Explains what actually triggers a DPDP Board inquiry, what evidence the Board can demand under Sections 28 and 36, and where the gap between policy and proof most often catches businesses out.
Most businesses picture a regulatory audit as a scheduled visit — an inspector arrives with a checklist, walks through some paperwork, and leaves. Under the DPDP Act, that's not quite how it works, and the difference matters. The Data Protection Board of India doesn't need to show up in person to start scrutinizing an organization's compliance. It can act on a single complaint from one customer, open an inquiry entirely on its own initiative, and demand documents, explanations, and access records without ever setting foot on the premises.
Understanding what actually triggers that scrutiny — and what the Board looks at once it does — is more useful than picturing a generic "audit" and hoping for the best.
Two Very Different Kinds of "Audit"
The word "audit" covers two distinct things under the DPDP framework, and conflating them leads to a false sense of security.
- Mandatory self-audits apply specifically to organizations designated as Significant Data Fiduciaries. Under Section 10 and Rule 13, an SDF must appoint an independent data auditor and undertake a Data Protection Impact Assessment and audit once every twelve months, then furnish the resulting report to the Board. This is a proactive, scheduled obligation — the organization commissions its own scrutiny.
- Board-initiated inquiries apply to everyone, regardless of SDF status. Section 28 gives the Board the power to inquire into a complaint from any Data Principal, or to open an investigation on its own motion — without waiting for anyone to complain. This is the scrutiny most businesses actually need to worry about, because it can happen to an organization that never expected to be examined at all.
What Triggers a Board Inquiry
A Board inquiry doesn't require a major breach to get started. In practice, the triggers tend to be more mundane than businesses expect:
| Trigger | What It Looks Like |
|---|---|
| A Data Principal complaint | A customer's grievance about an unresolved access or erasure request escalates to the Board |
| A reported personal data breach | The Section 8(6) notification itself can prompt a closer look at the surrounding circumstances |
| A Consent Manager breach notification | The Board can act on intimation of a condition breach involving a registered Consent Manager |
| Media or public reporting | A publicized incident or complaint pattern can draw scrutiny even without a formal complaint |
| Sector-specific regulatory referral | Other regulators flagging a data-handling concern within their own oversight |
What the Board Can Actually Demand
Once an inquiry is underway, the Board's powers are substantial. Under Section 28, it can summon and examine any person under oath, demand the production of any data, books, registers, or records, and inspect premises where data processing occurs, with safeguards to avoid unnecessarily disrupting operations. Separately, Section 36 empowers the Board to call for any information it needs from a Data Fiduciary, Data Processor, or other relevant party — including technical documentation, security protocols, policies, and audit reports.
In practice, an organization facing this kind of inquiry needs to be able to produce, credibly and quickly:
| What Gets Examined | What "Good" Looks Like |
|---|---|
| Data inventory | A current, accurate record of what personal data is held, where, and why |
| Notices and consent records | Evidence of what was shown to a Data Principal, when, and their specific consent status per purpose |
| Legal basis documentation | A clear account of which provision — consent or a specific legitimate use — applies to each processing activity |
| Vendor/processor contracts | Section 8(2)-compliant agreements covering every third party that touches the data in question |
| Security safeguards | Documented technical and organizational measures, not just a policy statement asserting them |
| Breach history and response | Records of any incidents, how they were assessed, and whether notification obligations were met |
| Rights-request handling | Evidence that access, correction, and erasure requests were processed within a reasonable timeframe |
| Retention and erasure practices | Proof that data no longer needed for its stated purpose has actually been deleted, not just scheduled for deletion |
The consistent theme across all of these: the Board isn't primarily interested in policy documents that describe good intentions. It's looking for evidence that the described practice actually happened — a consent log, not just a consent policy; a deletion record, not just a retention schedule.
Where Organizations Get Caught Out
A recurring pattern in how these inquiries unfold is the gap between what an organization believes it can demonstrate and what it can actually produce on request. A privacy policy that describes a 30-day data retention period means little if nobody can show that deletion actually executes on schedule. A vendor contract that references "appropriate security measures" in vague terms doesn't hold up as well as one specifying exactly what those measures are and how compliance is verified.
The other common gap is fragmentation: consent records living in one system, the data inventory in a spreadsheet nobody's updated recently, and vendor contracts scattered across procurement's files with no single person able to assemble a coherent answer quickly. When the Board asks a specific question — which patients were affected by a given incident, or what consent basis applies to a particular marketing campaign — the ability to answer within hours, rather than days of internal searching, matters.
What the Penalty Structure Reflects
The Act's penalty schedule is instructive about where the Board's scrutiny is likely to concentrate: failure of reasonable security safeguards carries the steepest penalty, up to ₹250 crore; failure to notify a breach carries up to ₹200 crore, as do violations involving children's data; failure to meet additional Significant Data Fiduciary obligations carries up to ₹150 crore; and other violations of the Act or Rules carry penalties up to ₹50 crore. These aren't arbitrary figures — they signal that security safeguards, breach handling, and children's data protection are the areas most likely to draw serious enforcement attention.
Preparing for Scrutiny You Can't Schedule
Because a Board inquiry can start from a single complaint rather than a planned visit, "we'll get ready before the audit" isn't a workable strategy — there's no reliable advance notice. The more realistic goal is building a compliance posture that would hold up if examined on any given day: a current data inventory, documented consent and legal-basis records, vendor contracts that actually specify obligations rather than gesturing at them, and a breach-response process that's been tested rather than just written down.