What is a DPDP audit?

A DPDP audit is an independent assessment of how your organisation collects, uses, stores and shares digital personal data, measured against the Digital Personal Data Protection Act 2023 and the DPDP Rules. DPDP Audits tests 67 controls mapped across 21 sections of the Act and reports the gaps, with a remediation roadmap signed off by a CISA-certified auditor.

Who needs to comply with the DPDP Act 2023?

Any organisation that processes digital personal data in India, and any organisation outside India that processes such data to offer goods or services to people in India, is a Data Fiduciary under the Act. This covers banks, NBFCs, fintechs, hospitals, e-commerce, EdTech, SaaS and most businesses that hold customer or employee data.

When do DPDP Act obligations come into force?

The DPDP Rules 2025 were notified in November 2025 with a phased rollout. Provisions setting up the Data Protection Board of India took effect immediately, Consent Manager provisions follow after 12 months, and the core Data Fiduciary obligations — notice, consent, security safeguards, breach reporting and data principal rights — apply 18 months after notification, from May 2027.

What are the penalties for non-compliance with the DPDP Act?

The Data Protection Board of India can impose penalties of up to ₹250 crore for a failure to take reasonable security safeguards to prevent a personal data breach, with other penalties scaled by the type of breach under the Schedule to the Act.

How much does a DPDP compliance audit cost?

A one-time, project-based DPDP audit costs ₹1.5 lakh to ₹3.5 lakh per engagement. Ongoing DPO advisory on a monthly retainer costs ₹25,000 to ₹45,000 per month. Prices are indicative; the final fee depends on organisation size, data volume and scope, and GST applies.

Is AI used to reach audit conclusions?

No. AI-assisted Computer Audit Tools (CAATs) gather and organise evidence and report observations only. Every compliance determination, materiality assessment and audit opinion is made personally by Ram Krishan Dudeja, CISA, in line with ISACA and IIA professional standards.

Do you offer DPDP audits across India?

Yes. DPDP Audits works with organisations Pan-India, both remotely and on-site.

Can an IS audit or CERT-IN empanelled firm partner with DPDP Audits?

Yes. Under the Annual Audit Partner model, DPDP Audits works as a sub-contractor adding a DPDP module to your existing client engagements, on a day rate of ₹18,000 to ₹28,000 or a 20–30% revenue share, with the report co-branded with your firm.

DPDP Compliance for Hospitals and Healthcare Providers

Hospitals, clinics, diagnostic labs, pharmacies and health-tech apps hold some of the most personal data there is: diagnoses, prescriptions, test reports, insurance details and identity documents. Every one of these organisations that processes digital personal data is a Data Fiduciary under the Digital Personal Data Protection Act 2023.

How DPDP applies to healthcare

No separate "sensitive" category: the Act protects all personal data in the same framework, but a health data breach is exactly the kind of failure that attracts the highest penalties for inadequate security safeguards.
Medical emergencies: the Act allows processing without consent to respond to a medical emergency involving a threat to life or health. Routine treatment, billing, follow-ups and marketing still need a clear lawful basis.
Children: paediatric records involve children's data, which normally needs verifiable parental consent. The Rules provide limited exemptions for healthcare professionals and clinical establishments, but only for the purposes those exemptions cover.
Existing frameworks: clinical-records retention requirements and digital-health programmes continue to apply alongside DPDP.

Gaps commonly found in healthcare

Registration forms that collect far more than treatment needs, with no itemised notice
Test reports and prescriptions shared over personal WhatsApp or email accounts
Shared logins on hospital information systems, making access impossible to attribute
Patient data sent to labs, TPAs, insurers and software vendors without processor contracts
Health-tech apps collecting location, contacts or device data unrelated to care
Patient data used for marketing of health packages without separate consent
No process for patients to access, correct or ask for erasure of their records

Priorities before May 2027

Map patient data flows across OPD, IPD, labs, pharmacy, billing and third parties.
Rewrite registration and consent forms into itemised, plain-language notices.
Enforce individual logins, role-based access and one-year log retention on clinical systems.
Put processor clauses into lab, TPA, cloud and software vendor contracts.
Rehearse a breach of patient records against the 72-hour reporting requirement.

For the full timeline, see DPDP Rules 2025 explained, and use the DPDP audit checklist to self-assess.

DPDP Compliance for Hospitals and Healthcare Providers

How DPDP applies to healthcare

Gaps commonly found in healthcare

Priorities before May 2027

Need an independent DPDP audit?

Related guides