Data Audit
A review of how personal data is collected, used, stored and protected, compared with the law and your own policies.
A data audit is a structured check of how your organisation collects, uses, stores, shares and deletes personal data, compared against the law and your own policies. Its purpose is to find gaps before a regulator or a breach does.
Meaning of Data Audit
Significant Data Fiduciaries must carry out an audit at least every twelve months under Rule 13. Others can audit voluntarily to find gaps early.
The Act ties audits to Significant Data Fiduciaries. Section 10(2) requires a notified Significant Data Fiduciary to appoint an independent data auditor to evaluate its compliance, and to undertake periodic Data Protection Impact Assessments and periodic audits. Rule 13 makes this concrete: an annual Data Protection Impact Assessment and audit, with a report of significant observations furnished to the Board, together with due diligence that its algorithmic software does not pose risk to Data Principals' rights.
For everyone else, there is no statutory audit requirement, but audits are the main way to show accountability. A voluntary audit tests whether the notice matches practice, consent records are complete, retention schedules are applied, security safeguards under Section 8(5) and Rule 6 exist and work, vendors have contracts, rights requests are handled on time and breach plans match Rule 7. Many organisations also run audits to prepare for the main obligations taking effect on 13 May 2027.
Audits come in several shapes. An internal audit is done by the company's own team and is quick and frequent. An external audit is done by a consultant or firm and carries more weight with customers. For a Significant Data Fiduciary, the auditor must be independent. Scope can be the whole organisation, one department, one product or one vendor. A technical audit looks at systems, configurations and logs, while a compliance audit examines documents, processes and interviews.
A data audit differs from a Data Protection Impact Assessment, which looks ahead at the risk of a specific processing activity, usually before launch. It also differs from a security audit or penetration test, which examines technical defences but may not look at purposes, consent or retention. And it differs from data mapping, which records what you hold; the audit checks whether what you do with it is lawful and consistent. Audit findings should feed back into the map, policies and training.
Examples of Data Audit
An annual audit finds that an old marketing database still holds data of people who unsubscribed.
An annual audit of a retail brand finds an old campaign database that still holds contacts who unsubscribed two years ago. The team deletes them, fixes the unsubscribe sync with the email vendor and adds a monthly check.
A social platform notified as a Significant Data Fiduciary hires an independent auditor. The auditor reviews consent flows, tests [data localisation](term/data-localisation) controls for specified data and examines algorithmic checks, and the platform sends a summary of significant findings to the Board.
A small clinic group asks a consultant to audit front-desk practices. The review finds patient files left on a shared PC and an unsigned vendor contract for the appointment software, and both are fixed within a month.
Why Data Audit matters
An audit is cheaper than the problems it finds. A forgotten database with expired consent, a vendor with no contract or an unpatched server are far less costly to correct on your own schedule than after a breach, where penalties can reach ₹250 crore for security failures and ₹200 crore for failing to notify. For Significant Data Fiduciaries, failing to perform the required audit falls under the additional-obligations head of up to ₹150 crore.
Audits also build evidence. A dated report, with findings and fixes, shows leadership, customers and the Board that you check yourself. Enterprise buyers increasingly ask for the latest audit summary during procurement.
How it works in practice
- 1Define scope and criteria. Decide what is being audited, which part of the Act, Rules and sector rules apply, and which internal policies serve as the standard.
- 2Gather the evidence in advance: data map, notices, consent logs, retention schedule, vendor contracts, security reports, rights-request logs and incident records.
- 3Test, do not only read. Sample consent records, try an erasure request end to end, check access rights on a system, review logs and confirm that a processor deleted what it was told to.
- 4Rate each finding by risk, assign an owner and a due date, and record the evidence of closure.
- 5Report to senior management in plain language, with a short summary and a list of overdue items. Significant Data Fiduciaries must furnish the prescribed report to the Board.
- 6Repeat on a cycle, at least annually for high-risk areas, and follow up on previous findings first.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the audit as a checklist of documents. Test actual practice, such as whether a deletion request really removes data.
Auditing once, filing the report and never closing findings. The value is in the follow-up.
Confusing a security penetration test with a privacy audit. Each needs its own scope.
Picking an auditor who is not independent when the law requires independence, as for Significant Data Fiduciaries.
Compliance tips
Start small if resources are limited: audit the highest-risk area, such as customer onboarding or payments, and widen next year.
Agree a standard scoring method and use it every year, so you can show improvement over time.
Brief the audited teams so that the audit is seen as help, not blame, and findings are reported openly.
Keep audit reports and closure evidence in your accountability folder for the period you may need to produce them.
Common questions about Data Audit
Is a data audit mandatory under the DPDP Act?
It is mandatory for Significant Data Fiduciaries, who must appoint an independent data auditor under Section 10(2) and conduct audits and impact assessments annually under Rule 13. For other organisations it is not required, but it is a recommended way to prove compliance.
What is the difference between a data audit and a DPIA?
A DPIA assesses the risk of a particular processing activity, usually before it starts. A data audit reviews how your organisation actually handles data against the law and your policies. A Significant Data Fiduciary must do both, at least annually.
Who can conduct a data audit?
Internal teams can run general audits. A Significant Data Fiduciary must use an independent data auditor. External consultants and audit firms with privacy and security skills are common choices for others who want an independent view.
How often should I audit my data practices?
Significant Data Fiduciaries need an annual audit. Others should audit at least yearly for high-risk areas, and also after major changes such as a new system, a merger or a breach. Regular, smaller reviews often work better than rare large ones.