How do you prepare for a DPDP Act compliance audit in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What does a DPDP compliance audit actually examine?

Six areas, and they are the same six tracks you close before an audit. Data inventory and records of processing: what personal data you hold, where it is stored, which processor holds it, and the retention period for each category. Consent and notice: whether consent was specific, informed, recorded and retrievable, and whether the notice matches what you actually do. Security safeguards: MFA, encryption at rest and in transit, access control, logging, backup, and the ability to show it for every system holding personal data. Data principal rights: whether access, correction, erasure and nomination requests work end to end, with a timeline and an audit trail. Vendor and processor management: contracts, sub-processors, and whether a processor outside India is covered by the Act. And breach readiness: the Rule 7 runbook, the Board intimation template, the 72-hour tracker and the data principal notice.

What are the three findings that fail most audits?

Three, and all three are documentation failures rather than technical ones. First, consent that cannot be produced: the checkbox exists in the product, but there is no retrievable record of what the person agreed to, when, and which version of the notice they saw, and without that record the consent is not defensible. Second, erasure that does not work: a request comes in, the CRM and the marketing platform are cleared, and the back-up set, the warehouse and the payment processor are missed, so the person can be re-identified later, which is the finding that turns a minor issue into a serious one. Third, unknown vendors: a spreadsheet of processors that has not been updated in a year, with a CRM that quietly routes customer data to a new analytics tool nobody has contractually bound. Fixing all three takes less time than the audit itself would cost.

How do you evidence 180-day log retention and the 6-hour CERT-In clock?

Two artefacts, and they are the same artefacts a CERT-In aligned assessment asks for. First, a log retention and availability statement: which systems log, what is logged, the retention period, where the logs live, and evidence that at least 180 days of logs are retained within Indian jurisdiction as the directions require. Second, a breach runbook with a clock: a named person, a 6-hour trigger for CERT-In reporting under Directions 20(3)/2022-CERT-In, a separate 72-hour tracker for the Rule 7 intimation to the Data Protection Board, a draft intimation, a draft data principal notice, and a rehearsal record from a tabletop exercise. Assessors will ask who was on call, and a runbook with a name and a date answers that in one line.

What should you do in the six weeks before the audit?

A week-by-week plan that most Indian businesses can run without slowing down. Week 1: build the data inventory, and do it by asking three people, because the spreadsheet in the drive is not the inventory. Week 2: test the consent record and the notice, and fix the version history. Week 3: run the security check across every system in the inventory, MFA first, then encryption, then access control, and log the exceptions. Week 4: dry-run the rights process, send three test erasure requests, and time them. Week 5: close the vendor and processor gaps, and update the contracts. Week 6: run the breach tabletop, gather the evidence into a single index, and rehearse the two-hour walkthrough with whoever will answer the assessor's questions. A readiness and gap assessment in India runs Rs 40,000 to Rs 1,50,000 excluding 18% GST, and the closure work that follows typically runs Rs 1,00,000 to Rs 4,00,000 depending on how many systems are in scope.

What are the frequently asked questions?