How to Build Audit Trails for DPDP

Question

Accepted Answer

Audit trails are the single most important evidence businesses produce during a DPDP inquiry. A compliant audit trail records:

1. Consent events — who consented, to what purpose, through which channel, in which language, with what notice version, at what time.

2. Withdrawals and preference changes — captured with the same fidelity as consent, plus the downstream suppression confirmation.

3. Rights requests — access, correction, deletion, and nomination requests, with SLA timers and resolution evidence.

4. Data access logs — who in the organisation viewed or exported personal data, and why.

5. Vendor data shares — every onward transfer, with purpose, lawful basis, and DPA reference.

6. Breach events — detection, containment, notification, and remediation timeline.

These logs must be tamper-evident (append-only, hash-chained or signed), retained for the legally required period, and exportable in machine-readable format for the Board.