Right, picture this. Monday, half past nine, laptop barely awake, and there’s an email from an auditor: consent records for 25 customers, the current vendor register, and last quarter’s deletion logs, by Friday please. Sounds reasonable. Then you go hunting. Consent’s spread across two systems that have never been introduced to each other, deletions happen by email (so, somebody’s inbox, and that somebody is on leave), and the vendor register is a spreadsheet nobody’s opened since March.
Nothing in that email says you’ve done anything wrong. That’s not the point. By Wednesday you’ve realised you can’t prove half of what you’d swear you do, and that’s what an audit is really about. Not your policy. Your proof.
On timing, the actual duties start on 13 May 2027, security failures can run to ₹250 crore, and when the Board settles on a penalty it weighs up whether you tried to limit the damage, and how quickly and how well. So roughly seven months. Not tomorrow, not never.
Who’s coming for you?
First thing, “audit” means three different things here, and people mix them up constantly.
The official one only applies to Significant Data Fiduciaries. Those have to bring in an independent data auditor and do a DPIA and an audit every 12 months, and the important findings go to the Board. Nobody’s been notified as an SDF yet, going by the 2026 commentary, so unless you’re a huge platform waiting for a letter, there’s no statutory audit with your name on it. That’s the good news. The bad news is the other two.
The second kind is the one most businesses will really meet: a customer, a bank, a big enterprise partner or an investor wanting proof. Practitioners expect that even non-SDFs will be asked to show compliance. Could be a questionnaire, could be a call, could be somebody turning up with a laptop and a lot of patience.
The third is the Board, after a breach or a complaint, and there the whole conversation boils down to “what did you do about it, and where’s the proof?”
And if you are an SDF, a small trap. The Rules don’t say what “independent” means or what the auditor needs to be qualified in, so that’s your judgement to make, and to defend in front of the Board. Don’t ask the firm that wrote your policies to mark its own homework. Seems obvious. Gets missed.
Proof beats paper
If I could stick one idea on the wall, it’d be this. An auditor doesn’t care what your policy says, they test it. A policy that says “one year” proves nothing, the question is whether the data older than a year has gone. So you want real stuff on file - actual consent records, actual deletion tickets, actual access logs - and not a lovely PDF of good intentions.
| What | What they'll want to see | The law bit |
|---|---|---|
| Inventory | Where the data lives, where it goes, who else has it | The base for everything |
| Notice and consent | Which notice, which version, who said yes, when | Sections 5, 6, Rule 3 |
| Rights and complaints | Request log, how fast you replied, a contact person | Sections 8(9), 8(10), 11 to 14 |
| Security | Who can get in, encryption, logs, backups | Section 8(5), Rule 6 |
| Breach plan | The plan, the phone tree, the last time you practised | Section 8(6), Rule 7 |
| Vendors | The list, the contracts, proof you checked the scary ones | Sections 8(1), 8(2) |
| Retention | The schedule, plus proof things were deleted | Section 8(7), Rule 8 |
| Kids and overseas | Age and parent flow, where data goes abroad | Section 9, Rule 10, Section 16 |
| Ownership | Who's in charge, training, what the board sees | Section 8(4) |
A rough checklist, not legal advice. Add whatever your own sector demands.
Figure 1. From scope to evidence pack: scope and map, gap check, fix, evidence pack, dry run, repeat.
Back to that Monday email
So, the three things the auditor asked for, and then everything else in the table, in the order I’d do it.
Map first, because you can’t prove anything about data you can’t find. Which systems, which vendors, what each is for. If there’s no ROPA, you’ll learn that right now, and it’s better to learn it on a Tuesday than in the meeting.
Then the 25 customers. Pick them at random and for each one see if you can show which notice they saw, what they agreed to and when - because the Act puts the job of proving that on you, you need to show notice was given and consent obtained properly. If you’re leaning on a “legitimate use” (like having a job) - jot it down alongside a sentence explaining why that’s the reason, in one short line now.
Rights and complaints are the next in line, and trust me - they’re the easy ones to get wrong. A request that’s been hanging out in a shared inbox for three weeks is something an auditor will spot in about 10 minutes flat - so keep a log, a named contact in the public eye, and your reply times totally on the level.
Security is the one that gets people all twisted up. Nobody’s expecting perfection - they just want the basics covered: who’s let in, whether there’s any encryption at play, whether you’ve got an eye watching what’s going on, whether your backups are working and your logs are kept for long enough. And “we use encryption” isn’t evidence - a screenshot or an export is.
Breach plan: show it, show the phone tree, show when you last practised. The clocks are brutal, since Rule 7 wants customers told without delay and a detailed Board report inside 72 hours, and CERT-In’s six hours is running next to it.
Vendors and retention come as a pair in my head. For vendors, a list, a contract each, and proof you’ve looked hard at the risky ones. For retention, don’t just show the schedule - show the deletion happened, because that’s the bit auditors go straight for. Got children’s data, or sending anything overseas? Bring the parent-consent flow and a map of where it goes.
And lastly the most crucial but also most mundane one: who’s really in control here - who’s been given the keys & what ends up on the board. Treat audits like the regular thing they should be, not some annual surprise, and keep your DPDP records in sync with whatever your sector regulator is already after.
Pack it all up neatly
One folder per control, neatly sorted, with five basic things inside: the policy, the procedure, a handful of real-life examples, the owner’s name and date, & when the last person looked at it. Label the files in a way a non-expert could find them. Next time that audit email lands, you want to be able to send a link & get on with your day without starting a wild goose chase.
Do a trial run
Pick ten items off that table and play auditor. Ask yourself for 25 consents, five deletions, five vendor files, one set of access logs. Time it. Notice where you get stuck. Gaps you find in a dry run cost you a week, and gaps found in the real thing can cost a great deal more.
Where it usually goes wrong
Mostly in the joins between systems. The consent log’s there, but it never recorded which notice version the customer saw. Deletion works in the main database and never reaches the warehouse, the vendor or the backups. A vendor contract ran out last year and nobody noticed. The policy says one thing, the team does another. And over and over, nobody can say who owns a particular control. None of that takes a big budget. It takes a name and a date.
What to fix first
Not every gap is created equal, think about what the law actually hangs on each one: when it comes right down to it, security safeguards carry the highest stakes, failing to report a breach or mishandling kids’ data is second only to that, and the rest get lumped into a general catch-all. Prioritize the really heavy ones first, give a date to the rest, and make sure that a gap with an owner and a deadline looks a lot different from one that’s just been ignored.
Your next two months
Weeks one and two, scope it, map it, decide who owns it. Weeks three to five, sample your consents, deletions and vendors and write the gaps down. Weeks six to eight, fix the riskiest and build the folders. Then the dry run. Seven months is plenty if you start now, and not nearly enough if the first time you gather evidence is the week somebody asks for it.
If you’d like to see how a platform keeps consent records, vendor registers and deletion logs audit-ready, talk to the team, or start with the free plan.
Frequently Asked Questions
Only for Significant Data Fiduciaries, once the government notifies them, and they’ll need an independent data audit every 12 months. Nobody else is legally required to have one. But customers, banks, investors and enterprise partners will increasingly ask for proof, and the Board will want the same after a breach or complaint, so being ready matters either way.
For SDFs, it has to be an independent data auditor. The Rules don’t say what qualifications that auditor needs or what “independent” actually means, so you’ll have to make the call and be ready to defend it. Avoid hiring the same firm that wrote your policies, because that’s basically asking them to mark their own homework.
A data map, notice versions and consent records, a rights and complaints log, security evidence like access logs and encryption settings, a breach plan with proof you’ve practised it, a vendor list with contracts, a retention schedule with proof of deletions, and a named owner for each area. Real records count for far more than polished policy documents.
Play auditor for a day. Pull 25 random consent records, five deletion requests, five vendor files and one set of access logs, and time how long each one takes to find. Anywhere you get stuck is a gap, so write it down with an owner and a date. It’s a cheap way to find problems before an outsider does.
Go by what the law weighs most heavily. Security safeguards carry the biggest penalty, up to ₹250 crore, followed by breach notification and children’s data at up to ₹200 crore each. Most other failures fall into a catch-all band of up to ₹50 crore. Fix the heavy ones first and put a deadline on everything else.
From 13 May 2027, when the main duties start, so your evidence has to exist by then. Customer and partner questionnaires may well land before that. A workable plan is about two months: scope and map first, then sample and list the gaps, then fix the riskiest ones and build tidy evidence folders before a dry run.