Data protection audit under the DPDP Act: who must be audited and what the text requires

Search for DPDPA audit requirements and much of what ranks is vendor content: accreditation regimes, audit frameworks, certification checklists, report templates, all presented as if the law prescribed them. The Gazette text is far sparser than that. This article states exactly what the DPDP Act 2023 and the DPDP Rules 2025 require of a data protection audit, quotes the operative words, and is explicit about what has not been prescribed, so you can tell a statutory duty from a seller's construction.

Who must be audited: only notified Significant Data Fiduciaries

The audit duty lives inside section 10, and section 10 applies only to a Significant Data Fiduciary: "any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10", per the definition in section 2(z). There is no self assessment, no registration and no threshold you can compute for yourself. Either a notification covers you, or the statutory audit duty does not exist for you, whatever your scale.

As of 23 August 2026, no Data Fiduciary or class has been notified as significant, so no organisation in India currently carries the statutory data audit obligation. How notification works, and the two duties that arrive with the auditor, a board answerable Data Protection Officer and the DPIA, are covered in the Significant Data Fiduciary obligations guide.

One scoping fact worth stating precisely: for Data Fiduciaries, audit obligations appear in exactly two places in the framework, section 10 of the Act and Rule 13 of the Rules. The only other audit reference in either Gazette text is item 12 of Part B of the First Schedule, which requires a registered Consent Manager to maintain audit mechanisms and report outcomes to the Board. That is a separate registration regime and does not attach to Data Fiduciaries.

The independent data auditor in section 10(2)(b)

The appointment duty is one sentence:

"appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act"

Section 10(2)(b) of the DPDP Act 2023.

The sentence asks for two things at once. Independence: the auditor cannot be the function marking its own homework. And a yardstick: the evaluation is measured against the provisions of the Act itself, not against an internal policy, a certification scheme or an industry framework. Everything else about the auditor, who qualifies, how independence is tested, whether a firm or an individual, is left unsaid.

The periodic audit in section 10(2)(c)

Section 10(2)(c) then requires the Significant Data Fiduciary to undertake a "periodic Data Protection Impact Assessment", a "periodic audit", and such other measures as may be prescribed. For the audit, that is the entire statutory content: two words, with the cadence left to the Rules. The DPIA in the same clause gets a fuller statutory definition, which is unpacked in DPIA under the DPDP Act.

What Rule 13 adds: a 12 month clock and a report to the Board

Rule 13 of the DPDP Rules 2025 turns "periodic" into a schedule and gives the audit its one mandated output.

The cycle. Rule 13(1) requires the Significant Data Fiduciary, "once in every period of 12 months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such", to undertake a Data Protection Impact Assessment and an audit "to ensure effective observance of the provisions of this Act and the rules made thereunder". The clock starts at notification, not at a financial year end, and the audit travels together with the DPIA as one annual exercise aimed at the whole framework.

The report. Rule 13(2) requires the Significant Data Fiduciary to cause "the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations". The findings do not stay internal: the Data Protection Board of India receives the significant observations every cycle, as a matter of course, with no residual risk filter.

Rule 13 also carries two neighbouring duties on the same tier, algorithmic due diligence under Rule 13(3) and a conditional localisation restriction under Rule 13(4), covered in the Significant Data Fiduciary obligations guide.

How the audit differs from the DPIA

The two duties share a clock and a report but are not the same exercise. The audit evaluates compliance: did the organisation observe the Act and the Rules. The DPIA is a defined process aimed at people: a description of the rights of Data Principals, the purpose of processing, and assessment and management of the risk to those rights. The express independence requirement in section 10(2)(b) attaches to the auditor; the Act does not say who conducts the DPIA. One textual detail: Rule 13(2) speaks of "the person carrying out the Data Protection Impact Assessment and audit" in the singular, which reads naturally as one appointee running both, but the Rules never state expressly that this person must be the section 10(2)(b) auditor. That reading is interpretation, not text.

What the text fixes, and what it leaves open

Requirement	Source	What the text says	What is not prescribed
Independent data auditor	Section 10(2)(b)	Appoint an independent data auditor to carry out data audit, who shall evaluate compliance in accordance with the provisions of the Act	Who may act as auditor, any qualification or accreditation, how independence is tested
Periodic audit	Section 10(2)(c)(ii)	The words "periodic audit", with cadence left to the Rules	Scope, method, any named audit standard
12 month cycle	Rule 13(1)	A DPIA and an audit once in every period of 12 months from notification, to ensure effective observance of the Act and the rules	Audit standard, methodology, checklist or evidence requirements
Report to the Board	Rule 13(2)	The person carrying out the DPIA and audit furnishes to the Board a report containing significant observations	Report format or template, filing timeline, definition of significant observations

The honest gap statement, then: as of 23 August 2026 there is no auditor accreditation regime, no empanelment list, no named audit standard, no prescribed methodology and no report template anywhere in the Act or the Rules. Section 10(2)(c)(iii) leaves a hook for "such other measures, consistent with the provisions of this Act, as may be prescribed", but the only prescription so far is Rule 13, and Rule 13 fixes cadence and reporting, not method. Any product that presents a specific framework, certification or report format as a DPDPA legal requirement is selling its own construction.

When the duty starts, and what a breach costs

Notification G.S.R. 843(E) places section 10 in the group that comes into force 18 months from publication of the commencement gazette, and Rule 1(4) places Rule 13 in the matching 18 month group of the Rules. Both compute to 13 May 2027, which is interpretation until officially confirmed. Even after that date, the duty reaches only organisations the Central Government has notified. The stakes once it does: the Act's Schedule pairs breach of the section 10 obligations with a penalty that may extend to 150 crore rupees.

How to prepare, offered as recommendation

Nothing below is a statutory audit requirement; the Act and Rules prescribe no preparation file. It is this site's recommendation, built from the yardstick the auditor must use: compliance "in accordance with the provisions of this Act". An evaluation against the Act will ask for evidence of the duties you already carry, so the cheapest preparation is keeping that evidence as you go:

• a record of processing: what personal data you hold, each purpose, and the ground behind it
• the notice and consent artefacts behind your consent based processing
• contracts with every Data Processor, since section 8(2) permits engaging one for any activity related to offering of goods or services to Data Principals only under a valid contract
• a breach register holding each incident and the intimations sent under Rule 7
• a retention and erasure schedule implementing section 8(7)

The company compliance plan generates this as a tracked action list with the official source behind every action, the starter templates cover the processor contract clauses, and the small business checklist sequences the underlying duties. The official texts live at section 10 and Rule 13, each with its Gazette citation.