India’s Digital Personal Data Protection Act now applies to all of it. Most nonprofits are still treating data protection as a programme problem, something to do with beneficiary records and field surveys. Meanwhile the exposure is sitting in HR.