Is a DPDP compliance audit mandatory for every business?

No. The Act and Rules prescribe a recurring audit only for Significant Data Fiduciaries, which must appoint an independent data auditor and complete a data protection impact assessment and an audit every twelve months under Rule 13. Sector regulators or contracts can still call for reviews. Other businesses have no prescribed audit, yet they carry the core duties from 13 May 2027, and an internal audit gives evidence that notices, consent and safeguards operate as described. Confirm with counsel if the Government has notified your business as significant.

Who can conduct a DPDP compliance audit?

A Significant Data Fiduciary must use an independent data auditor, and an external firm with no part in designing the audited systems is the lower risk choice; counsel should confirm whether an internal team can qualify. Other businesses can use their own compliance team, an internal audit function or an external adviser. Where the same team built the controls, add an independent reviewer for the annual test.

How often should a DPDP compliance audit be done?

A Significant Data Fiduciary audit runs every twelve months under Rule 13, counted from notification. The Rules prescribe no cycle for other businesses, and a practical schedule is one full audit each year with quarterly spot checks on consent and rights requests. A review after any new vendor, new data field or breach keeps the evidence current between audits.

What documents does a DPDP auditor ask for?

Auditors ask for a data inventory that records the purpose of each field, and for dated versions of every notice. They also ask for consent and withdrawal records and the rights request log. Security evidence includes access reviews and log retention settings. Breach evidence covers the playbook and the record of the last drill. Vendor contracts and the retention schedule complete the pack, and a Significant Data Fiduciary adds its DPIA file.

What is the difference between a DPDP gap assessment and a DPDP compliance audit?

A gap assessment compares current practice with the requirements and produces a roadmap of what to change. A compliance audit checks that the controls operate and records the evidence, using samples traced from start to finish. Many businesses run the gap assessment first, fix the findings and then run the audit to confirm the result.

DPDP Compliance Audit: What to Review, Who Should Run It and How Often

Learn what a DPDP compliance audit covers, who should run it and how often to repeat it, with an evidence checklist and audit calendar for Indian businesses.

A DPDP compliance audit tests if your teams follow the data practices your policies describe. Only businesses the Government notifies as Significant Data Fiduciaries must appoint an independent data auditor under the Act, with an audit every twelve months under Rule 13. All other businesses set their own schedule. A yearly full audit with a short check each quarter is a reasonable place to begin.

Banking partners and the regulator can ask how the business handles personal data. A DPDP compliance audit lets you answer with a dated report and the records behind it. A policy document records what you intend. The audit follows one opt out from the store counter to that evening's WhatsApp campaign and records what happened. Each section marks which points are legal requirements and which are recommended practice.

Why Plan Your DPDP Compliance Audit Before 13 May 2027

The DPDP Rules 2025 were notified on 13 November 2025 and their duties start in stages. On 13 November 2026, Rule 4 begins, covering the registration of Consent Managers. The larger stage arrives on 13 May 2027, when duties such as notice, consent and security safeguards begin. Run the first audit well before 13 May 2027 and teams can fix what it finds.

Penalty bands show why records matter. The Schedule to the Act caps penalties at ₹250 crore for failing to maintain reasonable security safeguards. Failing to notify a breach, or breaching children's data duties, carries ₹200 crore. Breaches of Significant Data Fiduciary duties go up to ₹150 crore, and other provisions up to ₹50 crore. Each figure is the highest amount possible. Before it sets an amount, the Data Protection Board must consider how serious and how long the breach was, and what the business did to limit the harm.

The penalties guide explains how these bands apply: DPDPA penalties of up to ₹250 crore: triggers and how to avoid them

The Act and Rules prescribe a recurring audit for one group. Significant Data Fiduciaries (SDFs) are businesses the Central Government names after looking at how much and how sensitive their personal data is, and the risk to individuals. Every other business can treat the audit as recommended practice. A lender or a large customer still gets a dated record that the duties work as described.

What Does a DPDP Compliance Audit Review?

The DPDP audit checklist below has nine areas covering the duties most businesses carry. Your scope depends on the data you process and the exemptions or sector rules that apply. In each area, the auditor follows a real case through and asks for the records.

Where personal data enters. The auditor lists every place data comes in, from a website form to a store billing counter, and asks why each field is collected. The proof is a data inventory with the purpose beside each field. A record of processing activities (RoPA) is a GDPR term for a similar register, and the DPDP Rules do not name it.
Notices. A notice should tell the customer which personal data you collect, why, and what goods, services or uses it enables (Rule 3). At each collection point, the auditor compares the notice customers see with the approved version. Evidence: dated notice versions and the screens where each appears.
Consent and withdrawal. A consent record should show who agreed, which notice they saw and when. The Act expects withdrawal to be as easy as giving consent. The auditor checks that a sample of withdrawals reached the campaign and messaging tools. Consent logs and the traced samples serve as proof.
Rights requests and grievances. Individuals can ask to see their data, correct it or erase it, and can raise a grievance. Rule 14 allows a reasonable period of up to 90 days to answer a grievance, and sets no deadline for the other requests. Keep a log that records each request's type, its dates and any escalation.
Security safeguards. Rule 6 lists safeguards such as encryption and access control. The Rule also requires logs and personal data to be kept for one year to detect and investigate unauthorised access. The auditor checks who can reach which systems, including former employees and vendors. Access review records and log retention settings are the proof.
Breach readiness. Rule 7 requires the business to inform each affected individual without delay. The Board receives a description of the breach without delay, followed by further details within 72 hours, or a longer period the Board allows on a written request. The auditor will ask for the written breach plan and the last drill record. If your sector regulator sets its own reporting timelines, counsel can confirm which one applies to you.
Vendors and processors. A Data Processor is a vendor that handles personal data for you, such as your SMS agency or call centre. The Act allows this only under a valid contract. Rule 6 expects that contract to include safeguards where they apply. Your business still answers for the data. A vendor register of what each vendor receives, with contract extracts, completes the evidence.
Retention and erasure. When a customer withdraws consent or the purpose ends, erase the data unless another law requires retention. Vendors must erase their copies too. The Rules set no default retention period for businesses in general. Rule 6 keeps logs for security purposes, and Rule 8(3) separately requires specified logs and related data to be kept for a minimum of one year, for the purposes listed in the Seventh Schedule. Evidence: a retention schedule and records of deletion runs, including those at vendors.
Children's data and SDF duties. If you process the data of a child under 18, you need verifiable parental consent. The Rules list some exemptions. A notified SDF also appoints a Data Protection Officer based in India. Every year it completes a data protection impact assessment (DPIA), a structured review of processing risks. Keep age checks and guardian consent records, and the DPIA file for an SDF.

The checklist guide gives the full readiness list: DPDPA compliance checklist: 20 steps for Indian businesses

Who Should Run Your DPDP Compliance Audit?

Start by judging if your business is likely to meet the SDF criteria. Only the Central Government can notify a business, so your own assessment cannot confirm SDF status. A notified SDF needs an independent data auditor under the Act, and under Rule 13 the auditor sends the significant observations to the Data Protection Board. The Act gives no criteria for independence. An external firm with no role in designing the systems under review is the lower risk reading, and counsel should confirm whether an internal team can qualify. Confirm with counsel if the Government has notified your business before assuming the duty applies.

A business that is not notified can split the work into layers as recommended practice:

Process owners review their own flow each quarter. In retail, the CRM team can trace last month's WhatsApp opt outs into the campaign tool, and HR can check who has access to employee records.
A privacy or compliance lead keeps the evidence in one folder and fixes the audit dates. The Act requires a Data Protection Officer for SDFs only, so a smaller business can name a senior colleague to own privacy work.
An independent reviewer, such as internal audit or an outside firm, tests a sample every year and reports to senior leadership. Because this person did not build the controls, the findings carry more credibility.

An external DPDP compliance consultant helps most with a first baseline audit, with data flows across several vendors and in SDF preparation. With OneConsent's DPDP compliance audit services, the OneConsent team reviews and audits the scope you agree, and you receive personalised findings. Keep roles separate where independence matters. A firm that designed or sold the controls under review should not act as the independent auditor an SDF must appoint.

How Often Should You Run a DPDP Compliance Audit?

Rule 13 sets the only fixed cycle. From 13 May 2027, a notified SDF completes its impact assessment and audit once every twelve months, counted from the date of its notification. For every other business the Rules prescribe no cycle, so the timing is your call. The schedule below is recommended practice.

Annual full audit of all nine areas. Hold the first one before 13 May 2027, so findings are fixed by the time the duties begin.
Quarterly spot checks on a few consent withdrawals and rights requests, and on vendor changes.
Monthly dashboard showing open rights requests and grievances against your published response periods, and access reviews still pending.
Event reviews when you add a vendor or collect a new data field, and after a breach or a change in the Rules.

How to Run Your First DPDP Compliance Audit

Decide the scope first, and name one owner with the authority to ask any team for evidence. For a first audit, take the nine areas above and limit them to the systems and period you choose. The work grows with each extra system and vendor, so a gap assessment helps when scope is unclear.

Then send each team a request listing the documents its area needs.

Testing follows. Take ten customers who opted out at a store counter or in the app and check each against the SMS and WhatsApp tools; for access, check five departed employees. A traced sample answers what policies leave open, such as how long a withdrawal takes.

Rank findings by legal importance and harm to individuals, then by operational effect and urgency. The penalty provision is one input. Assign each finding a named owner and due date, and retest after the fix.

A DPDP gap assessment, sometimes called a readiness assessment, is a sensible step before the audit. The assessment lists where current practice falls short of the requirements and gives you a roadmap. The audit comes later and tests whether the fixes work, recording the evidence.

What Should Leadership Receive After the Audit?

A useful report states what was covered, the period and the method, including sample sizes. Every finding carries a severity rating and points to its evidence, and it names an owner and a due date. The retest result closes it. Leadership also needs a one page summary. The summary should list the findings that could interrupt customer sign ups or campaigns, the gaps that cut across teams or vendors, and any fix that needs budget or approval.

How DPDP Compliance Software Supports Audit Evidence

The records an auditor needs live across systems, from the CRM to vendor portals. DPDP compliance software can bring consent records and request logs into one place, so auditors sample from it directly. In a demo, ask to see dated consent evidence and a trace from a withdrawal to each connected messaging tool.

A DPDP compliance platform such as OneConsent offers modules for gap assessment and data discovery, plus consent audit trail and DPIA. Breach management and third party risk management modules cover the breach and vendor areas of the audit.

Software records and organises evidence. Scope decisions, sign off and legal interpretation stay with your team. An SDF still has to appoint its own independent auditor, and a platform cannot make a business compliant on its own.

Prepare Audit Ready Evidence with OneConsent

If you plan a DPDP compliance audit before 13 May 2027, start with a gap assessment. The OneConsent team reviews your notices, consent flows and vendor arrangements against the Rules, and you receive personalised findings to act on. To see how consent records and audit reports look in the platform, book a OneConsent demo. OneConsent's DPDP compliance solutions can help your team gather and organise audit evidence; decisions on scope and fixes stay with you.