India Alternative Care Network (IACN)

Data Protection and Privacy Policy

Last updated: 19 October 2026

1. Purpose and scope

The India Alternative Care Network (IACN) is a national platform committed to strengthening alternative care systems, promoting family-based care and advocating for child rights across India. IACN facilitates the exchange of learning, dissemination of knowledge, and formation of partnerships on issues related to children without parental care or at risk of family separation.

IACN operates under international and national child rights frameworks, including:

• UN Convention on the Rights of the Child (UNCRC) and the UN Guidelines for the Alternative Care of Children (2009).
• Juvenile Justice (Care and Protection of Children) Act, 2015 (as amended).
• Mission Vatsalya, Adoption Regulations, and Model Guidelines for Foster Care (2024).

1.1 Purpose of this Policy

This Data Protection and Privacy Policy governs how personal data is collected, used, processed, stored, shared, and safeguarded across all network operations including our website (https://iacn.in), platform (https://network.iacn.in), membership management, newsletters, learning exchanges, webinars and events.

1.2 Scope and Applicability

This Policy applies to all actors within the IACN governance structure, operational and member organisations and participants.

2. Institutional Framework & Data Responsibilities

2.1 Role of IACN and the Host Organisation

• Data Fiduciary: IACN (represented by its Core Committee and Secretariat) acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act), determining the purpose and means of personal data processing.
• Operational Independence: In accordance with IACN governance rules, the Secretariat maintains an independent identity. Personal data collected for IACN operations is maintained separately from the Host Organisation's independent organizational data.

3. Key Definitions

• "Data Principal": The individual to whom personal data relates (including General Members, Steering Committee members, practitioners, researchers, care leavers, children, and website users).
• "Personal Data": Any data about an individual who is identifiable by or in relation to such data.
• "Child": An individual who has not completed eighteen (18) years of age.
• "Care Leaver": A young person who has spent time in alternative care and has transitioned or is transitioning out of care.

4. What information does IACN collect?

IACN collects only the personal data reasonably necessary to fulfill its strategic priorities: visualizing proof of concept, delivering capacity-building services, driving policy engagement, and building evidence-based research.

5. How does IACN use personal information?

IACN may use personal information to:

• Process membership applications and maintain the network's membership records.
• Share newsletters, website updates, learning resources, event announcements and other relevant communications.
• Coordinate meetings, training sessions, regional activities and learning exchanges.
• Identify opportunities for collaboration among practitioners, organisations, researchers and government stakeholders.
• Invite members to contribute to resource libraries, research, documentation, consultations and relevant initiatives.
• Understand members' professional interests and emerging needs to inform the network's strategy and work plan.
• Maintain appropriate records of network activities and improve the relevance and accessibility of IACN's resources.
• Respond to enquiries, address complaints, maintain platform security and fulfil applicable legal obligations.

IACN will not use personal information for purposes that are incompatible with the purpose communicated at the time of collection without an appropriate lawful basis and any required notice or consent.

6. Consent and transparency

Where consent is required, IACN will seek it in an informed and appropriate manner. Individuals will be told what information is being collected, why it is needed and how it will be used.

Subscribing to the IACN newsletter, registering for an event, becoming a member and agreeing to the public display of a professional profile are distinct activities. Where relevant, IACN will provide individuals with appropriate choices about these activities.

Individuals may withdraw consent where processing relies on consent, subject to applicable law and any lawful requirements to retain certain records. Withdrawing consent may affect IACN's ability to provide a particular communication.

7. Data Sharing and Transfer Protocols

IACN does not commercialize, rent, or trade personal data. Data is shared strictly on a need-to-know basis under the following parameters:

• Governance & Internal Teams: Shared among the Core Committee, Secretariat, National Coordinator, Regional Desks, and Working Group Focal Persons for operational coordination.
• Host Organisation: Shared with authorized administrative and finance leads of the Host Organisation solely for legal, human resource, and financial compliance.
• External Service Providers: Shared with vetted technology partners (e.g., website hosting, email distribution software, cloud storage) bound by confidentiality agreements.
• Statutory Disclosures: Shared with legal or governmental bodies only when mandated by Indian law or judicial order.

8. Safeguarding Children, Care Leavers, and Vulnerable Groups

Given IACN’s mandate regarding children without parental care or at risk of separation, strict safeguarding principles are applied to all data processing activities.

8.1 Child Data Protection

• Verifiable Parental/Guardian Consent: IACN does not directly collect or process personal data of children unless necessary for specific, ethically approved research activities. In such cases, prior verifiable consent from a parent, legal guardian, or Child Welfare Committee (CWC)—alongside the child’s informed assent—is strictly mandatory.
• Prohibition of Tracking/Profiling: IACN will not engage in behavioral tracking, targeted communications, or profiling of children.
• Prioritizing the Best Interest of the Child: In line with the JJ Act, 2015, data processing will never compromise a child’s safety, identity, or best interests.

8.2 Anonymization and Dignity in Communication Activities

• Default Anonymization: Case studies, documentation, and research briefs will utilize pseudonyms, generalized context, or fully anonymized data to eliminate re-identification risks.
• Trauma-Informed Media Consent: Explicit, written consent forms detailing exact usage scope and duration must be executed before publishing photographs, personal stories, or quotes of care leavers or children.
• Risk Assessment: IACN evaluates potential risks of stigma, discrimination, or retaliation before releasing any narrative or media involving care-experienced individuals or child rights defenders.

9. Data Security and Storage Measures

IACN employs administrative, technical, and physical safeguards to prevent loss, misuse, unauthorized access, or unauthorized alteration of personal data:

• Access Control: Role-based access restrictions applied to Secretariat databases and working group registries.
• Secure Storage: Cloud-hosted repositories secured with encryption standards and mandatory multi-factor authentication (MFA).
• Data Transmission: Strict prohibition against transmitting unencrypted spreadsheets containing personal or sensitive safeguarding data through informal messaging platforms or personal email accounts.
• Periodic Audits: Regular review of user permissions by the Secretariat, especially when governance terms expire or organizational roles shift.

10. Data Retention Schedule

Personal data is retained only for as long as necessary to achieve its initial purpose or comply with legal requirements:

• General Membership & Governance Records: Retained for the duration of active membership or governance tenure.
• Event & Capacity Building Logs: Retained for up to three (3) years for institutional reporting and donor audits.
• Research & Public Documentation: Anonymized data retained indefinitely for historical evidence-building; raw personal identifiers purged upon project closure.
• Financial and Administrative Records: Managed by the Host Organisation in accordance with statutory Indian retention periods (typically 7–8 years).

11. Individual Data Rights

Under applicable Indian data protection laws, Data Principals possess the following rights:

1. Right to Summary & Access: Obtain confirmation on whether IACN holds their personal data and receive a summary of processing activities.
2. Right to Correction & Updating: Request correction or updating of incomplete, inaccurate, or outdated personal information.
3. Right to Erasure: Request the deletion of personal data when processing is no longer required or consent is withdrawn.
4. Right of Grievance Redressal: Seek prompt resolution regarding any concern or suspected breach of personal privacy.

To exercise these rights, write to the IACN Secretariat at iacnsecretariat@iacn.in.

12. Breach Response and Incident Management

In the event of a suspected or confirmed data breach:

1. The Secretariat and Host Organisation technical team will initiate immediate containment measures.
2. The National Coordinator and Core Committee will evaluate the severity and potential impact of the breach.
3. Affected Data Principals and relevant authorities (including the Data Protection Board of India, where applicable) will be notified without undue delay, outlining mitigation steps taken.

Suspected breaches must be reported immediately to iacnsecretariat@iacn.in.

13. Policy Reviews and Updates

This Policy is reviewed periodically to align with evolving Indian statutory requirements.

14. Contact and Grievance Redressal

For queries, privacy concerns, or requests regarding this Policy, please contact:

Secretariat – India Alternative Care Network (IACN)

Email: iacnsecretariat@iacn.in