What is a DPDP audit?

A DPDP audit is an independent assessment of how your organisation collects, uses, stores and shares digital personal data, measured against the Digital Personal Data Protection Act 2023 and the DPDP Rules. DPDP Audits tests 67 controls mapped across 21 sections of the Act and reports the gaps, with a remediation roadmap signed off by a CISA-certified auditor.

Who needs to comply with the DPDP Act 2023?

Any organisation that processes digital personal data in India, and any organisation outside India that processes such data to offer goods or services to people in India, is a Data Fiduciary under the Act. This covers banks, NBFCs, fintechs, hospitals, e-commerce, EdTech, SaaS and most businesses that hold customer or employee data.

When do DPDP Act obligations come into force?

The DPDP Rules 2025 were notified in November 2025 with a phased rollout. Provisions setting up the Data Protection Board of India took effect immediately, Consent Manager provisions follow after 12 months, and the core Data Fiduciary obligations — notice, consent, security safeguards, breach reporting and data principal rights — apply 18 months after notification, from May 2027.

What are the penalties for non-compliance with the DPDP Act?

The Data Protection Board of India can impose penalties of up to ₹250 crore for a failure to take reasonable security safeguards to prevent a personal data breach, with other penalties scaled by the type of breach under the Schedule to the Act.

How much does a DPDP compliance audit cost?

A one-time, project-based DPDP audit costs ₹1.5 lakh to ₹3.5 lakh per engagement. Ongoing DPO advisory on a monthly retainer costs ₹25,000 to ₹45,000 per month. Prices are indicative; the final fee depends on organisation size, data volume and scope, and GST applies.

Is AI used to reach audit conclusions?

No. AI-assisted Computer Audit Tools (CAATs) gather and organise evidence and report observations only. Every compliance determination, materiality assessment and audit opinion is made personally by Ram Krishan Dudeja, CISA, in line with ISACA and IIA professional standards.

Do you offer DPDP audits across India?

Yes. DPDP Audits works with organisations Pan-India, both remotely and on-site.

Can an IS audit or CERT-IN empanelled firm partner with DPDP Audits?

Yes. Under the Annual Audit Partner model, DPDP Audits works as a sub-contractor adding a DPDP module to your existing client engagements, on a day rate of ₹18,000 to ₹28,000 or a 20–30% revenue share, with the report co-branded with your firm.

DPDP Compliance for E-commerce and D2C Brands

E-commerce marketplaces and D2C brands collect personal data at every step: sign-up, browsing, checkout, delivery, returns and reviews. Much of it then flows to payment gateways, logistics partners, ad platforms and analytics tools. Under the Digital Personal Data Protection Act 2023, the brand remains the Data Fiduciary for all of it.

How DPDP applies to e-commerce

Purpose-specific consent: data needed to fulfil an order is different from data used for marketing, personalisation or retargeting. Each purpose must be itemised in the notice, and consent for marketing cannot be a condition of buying.
Trackers and pixels: sharing customer identifiers or behaviour with ad and analytics platforms is processing that needs a lawful basis and must be covered in the notice.
Inactive accounts: the Rules require large e-commerce entities above a prescribed user threshold to erase personal data after a set period of user inactivity, with advance notice to the user.
Dark patterns: pre-ticked boxes and confusing opt-outs undermine the requirement that consent be free and unambiguous, and also sit uneasily with consumer protection guidance on dark patterns.

Gaps commonly found in e-commerce

One checkbox covering terms, privacy policy and marketing together
Marketing pixels firing before the user has seen any notice
Unsubscribe links that stop emails but not SMS, WhatsApp or retargeting
Customer data exported to spreadsheets for campaigns and never deleted
Logistics and customer-support vendors with full customer data access and no processor terms
No clear retention period for dormant accounts and old orders
Account deletion requests handled manually, inconsistently, or not at all

Priorities before May 2027

Separate order-fulfilment consent from marketing and personalisation consent.
Audit every tag, pixel and SDK on the site and app, and what data each sends.
Make withdrawal work across all channels, not just email.
Define retention periods and automate erasure for inactive accounts.
Add processor clauses to logistics, payments, support and marketing vendor contracts.

See DPDP Rules 2025 explained for the timeline, and the DPDP audit checklist for a full self-assessment.

DPDP Compliance for E-commerce and D2C Brands

How DPDP applies to e-commerce

Gaps commonly found in e-commerce

Priorities before May 2027

Need an independent DPDP audit?

Related guides