What is a DPDP audit?

A DPDP audit is an independent assessment of how your organisation collects, uses, stores and shares digital personal data, measured against the Digital Personal Data Protection Act 2023 and the DPDP Rules. DPDP Audits tests 67 controls mapped across 21 sections of the Act and reports the gaps, with a remediation roadmap signed off by a CISA-certified auditor.

Who needs to comply with the DPDP Act 2023?

Any organisation that processes digital personal data in India, and any organisation outside India that processes such data to offer goods or services to people in India, is a Data Fiduciary under the Act. This covers banks, NBFCs, fintechs, hospitals, e-commerce, EdTech, SaaS and most businesses that hold customer or employee data.

When do DPDP Act obligations come into force?

The DPDP Rules 2025 were notified in November 2025 with a phased rollout. Provisions setting up the Data Protection Board of India took effect immediately, Consent Manager provisions follow after 12 months, and the core Data Fiduciary obligations — notice, consent, security safeguards, breach reporting and data principal rights — apply 18 months after notification, from May 2027.

What are the penalties for non-compliance with the DPDP Act?

The Data Protection Board of India can impose penalties of up to ₹250 crore for a failure to take reasonable security safeguards to prevent a personal data breach, with other penalties scaled by the type of breach under the Schedule to the Act.

How much does a DPDP compliance audit cost?

A one-time, project-based DPDP audit costs ₹1.5 lakh to ₹3.5 lakh per engagement. Ongoing DPO advisory on a monthly retainer costs ₹25,000 to ₹45,000 per month. Prices are indicative; the final fee depends on organisation size, data volume and scope, and GST applies.

Is AI used to reach audit conclusions?

No. AI-assisted Computer Audit Tools (CAATs) gather and organise evidence and report observations only. Every compliance determination, materiality assessment and audit opinion is made personally by Ram Krishan Dudeja, CISA, in line with ISACA and IIA professional standards.

Do you offer DPDP audits across India?

Yes. DPDP Audits works with organisations Pan-India, both remotely and on-site.

Can an IS audit or CERT-IN empanelled firm partner with DPDP Audits?

Yes. Under the Annual Audit Partner model, DPDP Audits works as a sub-contractor adding a DPDP module to your existing client engagements, on a day rate of ₹18,000 to ₹28,000 or a 20–30% revenue share, with the report co-branded with your firm.

DPDP Compliance for EdTech Platforms and Schools

Under the Digital Personal Data Protection Act 2023, anyone under 18 is a child. That puts EdTech platforms, schools, coaching institutes and test-prep apps squarely under the Act's strictest provisions, because most of their users are children.

What the Act requires for children's data

Verifiable parental consent: before processing a child's personal data, the Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. The Rules set out how that verification can be done.
No tracking or targeted advertising: tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
No detrimental processing: processing likely to harm a child's well-being is not permitted.
Limited exemptions: the Rules exempt educational institutions and certain other entities for specific purposes, such as educational activities and the safety of children. They do not cover every use, such as marketing.

Failing to meet the obligations for children's data can attract penalties of up to ₹200 crore.

Gaps commonly found in EdTech and schools

Sign-up flows that accept a child's own consent or a simple "I am over 18" checkbox
Learning analytics used to target upsell offers to students
Third-party SDKs for analytics or ads embedded in apps used by children
Proctoring tools capturing video, screen and device data with no clear retention limit
Student records shared with coaching partners, transport vendors or app providers without contracts
Teachers using personal messaging groups to share student data and results
No process for parents to access, correct or erase their child's data

Priorities before May 2027

Identify every place a child's data enters the system, including apps, forms and admissions.
Implement a verifiable parental consent flow suited to your users.
Remove ad and behavioural-tracking SDKs from child-facing products.
Document which exemptions you rely on and for exactly which purposes.
Set retention limits for proctoring recordings, assessments and admission documents.

See DPDP Rules 2025 explained for the timeline, and the DPDP audit checklist for a full self-assessment.

DPDP Compliance for EdTech Platforms and Schools

What the Act requires for children's data

Gaps commonly found in EdTech and schools

Priorities before May 2027

Need an independent DPDP audit?

Related guides