In short. Under India's Digital Personal Data Protection Act, 2023, a programme office that collects applications is a Data Fiduciary: it decides why and how applicants' personal data is processed. In practice that means giving a clear notice at the point of collection, using the data only for the stated purpose, collecting no more than that purpose needs, keeping it no longer than necessary, honouring requests to correct or erase it, protecting it, and naming someone applicants can contact with a grievance. This is general guidance for programme offices and not legal advice; confirm the details with your counsel and the current text of the Act and Rules.
Calls for applications gather a surprising amount of personal data: names, phone numbers, dates of birth, family income, academic records, referee details, photographs, sometimes disability or health information. The DPDP Act gives the people behind that data enforceable rights, and gives the office holding it duties. This article translates the main ones into the steps of running a call. Timelines for different parts of the law are phased, so check which obligations apply to you on the date you collect.
Key Terms in Plain Words
You remain responsible for personal data even when a processor holds it. Choosing software is therefore a compliance decision, not only a procurement one.
Give Notice Before You Collect
Before or when an applicant gives you data, the Act expects a notice that tells them, in clear and plain language:
- What personal data you are collecting.
- The purpose for which it will be used.
- How they can exercise their rights, including withdrawing consent and complaining to the Board.
- How to contact you with a grievance.
Practical steps for an application form:
- Put a short notice at the top of the form, linked to the fuller privacy policy. Do not bury it in a terms page.
- Write the purposes as applicants would understand them: "to assess your application, to contact you about your result, and to verify your eligibility."
- Obtain consent with an unticked box and a clear action, separately from accepting the call's terms.
- Offer the notice in English and, where your applicants need it, in the languages the Constitution lists.
- Keep a dated copy of the notice version and a record of who accepted which version.
Limit Purpose and Collect Less
Two principles do most of the work. Purpose limitation means data collected to assess an application is not later used for marketing your other programmes or shared with sponsors unless the applicant was told and agreed. Data minimisation means you ask only for what the purpose needs.
A form audit helps. List every field and write beside it the decision it feeds. If you cannot name one, remove the field. Date of birth may be needed to check an age limit, while home address may not be needed until an award is made. Sensitive material, such as income, category and disability, should be collected only where eligibility rules require it, shown only to the people who verify eligibility, and kept apart from merit review.
Special care applies to children. The Act treats anyone under 18 as a child and requires verifiable consent from a parent or guardian before processing, with limits on tracking and targeted advertising. School competitions and junior hackathons should plan for this at the form design stage.
Retention and Erasure
Keep personal data only as long as the purpose requires, unless a law requires you to keep it longer. Decide retention periods before the call opens, per category:
When an applicant withdraws consent or asks for erasure, you generally need to delete their data, and tell any processors to do the same, unless a legal requirement obliges you to retain it. Set up a route for this before the first request arrives: who receives it, how identity is checked, who deletes, in what systems, and how you confirm. Erasure that only removes a name but leaves date of birth, phone number and free-text answers in exports and backups is incomplete. List every place applicant data lives: the application system, spreadsheets, email threads, shared drives, files downloaded by reviewers.
Security and Breach Response
You must take reasonable security safeguards to prevent a personal data breach, and notify the Board and affected individuals if one occurs. In programme terms:
- Limit access by role: reviewers should see what they need to score and nothing else.
- Use accounts, not shared passwords, and remove access when a person leaves a panel.
- Make links to private files expire.
- Keep an audit log of who opened what.
- Have a one-page breach plan naming who decides, who contacts applicants and who contacts the Board.
- Agree in writing with every processor how they will tell you about an incident, and how fast.
A Grievance Officer
The Act expects a Data Fiduciary to publish business contact information for someone able to answer questions about processing, and to provide a grievance redressal mechanism. Name a person or a role, give an email and a response time, publish both in the privacy notice and on the application page, and log every complaint and its outcome. Applicants are usually satisfied by an answer and a fix, and the Board is less likely to hear about a problem that was resolved at your desk.
Reviewers, Referees and Nominees Are Data Principals Too
It is easy to think only of applicants. Referees give their details so that you can contact them. Nominators and nominees are named by others. Reviewers have profiles, conflicts and scores. Each needs to be told what you hold and why. For nominations, notify the nominee that they have been nominated, say what you hold about them, and ask whether they agree to be considered before any jury reads it.
How IdeaScore Helps
IdeaScore is designed so that much of this is a setting and not a spreadsheet. Questions can be marked as sensitive, so answers such as income, category and disability reach only the people verifying eligibility, with a retention period you set. Nominees can be asked to agree before a jury reads their nomination. Roles open only what they should, private files open only for programme staff, assigned evaluators and the team itself, and shared links expire. Deleted items can be restored for 30 days by an owner, and complete removal is available on request, including date of birth and other personal details. Names and contact details are never sent to IdeaScore AI. The Trust Centre lists the laws and standards we work to, including a self-assessed "DPDP Act Ready" badge, which is a statement of our own readiness and not a certificate.
The Act places duties on you as the Data Fiduciary, and no tool discharges them for you. Software can make the notice, the access controls and the deletion route easier to run.
A Starter Checklist
- A plain-language notice on the form, with purposes, rights and a contact.
- Separate, unticked consent, and a stored record of the version accepted.
- A field-by-field audit: every question tied to a decision.
- Sensitive answers limited to eligibility staff, with a retention period.
- A plan for applicants under 18, including verifiable parental consent.
- Retention periods by data category, set before opening.
- An erasure route that covers every system and export.
- Role-based access, expiring links and an audit log.
- A breach plan and processor agreements that cover it.
- A named grievance contact, published and answered within a stated time.
- Notices to referees, nominees and reviewers.
Start with the form audit, because it is the quickest way to reduce risk: data you never collect cannot leak, be misused or need erasing later. As with any law that is being phased in, read the current Act and Rules, and take legal advice for your institution's particular position.
