Who needs to comply with the DPDP Act 2023?

Any organisation that processes digital personal data in India, and any organisation outside India that processes such data to offer goods or services to people in India, is a Data Fiduciary under the Act. This covers banks, NBFCs, fintechs, hospitals, e-commerce, EdTech, SaaS and most businesses that hold customer or employee data.

When do DPDP Act obligations come into force?

The DPDP Rules 2025 were notified in November 2025 with a phased rollout. Provisions setting up the Data Protection Board of India took effect immediately, Consent Manager provisions follow after 12 months, and the core Data Fiduciary obligations — notice, consent, security safeguards, breach reporting and data principal rights — apply 18 months after notification, from May 2027.

What are the penalties for non-compliance with the DPDP Act?

The Data Protection Board of India can impose penalties of up to ₹250 crore for a failure to take reasonable security safeguards to prevent a personal data breach, with other penalties scaled by the type of breach under the Schedule to the Act.

How much does a DPDP compliance audit cost?

A one-time, project-based DPDP audit costs ₹1.5 lakh to ₹3.5 lakh per engagement. Ongoing DPO advisory on a monthly retainer costs ₹25,000 to ₹45,000 per month. Prices are indicative; the final fee depends on organisation size, data volume and scope, and GST applies.

Is AI used to reach audit conclusions?

No. AI-assisted Computer Audit Tools (CAATs) gather and organise evidence and report observations only. Every compliance determination, materiality assessment and audit opinion is made personally by Ram Krishan Dudeja, CISA, in line with ISACA and IIA professional standards.

Do you offer DPDP audits across India?

Yes. DPDP Audits works with organisations Pan-India, both remotely and on-site.

Can an IS audit or CERT-IN empanelled firm partner with DPDP Audits?

Yes. Under the Annual Audit Partner model, DPDP Audits works as a sub-contractor adding a DPDP module to your existing client engagements, on a day rate of ₹18,000 to ₹28,000 or a 20–30% revenue share, with the report co-branded with your firm.

DPDP Audit Checklist: What an Auditor Will Test

Q: What is a DPDP audit?

A DPDP audit is an independent assessment of how your organisation collects, uses, stores and shares digital personal data, measured against the Digital Personal Data Protection Act 2023 and the DPDP Rules. DPDP Audits tests 67 controls mapped across 21 sections of the Act and reports the gaps, with a remediation roadmap signed off by a CISA-certified auditor.

A DPDP audit tests whether an organisation's actual practice — not just its policies — meets the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. The checklist below reflects the areas covered in a DPDP Audits engagement, which maps 67 controls across 21 sections of the Act. Use it as a self-assessment before an independent audit.

How to use this checklist

For each question, ask what evidence would prove the answer: a screenshot of the consent screen, an export of access logs, a signed processor contract, a closed DSAR ticket. A policy that says something happens is not evidence that it does.

Applicability and data inventory

Is there a current inventory of personal data by system, purpose and owner?
Are all Data Processors (vendors, cloud, SaaS) identified and under contract?
Has the organisation assessed whether it may be notified as a Significant Data Fiduciary?

Notice and consent (Sections 5 and 6)

Does every collection point show a standalone notice with an itemised list of data and purposes?
Is consent free, specific, informed, unconditional and unambiguous, with a clear affirmative action?
Can consent be withdrawn as easily as it was given, and is withdrawal honoured downstream?
Is there an auditable record of when and how each consent was obtained?

Legitimate uses (Section 7)

Where processing relies on a legitimate use instead of consent, is the basis documented?

Data Fiduciary obligations (Section 8)

Is personal data accurate and complete where it is used for decisions or shared?
Are retention periods defined, and is data erased when the purpose is served?
Is a contact person (or DPO) published for data protection queries?

Security safeguards (Section 8(5))

Is personal data encrypted, masked or tokenised at rest and in transit?
Are access rights role-based, reviewed periodically and revoked on exit?
Are access logs kept for at least one year and actually monitored?
Do processor contracts require equivalent safeguards?

Breach management (Section 8(6))

Is there a tested incident response plan covering Board and Data Principal notification?
Can the organisation produce a detailed breach report within 72 hours?

Children's data (Section 9)

Is age identified at onboarding, and is verifiable parental consent obtained for under-18s?
Are tracking, behavioural monitoring and targeted advertising aimed at children blocked?

Data Principal rights (Sections 11–14)

Can individuals request access, correction, completion and erasure through a published channel?
Are requests logged, tracked and closed within the prescribed timeline?
Is there a grievance redressal mechanism, and a nomination facility?

Cross-border transfers (Section 16)

Is every transfer of personal data outside India identified, with destination and recipient?
Are transfers checked against any country restrictions notified by the Government?

Consent Managers (Rules)

If a Consent Manager is used, is it registered and are integrations documented?

What an independent audit adds

Self-assessment finds the obvious gaps. An independent auditor tests evidence against each control, records deviations with a chain of custody, and gives you a prioritised remediation roadmap signed off by a CISA-certified professional — the kind of record that stands up if the Data Protection Board ever asks questions.

For the timeline these controls must meet, read DPDP Rules 2025 explained.