protection Act, 2023 (the “DPDP Act” ) is India’s first comprehensive legislation governing personal data protection. Enacted to regulate how personal data is collected, stored, and processed, the DPDP Act introduces key principles of lawfulness, transparency, and accountability in data handling. The Digital Personal Data Protection (DPDP) Rules, 2025, introduced by the Ministry of Electronics and Information Technology (MeitY), provide a structured framework for implementing the DPDP Act, and carve out certain relaxations for educational institutions that collect and process personal data. The Rules are yet to be implemented and are open for public consultation at this time.  In this edition we delve into how the DPDP Act read with the Rules apply to educational institutions, and how educational institutions may prepare to comply with the new DPDP Act.   Recapping - Summary of the DPDP Rules The DPDP Rules regulate how Data Fiduciaries collect, store, and process personal data. These rules emphasize:  •    Data Minimization: Institutions must collect only the necessary personal data for specific, legitimate purposes.  •    Purpose Limitation: Personal data should only be used for the stated purpose and must not be repurposed without authorization.  •    Data Security: Institutions must implement technical and organizational safeguards to prevent unauthorized access, modification, or misuse of data.  •    Rights of Data Principals: Individuals, including students and parents, have the right to access, correct, or request the deletion of their personal data.  Applicability of DPDP Act and Rules to Educational Institutions   The DPDP Act applies to all entities processing personal data digitally, including government bodies, private organizations, and educational institutions. Since educational institutions collect data pertaining to students, faculty, and parents for their routine administration, operations and impact measurement, the DPDP Act would apply to educational institutions that collect and process personal data.   Definition of Educational Institutions   Part B of the Fourth Schedule of the DPDP Rules defines “educational institutions” as an institution of learning that imparts education, including vocational education. This broad definition covers schools, colleges, universities, and vocational training centers, whether they are run as for-profit or non-for-profit entities.   Impact on Educational Institutions Typically, as Data Fiduciaries, educational institutions must ensure the lawful, fair, and secure handling of personal data in activities such as admissions, academic tracking, and administrative management. As part of their regular compliance obligations, educational institutions must:  •    Obtain explicit and verifiable parental consent for processing children's personal data.  •    Not carry out behavioural monitoring and tracking of children through data collection except for educational or safety-related purposes. •    Draft a robust data privacy, data protection, data use and data retention policy along with well-established processes to implement these policies in letter and spirit.  •    Establish robust data breach response mechanisms to contain and mitigate security incidents.  •    Train staff members on data protection best practices and compliance requirements under the DPDP Rules.  •    Appoint a Data Protection Officer (DPO) to oversee compliance and governance.  Exemptions Provided to Educational Institutions  Certain relaxations have been granted to educational institutions under the DPDP Rules to balance compliance requirements with practical operational needs. These exemptions include:  •     Processing without Consent for Educational Purposes : Educational Institutions can collect and process students' data without verifiable parental consent if necessary for academic purposes, safety, or institutional operations.  •     Permissions for Limited Behavioral Monitoring: The DPDP Rules outline strict limitations on tracking and behavioral monitoring within educational institutions to protect student privacy. Such monitoring is permissible only for two key reasons: first, to support the educational activities of the institution, and second, to ensure the safety of children enrolled. This means that data collection related to student performance, academic progress, and engagement is allowed as part of the institution's educational objectives. Similarly, monitoring aimed at safeguarding students—such as preventing bullying or ensuring a secure environment—is also permitted. However, any processing of data or behavioral tracking for purposes outside of these educational or safety-related reasons (such as advertisements is prohibited). These exemptions acknowledge the unique role of educational institutions and allow them to function efficiently while maintaining privacy safeguards. However, Data Fiduciaries are not permitted to carry out any data processing activities that have a detrimental effect on the well-being of a child.   Pacta’s View on the DPDP Rules and the Education Sector   At Pacta, we recognize that the DPDP Rules introduce both challenges and opportunities for educational institutions. The increasing emphasis on data protection aligns with global privacy standards, ensuring student privacy while maintaining academic integrity. However, institutions must take proactive steps to implement data governance policies, enhance security measures, and train staff on compliance.  By embracing these changes, educational institutions can build trust with students, parents, and regulators, ensuring a safe and compliant learning environment.  If your institution needs guidance on implementing DPDP compliance measures, reach out to Pacta for expert solutions and tailored strategies.

The Digital Personal Data Protection (DPDP) Rules, 2023 (the “ DPDP Rules ”), were introduced by the Ministry of Electronics and Information Technology (MeitY), Government of India, in early January 2025, following the enactment of the Digital Personal Data Protection Act, 2023 (the “DPDP Act” ), on August 11, 2023. The DPDP Act read with DPDP Rules is poised to provide a comprehensive framework for digital personal data protection, emphasizing the principles of lawfulness, transparency, and accountability. The DPDP Rules would come into effect in a phased manner. The exact dates for the implementation of different provisions will be notified by the government, which has promised to allow organizations “enough time to adapt their processes to comply with the law”. In this edition, we delve into the implications of the DPDP Act for social sector enterprises. Overview of the DPDP Act The DPDP Act introduce two central roles in the realm of data governance: 1. Data Fiduciaries: These are entities, including organizations, businesses, or individuals, that collect, process, or store personal data. An NGO that collects personal data in digital modes can be a Data Fiduciary under the DPDP Act. Obligations of a Data Fiduciary under the DPDP: A Data Fiduciary is responsible for ensuring that personal data is handled in compliance with the law. Their obligations include obtaining explicit consent for collecting and processing personal data, implementing data security measures, and respecting the rights of individuals whose data they process. 2. Data Principals: This term refers to the individuals whose personal data is being collected or processed. A beneficiary of an NGO’s programs whose personal data is collected for monitoring, evaluation or program delivery is a Data Principal under the DPDP Act. Rights of the Data Principal under DPDP: A Data Principal has specific rights under the DPDP Act read with Rules, such as the right to access, correct, or erase their data. They are at the center of the regulatory framework, emphasizing the importance of individual privacy and control over personal information. Implications for NGOs NGOs would be classified as Data Fiduciaries as NGOs often collect and process personal data from beneficiaries, donors, and stakeholders, making compliance essential under the DPDP Rules. Importantly the DPDP Act continues to hold the Data Fiduciary responsible even for data breaches or non-compliance by Data Processors, and mandates that contracts between Data Fiduciaries and Data Processes must reflect this responsibility. The following are the compliances under the DPDP Rules that are applicable to social sector: a. NGOs should obtain explicit and informed consent from individuals (Data Principals) before collecting or processing their personal data. This consent must clearly outline the purpose of data collection, the retention period, and whether the data will be shared with third parties, such as partner organizations or service providers. b. Implement reasonable security measures , including encryption, controlled access, and regular system monitoring. If NGOs rely on third-party service providers (Data Processors) for data handling, they must ensure these entities also comply with the same security standards, and ensure that they implement appropriate checks of these compliances. c. NGOs are required to provide detailed information to Data Principals about their data processing practices. This includes specifying the purpose of data collection, the rights of individuals under the DPDP Act, and providing contact details for someone responsible for addressing queries related to data processing. d. The DPDP Rules also emphasize data minimization and retention limitation, requiring NGOs to collect only the personal data necessary for their stated purposes. Data must be retained only for as long as required by law or operational necessity. Once the purpose has been fulfilled, NGOs are expected to delete the data, ensuring that unnecessary retention does not compromise individual privacy. e. In cases where NGOs process personal data without explicit consent, as permitted by certain exceptions under the DPDP Act (such as compliance with legal obligations), it must notify the Data Principals about the processing activity. The notification should include information about the processing and provide a communication channel, such as a website or contact point, where individuals can exercise their rights under the DPDP Act. f. NGOs must appoint a Data Protection Officer (DPO) to ensure compliance with the DPDP Rules. The DPO plays a critical role in overseeing data protection strategies, monitoring compliance, and acting as the point of contact for grievances related to personal data processing. For NGOs, the DPO ensures that data collection, storage, and usage align with the principles of lawfulness, transparency, and accountability. The DPO is also responsible for conducting regular audits, training staff, and coordinating with the relevant authorities to address potential breaches or violations. NGOs can undertake the following to ensure compliance under the DPDP Rules: 1. Conduct a Data Audit NGOs must map their data collection, storage, and processing practices to identify gaps and ensure alignment with the DPDP Act and Rules. 2. Update Policies and Procedures Privacy policies, consent forms, and internal guidelines should be revised to reflect the transparency and accountability requirements under the DPDP Act and Rules. 3. Train Stakeholders Educating staff, volunteers, and other stakeholders on data protection principles is essential to foster a culture of compliance. 4. Leverage Technology Investing in technology solutions can simplify compliance tasks, from anonymization to monitoring data access. Conclusion The DPDP Rules herald a new era of accountability and privacy in data processing. For NGOs, these rules present both opportunities and challenges. By proactively adopting best practices and ensuring compliance, NGOs can not only avoid penalties but also reinforce their credibility and trustworthiness in the eyes of beneficiaries, donors, and stakeholders.