Paper consent is still personal data under the DPDP Act

Sehmat team · 28 September 2026

Yes. The DPDP Act applies to personal data collected “in non-digital form and digitised subsequently” (s.3(a)(ii)). If a field worker fills a paper form and someone later scans it, types it into a spreadsheet or enters it in an app, the Act applies to that data. Paper consent forms need the same notice, choice and proof as a web form.

This matters most for work that happens away from screens: field programs, NGOs, health camps, school drives, self-help groups and CSR projects.

Key points

The Act covers personal data collected digitally, and data collected on paper and digitised later (s.3(a)).
A notice must come with or before the consent request, on paper too (s.5(1)). Its contents are set by Rule 3 from 13 May 2027.
The notice must be available in English or any Eighth Schedule language (s.5(3), s.6(3)).
Withdrawal must be as easy as giving consent (s.6(4)). A person who signed on paper needs a simple way to withdraw.
The organisation must be able to prove notice and consent (s.6(10)). A pile of loose forms is hard to rely on.

Why does paper fall under a digital data law?

The Act is about digital personal data, but it defines that broadly. Section 3(a) covers data collected “(i) in digital form; or (ii) in non-digital form and digitised subsequently”. Most paper records are digitised at some point. A beneficiary list goes into Excel. A health camp register is typed into a reporting tool. A scanned form sits in a shared drive. From that moment, the Act’s duties apply.

The Act does not apply to data kept purely for personal or domestic purposes (s.3(c)(i)). An organisation running a program is not in that position.

Who does this affect most?

NGOs and CSR implementers that enrol beneficiaries in villages and urban settlements.
Health camps that record names, ages, phone numbers and health details.
Schools and education programs that collect data about children and parents.
Microfinance, livelihood and self-help group programs that keep member registers.
Funders and program partners that receive beneficiary data from implementers.

Each of these may be a Data Fiduciary, which is anyone who decides the purpose and means of processing (s.2(i)). In a partnership, more than one organisation may be a Data Fiduciary, so agree on who does what.

Some government benefit processing has its own rules: Act s.7(b), Rule 5 and the Second Schedule. If you deliver a scheme for the State, check whether that route applies before you design a consent form.

The same tests apply as for any consent. It must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6(1)). On paper, that means:

A notice the person can read. Print it in their language and in English. Rule 3 needs an itemised list of data and each purpose.
Separate ticks for separate purposes. For example, one box for enrolment and another for photos in a donor report. Never pre-tick.
A clear action. A tick, signature or thumb impression made by the person.
Contact details. Name a person who can answer questions (s.6(3); Rule 9).
A way to withdraw. Print a phone number, link or QR code the person can use later (Rule 3(c)).

Children and guardians

If a participant is under 18, the parent or lawful guardian must give verifiable consent (s.9(1)). The same applies to a person with disability who has a lawful guardian. Rules 10 and 11 set out how to check, from 13 May 2027.

Before the field visit

Keep the form short. Ask only for the data you need (s.6(1)).
Print a version number and date on every sheet, so you know which notice the person saw.
Print in the local language alongside English. Have the translation checked by a fluent reader.
Train field staff to read the notice aloud when people cannot read it themselves.

In the field

Give the person time. Answer questions. Do not make a service depend on an unrelated consent.
Leave a copy or a card with the withdrawal contact.
Store completed sheets securely. Do not leave them in vehicles or open offices.

After the field visit

Digitise promptly, and check the scan against the paper.
Link each scan to the person’s record and the notice version.
Decide how long you will keep the paper and the scan (s.8(7)). Then follow your plan.
Protect the digitised data with access control and logs (Rule 6).

How Sehmat helps

Print bilingual paper consent sheets with a QR code on every page.
Upload scans or phone photos. Sehmat straightens the pages and reads boxes, signature ink and handwriting in Indian scripts using AI processed in India. A person reviews each result.
Each consent is stored with the exact notice version and language shown, a proof PDF with an integrity code, and write-once evidence kept for 7 years by default.
Field teams can collect consent offline using the Android SDK, and people can later withdraw from their personal link.
Data is stored in data centres located in India.

Sources

This article is general information, not legal advice.