What Is the DPDP Cyber Security Audit?
Key takeaways
- The cyber security audit is a DPDP obligation for significant data fiduciaries, and it sits alongside the DPO and Board reporting duties in the same Rules.
- The audit's scope is the security of personal data processing, not the whole ISMS, so the CERT-In empanelment audit and the DPDP audit cover overlapping ground with different evidence and different outcomes.
- Independence is the point, so the auditor must not have run the controls being audited, which is why a firm cannot audit its own implementation.
- A good DPDP audit produces a remediation list with owners and dates, because the evidence of compliance is the closed action, not the report itself.
- Plan the two audits on one calendar, since a single forensic evidence set can support the CERT-In audit, the DPDP audit and a client's security questionnaire.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the DPDP cyber security audit actually examine?
It examines the security of the personal data processing, in practice the controls the Act and the Rules require: the notice and consent design, the accuracy and purpose limitation of processing, the security safeguards around the data in rest and in transit, the rights-request workflow, the breach detection and notification procedure, the vendor and sub-processor controls, the retention and erasure of data, and the evidence that all of these operated as documented. A good auditor also tests a sample: pull a rights request and time it, check a consent record against the version of the notice shown, trace an erasure request through to the backups, and sample vendor contracts for the required clauses.
Who can conduct the audit, and what does independence mean?
The Rules require the audit to be conducted by an independent auditor, and independence is the substance of the requirement rather than a formality. The auditor must not have designed, implemented or operated the controls under review, and must not have a financial interest in the outcome. That excludes the internal IT team and the vendor that built the compliance programme, both of which are common failures in Indian implementations. A firm that wants the audit done well is best served by an external auditor with cyber and data protection depth, and a firm that also needs the CERT-In empanelment audit can ask the same firm to do both, provided the two scopes are separated in the report.
How often must the audit happen, and what does it produce?
The Rules require periodic audits and periodic reporting to the Board, and the frequency and the first due date depend on the notification that specifies the significant data fiduciary obligations, so check the current notification rather than assuming an annual cycle. What the audit produces matters as much as when: a findings list, each finding rated by severity, each mapped to a control and a Rule obligation, each with a named owner and a due date. The Board report is then short, because the underlying work is in the tracker. A report with no tracker is an artefact nobody acts on, and it will be the first thing a client audit or a regulator asks about a year later.
How is this different from the CERT-In empanelment audit?
Different scope, different auditor pool, different cadence, different output. The CERT-In empanelment audit checks the Information Security Management System against the 28 April 2022 directions, performed by a CERT-In empanelled auditor, at least once every three years and after any significant change. The DPDP audit checks personal data processing against the Act and the Rules, and it applies to significant data fiduciaries. The overlap is real: identity and access, logging, incident response, supplier security and change management appear in both, so one evidence set can serve both. But do not let one report masquerade as the other, because the DPDP side needs personal data coverage and the CERT-In side needs ISMS coverage.
| Aspect | DPDP cyber security audit | CERT-In empanelment audit |
|---|---|---|
| Applies to | Notified significant data fiduciaries | Organisations in scope of the 2022 directions |
| Legal basis | Digital Personal Data Protection Act 2023 and Rules 2025 | CERT-In directions of 28 April 2022 and the IT Act 2000 |
| Auditor | Independent external auditor, not the implementer | Auditor empanelled by CERT-In |
| Cadence | Periodic, as specified in the notification | At least once every three years and after significant change |
| Core scope | Personal data processing, consent, rights, breach and vendor controls | Information Security Management System, logs, ISMS and incident management |
| Output | Findings, severity ratings, owners and due dates, plus Board reporting | ISMS audit report with non-conformities and closure evidence |
What are the frequently asked questions?
Get a straight answer on this
Send us your ISMS scope and your data processing inventory, and we will return a combined audit plan with one evidence set covering both obligations.
Send us the details See pricing