Nonprofit & Social Purpose Organisations routinely hold sensitive personal data, including health, household and financial details. Much of it belongs to people with the least power to object if it is misused. As that data moves through spreadsheets, WhatsApp groups, survey apps and AI tools, the risks grow: privacy breaches, biased outputs, loose access controls and vendors no one has vetted. The DPDPA turns these good-practice questions into legal obligations, with its core duties taking effect on 13 May 2027. This session treats responsible data use as a leadership responsibility rather than an IT task, and gives leaders a practical way to find their gaps while there is still time to close them.