DPDP for the Internal audit (IAW) in Central government

Process lawfully and only for the scheme's purpose, collect only the data needed, keep it accurate, keep it only as long as needed or required by law, protect it with reasonable safeguards, give people a contact for questions and rights, and be accountable for meeting these standards.

Rule 5 and the Second Schedule apply to State processing under Section 7(b). Section 7 · Section 8(5) · Rule 6 · Section 8(3)

1. Field review: needed or not.
2. Accuracy: how errors are corrected.
3. Retention: which schedule applies.
4. Security: who can access.
5. Contact: published on the portal.
6. Accountability: a named officer.

• Standards checklist per scheme
• Correction process
• Retention schedule

• Treating standards as a formality
• No correction route
• No named officer

Use Aadhaar only where a law or notification allows it, store the number only in an Aadhaar Data Vault, show it masked on screens and in reports, and never publish it. Core biometric information must never be shared. Authentication devices at the field level need vendor and operator controls.

Aadhaar Act Sections 7 and 29 and UIDAI rules, with DPDP Section 8(5). Section 8(5) · Rule 6 · Section 7

1. Find every place Aadhaar numbers are stored.
2. Move them to a vault with reference keys.
3. Mask on screens, reports and files.
4. Check PoS and field device vendors.
5. Log access to the vault.

• Vault design
• Masking evidence
• Access logs

• Aadhaar in spreadsheets
• Full numbers on dashboards
• Field operators keeping copies

No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.

Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty. Section 8(5) · Rule 6 · Section 8(1)–(2)

1. For each policy, write the record that would show it working.
2. Check whether that record exists for the last quarter.
3. Where it does not, start producing it.
4. Sample a few records every quarter.
5. Keep the samples with the policy.

• Policy-to-record map
• Quarterly samples
• Gaps and actions

• Approving policies with no record behind them
• Showing a policy when asked for evidence
• Records that exist only before an audit

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

1. List the duties that apply.
2. For each, name the piece of evidence that would satisfy an auditor.
3. Ask owners to attach it.
4. Mark duties without evidence as open, not ready.
5. Review the list before each management sign-off.

• Duty-to-evidence list
• Attached evidence
• Sign-off record

• Accepting 'done' without seeing anything
• Counting policies as evidence
• One sign-off and no review after

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

1. Ask for the position split into tested, stated and not looked at.
2. Ask for two or three samples you can see.
3. Ask who reviewed the evidence.
4. Ask what changed since the last review.
5. Record the answers in minutes.

• Position with tested and stated parts
• Samples seen
• Minutes

• Trusting a single summary slide
• No difference between stated and tested
• No record of what management saw

Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.

Add data protection to internal audit and risk reviews.

The Act sets duties in Sections 5 to 12. A risk register shows management where each duty stands. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 10 · Rule 13

1. List the duties that apply to you.
2. For each, write the risk in plain words, the control and the owner.
3. Link existing controls and audits as evidence.
4. Rate likelihood and impact in your usual way.
5. Review every quarter with management.

• Risk register extract
• Linked evidence
• Quarterly review minutes

• One line saying 'DPDP compliance'
• No owners
• Evidence that is only a policy document

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

Integrator-run systems must give the department access to logs.

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List systems holding personal data and what each logs today.
2. Turn on access logging where it is missing.
3. Send logs to one protected store, with at least one year of retention.
4. Keep a copy of ICT logs in India for at least 180 days.
5. Sync clocks and review alerts every day.

• Log source list
• Retention settings
• Alert review records

• Logging only failures, not who viewed a record
• Logs stored on the same server they describe
• Clocks out of sync, so timelines cannot be built

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

System integrators, NIC, state agencies and field operators process data for the department.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

Vendor admin accounts and district-level logins are the usual weak points.

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

1. Write a role matrix for each key system.
2. Replace shared logins with named accounts.
3. Use multi-factor sign-in for admin and remote access.
4. Review access every quarter with each manager.
5. Remove access on the last working day.

• Role matrix
• Quarterly review sign-offs
• Leaver removal report

• Generic logins on shared machines
• Access that only grows
• No review of vendor accounts

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A leaked beneficiary list is a breach; CERT-In and the Data Protection Board both need to hear.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan