Child protection and safeguarding for NGOs

Safeguarding is how an organisation keeps the children and vulnerable adults it works with safe from harm, and what it does when it is worried that someone is at risk. In India part of it is also law: under the Protection of Children from Sexual Offences Act, 2012 (POCSO), anyone who knows or suspects that a child has been sexually abused must report it to the police.

This guide is for NGO leaders, staff and volunteers, and for CSR teams that fund work with children. It explains the law in plain words, but it isn’t legal advice: in a specific case, turn to the police, the child helpline, a lawyer or a child protection professional.

If you are worried about a child right now

Act calmly and quickly. You don’t need proof, or anyone’s permission, to call for help.

1. If a child is in immediate danger, call 112 for the police, the fire service or an ambulance.
2. For a child at risk, call 1098, the national child helpline. It is free, it runs 24 hours a day with control rooms in every state and union territory, and it is linked with 112.
3. If you know or suspect sexual abuse, tell the police: the local police station or the Special Juvenile Police Unit (SJPU), the police unit for children that every district and city must have. Under Section 19 of POCSO this is your own legal duty, not only your organisation’s.
4. Tell your organisation’s safeguarding lead at once, so they can make the child safe and help you report.
5. Write down what you saw or heard as soon as you can: the child’s own words, the date, the time and who was there.
6. Don’t investigate, and don’t confront anyone. Questioning a child again and again, or warning a suspect, can damage the case and put the child at greater risk.

What safeguarding means

Safeguarding is the broad duty: preventing harm to the people you work with, and acting when harm is suspected. Child protection is the part that deals with children who are being harmed or are at risk. In POCSO and in the Juvenile Justice (Care and Protection of Children) Act, 2015 (the JJ Act), a child is anyone under 18. A vulnerable adult is someone who, for a time or always, can’t fully protect themselves, such as some older people, patients and people with disabilities.

Harm can be abuse of any kind, neglect, exploitation such as child labour, or harm online, and it can come from anyone, including an organisation’s own habits, such as publishing a child’s photo with their name and school. Every organisation that works with children should name a designated safeguarding lead: the person who receives every concern and makes sure the right people act.

The law in brief

Each district has at least one Child Welfare Committee, which decides on the care of children in need of care and protection, and since the 2021 amendment to the JJ Act the District Magistrate’s recommendation is considered before a children’s home is registered. From 13 May 2027, data protection law also requires a parent’s or guardian’s verifiable consent before you process a child’s personal data: see data protection for NGOs.

What a child protection policy should contain

A child protection policy is your organisation’s written promise and its rulebook. Many CSR funders ask to see one before they fund work with children.

Safe recruitment and a code of conduct

Safe recruitment makes it harder for someone who means harm to reach children through your organisation. For any role that involves children:

• say in the role description that it involves children and that checks will be made;
• check identity and references, ask about working with children at interview, and ask candidates to declare any criminal record;
• for roles that bring the same adults back to work with children regularly, carry out police verification and background checks, and repeat them from time to time, as Rule 3 of the POCSO Rules expects;
• train people on your policy before they start, and supervise them closely while they are new.

A code of conduct turns the policy into plain rules for the day: never be alone with a child; no private contact with children by phone, WhatsApp or social media; no gifts or money to individual children; touch only when it is appropriate and the child is comfortable; never take a child anywhere; no alcohol or drugs; and never hit, shout at or punish a child. Physical punishment isn’t only a breach of the code: under Section 75 of the JJ Act, cruelty to a child by someone employed by, or managing, an organisation entrusted with the child’s care can bring up to five years’ rigorous imprisonment and a fine of up to ₹5 lakh.

The two-adult rule

The two-adult rule means that no staff member or volunteer is ever alone with a child or a vulnerable adult: at least two adults are present, in the open. It protects children, and adults too. Hold one-to-one reading or tutoring where others can see, ask a teacher or carer to take a child to the toilet, never let one adult drive a child alone, and name a safeguarding lead for every activity with children. Volunteering on SocioStory is for adults only, and every drive with children follows this rule; our safeguarding policy sets out the rest.

Responding to a disclosure

A disclosure is when someone tells you that they, or someone else, are being harmed. Listen calmly, and don’t show shock or anger. Don’t ask leading questions: “Tell me more” is enough, “Was it your uncle?” is not. Never promise to keep it secret. Reassure them that they were right to tell you, write down their words as soon as you can, and report it straight away.

A good first response might be: “Thank you for telling me. You’ve done the right thing. I can’t keep this a secret, because I need to tell people who can help keep you safe.”

Then the organisation acts. It makes the child safe first, reports to the police where the law requires it, tells only the people who need to know, and keeps records securely. If the concern is about a staff member or volunteer, keep them away from children while it is looked into: that protects everyone, and it isn’t a finding of guilt. An internal inquiry never replaces a report to the police.

Photos, stories and online safety

Photograph children only with a parent’s or guardian’s consent and the organiser’s agreement. Never publish anything that could identify a child victim or a child in care, not even in a WhatsApp forward: blurring a face doesn’t help if the caption names the school or village. Turn off location tags, because a photo’s location data can lead someone to a child’s home or a shelter. Our guide to consent, photos and dignity covers this in full.

What CSR funders and partners expect

CSR teams increasingly ask partners that work with children for a written policy, a named safeguarding lead, training records and a reporting route before they release money. Paperwork shows that a policy exists, not that it works, so good funders also ask how the last concern was handled, without asking for anyone’s identity, and write safeguarding into their CSR agreements.

If you are on a CSR team, check safeguarding when choosing an NGO partner, in proportion to the risk, and help a promising partner fix gaps rather than simply turning it down. Make sure your employee volunteers follow the partner’s rules, and never ask for photos or stories that identify children.

Common mistakes

• A policy on paper that nobody has been trained on.
• Leaving one adult alone with a child “just for five minutes”.
• Promising a child to keep a secret, or waiting for proof before reporting.
• Opening a hostel or children’s home before it is registered under the JJ Act.

The Academy’s safeguarding course teaches all of this in short, practical lessons.