The Digital Personal Data Protection Rules were notified on 14 November 2025 and phase in over eighteen months. Most duties of a company that handles personal data start in mid-May 2027. A DPDP audit checks whether the company can show, with evidence, that it knows what personal data it holds, why, who sees it, and what it does when something goes wrong.
Facts checked: 16 October 2026. The notification date, the eighteen-month phasing and the penalty amounts come from the Government's own PIB note on the Rules. The month-level dates in the table and the Significant Data Fiduciary duties come from secondary sources (compliance firms and legal commentary), and we did not read the Gazette text. Confirm the exact dates against the Rules before relying on them.
The dates, and the one that is not settled
| What | Date |
|---|---|
| Rules notified (PIB); Data Protection Board provisions apply | 14 November 2025 |
| Consent Manager registration begins | about November 2026 (secondary sources) |
| Most obligations on companies, including the duties of Significant Data Fiduciaries | about 13 to 14 May 2027, at the end of the eighteen months (secondary sources say 13 May) |
The open point: MeitY reportedly proposed, after a stakeholder consultation on 23 January 2026, to cut the 18-month window to 12 months, which would pull the main date to about November 2026. We found no notified amendment. Planning to the earlier date costs little if you are already working to May 2027, and it covers you if the proposal goes through.
What the law actually asks of a company
The Act calls a company that decides why and how personal data is processed a data fiduciary. In plain terms, it must:
- Tell people what data it collects and why, and get consent where consent is the basis.
- Use the data only for that purpose, and keep it only as long as needed.
- Keep reasonable security safeguards.
- Report a personal data breach to the Data Protection Board and to the people affected.
- Let people see, correct and erase their data, and respond to complaints.
A Significant Data Fiduciary, designated by the Government on factors such as volume and sensitivity of data, has more: according to the sources we read, an annual data protection impact assessment, an independent data audit, and a data protection officer based in India. No designations were reported as made when we checked.
The Act's penalties are large. According to the Government's note on the Rules, the highest, up to ₹250 crore, applies to failing to keep reasonable security safeguards. Not telling the Board or affected people about a breach, and breaches of the duties on children's data, can each draw up to ₹200 crore. Any other violation can draw up to ₹50 crore.
A DPDP audit, step by step
- Find the personal data. List every system and spreadsheet that holds customer, employee, vendor or candidate data. Include shared drives, e-mail attachments, HR and payroll tools, CRM and support tools, and anything a vendor hosts for you.
- Map purpose to data. For each item, write the reason it is collected. Data with no stated reason is the first finding.
- Test notice and consent. Read the forms and screens people actually see. Check the notice says what the Rules require and that consent can be withdrawn as easily as it was given.
- Test retention and erasure. Pick records past their purpose and check whether they are still there. Ask who deletes, and whether deletion reaches backups and vendors.
- Test access. Who can see personal data, and does it match their job? Check leavers and shared logins.
- Test vendors. For each processor, check the contract covers security, breach notice and deletion, and see what they sent you last year.
- Test the breach process. Run a tabletop: a spreadsheet of customer data is e-mailed to the wrong person. Who is told, by whom, and how fast? An untested plan is a finding.
- Test requests from people. Send a test access or erasure request and time the response.
- Check governance. Who owns this, and does the board or audit committee see a report?
Each step ends with evidence: a screenshot, a log, a signed contract, a dated record. An audit finding with no evidence is only an opinion.
Where internal audit fits
DPDP is not only a legal exercise. It is a controls exercise: access, retention, vendors and incident handling are the same areas internal audit already tests. Add data protection to the annual plan, map each step above into the risk and control matrix, and test the controls the way you test any other. Our guide on cyber and AI risk in the internal audit plan shows how the risk areas connect.
Working with client data in AI tools raises the same questions for CA firms; see our DPDP-safe prompt library.
Frequently Asked Questions
When does the DPDP Act apply to my company?
Most duties start around mid-May 2027 under the notified Rules, at the end of the eighteen-month phase-in. A proposal to bring this forward to about November 2026 had not been notified when we checked.
Who needs a DPDP audit?
The Act requires an independent audit of Significant Data Fiduciaries. Other companies are not required to commission one, but an internal readiness review is the practical way to show compliance.
What is a Significant Data Fiduciary?
An entity the Government designates based on factors such as the volume and sensitivity of the personal data it handles. Duties such as an annual impact assessment and audit apply to it.
What are the penalties?
Up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not reporting a breach or for breaches of the duties on children's data, and up to ₹50 crore for other violations.
Does the DPDP Act cover employee data?
It covers personal data of individuals, which includes employees. The Act has specific legitimate-use provisions for employment purposes; read them for your case.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error