Internal audit in a PSU covers head office, regions, plants and a partner network of distributors or franchisees. Your work shows whether DPDP controls run in all of them, not only at the corporate office.
Most of the risk sits outside your own offices, with distributors, franchisees, meter vendors and labour contractors. Audit already visits regions and units; DPDP checks fit into those visits. Test samples from partners as well as from your own systems.
The first four things to sort out
Add DPDP checks to region and unit audit programmes.
Sample partner records against the signed data clause.
Compare partner and vendor logins with active agreements.
Report what was tested and what was only stated.
A worked example
Internal audit head
Internal audit tests the distributor data clause
Week 1Audit picks ten distributors in two regions, all with a signed data clause.
Week 2Visits find Aadhaar copies kept at three counters and one consumer list on a shared office PC.
Week 3The finding goes to the DPO and the region heads with owners and dates.
Month 6Audit revisits the same distributors and checks the copies are gone.
Evidence kept
Sample list
Visit notes
Management response
Retest results
A signed clause is a promise; a visit shows whether it is kept.
What others in the sector usually do. Internal audit teams in PSUs commonly add a few DPDP checks to existing unit visits rather than running a separate audit.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
Oil and gas marketing
Distributor registers and delivery slips with addresses; Subsidy and Aadhaar data in distributor software; Consumer numbers shared with marketing partners
Power generation and transmission
Contract labour gate passes and biometrics; PSU hospital records of employees and families; Township allotment and resident records
Electricity distribution (state discoms)
Smart-meter data held by the meter vendor; Billing files shared with collection agencies; Consumer lists exposed on public bill lookup pages
Transport undertakings (rail PSUs, metro, state road transport)
Passenger lists and reservation charts; Concession passes with ID copies; CCTV and travel-card data
Steel, mining, defence production and heavy industry
Medical surveillance records of workers; Township and school records; Resettlement and compensation records of affected families
State development corporations and boards
Lottery and allotment lists published with full details; Ration and supply records; Old paper files in record rooms
Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022
Short answer: Yes, you are responsible for what they do with your consumers' data
When distributors, dealers or franchisees handle consumer data for your service, they act for you, and you are responsible. Give them only what they need, add a data clause to agreements, train them, and check a sample every year. If a partner uses data for its own business, such as selling insurance, that is outside your purpose and must stop.
Short answer: Possibly, for some activities; get a written legal view
The DPDP Act uses the Article 12 meaning of 'State'. Many PSUs have been treated as the State by courts, depending on how deeply the government controls them. If you are, Section 7(b) and 7(c) and Section 17(4) may apply to public functions, but not automatically to commercial customer-facing work. Write an activity-wise legal view and keep the State provisions narrow.
What the law says
Section 2(x) defines State by reference to Article 12. Sections 7(b), 7(c) and 17(4) apply to the State. Section 7 · Section 8(7) · Rule 8
Steps
List activities: public functions, schemes, commercial sales.
No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.
From your seat: Internal audit head. Test operation, not existence. Pick five records and trace each one end to end.
What the law says
Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty. Section 8(5) · Rule 6 · Section 8(1)–(2)
Steps
For each policy, write the record that would show it working.
Check whether that record exists for the last quarter.
Short answer: Evidence for each duty, not status colours
Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.
From your seat: Internal audit head. Ask for the evidence list before you accept any readiness statement.
Short answer: Only as far as the evidence behind it
Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.
From your seat: Internal audit head. Your report is one of the few independent views management gets. Say what was tested and what was not.
Short answer: One line per duty, with owner and evidence
Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.
From your seat: Internal audit head. Check that each DPDP line has a control you can actually test.
Short answer: At least one year; 180 days of ICT logs in India
Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.
From your seat: Internal audit head. Sample whether logs exist for the period, not just whether logging is switched on.
Example in PSUs and utilities
Consumer systems and township systems both need logging.
What the law says
Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8
Steps
List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Short answer: Yes, every vendor that touches personal data
You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.
From your seat: Internal audit head. Pick the three largest vendors and read their contracts against the six things.
Example in PSUs and utilities
Distributors, franchisees, meter vendors, ticketing vendors and labour contractors.
Short answer: Only those who need it, reviewed every quarter
Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.
From your seat: Internal audit head. Compare the access list with the HR leavers list.
Example in PSUs and utilities
Partner and franchisee logins are the weak point.
What the law says
Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6
Steps
Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Internal audit head. Ask for the last drill record and its findings.
Example in PSUs and utilities
A leaked consumer list from a distributor is your breach to report.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan
The sections you will use most
Section 8(5) · Rule 6: Security safeguards. Large consumer systems and plant systems both need safeguards; some are protected systems.
Section 8(1)–(2): Responsibility for vendors. Distributors, franchisees, meter vendors, ticketing vendors and labour contractors process data for you.
DPDP Act, Section 2(x) and Article 12 of the Constitution
The Act defines 'State' with the meaning in Article 12. Many PSUs have been treated as 'the State' by courts, depending on government control.
Get a legal view on which activities can rely on Section 7(b), 7(c) and 17(4). Customer-facing commercial work usually follows full duties.
MeitY
CERT-In Directions, 2022
Report specified cyber incidents within six hours; keep ICT logs 180 days in India.
Applies to every PSU.
CERT-In
IT Act, Section 70 and NCIIPC
Systems notified as protected systems come under NCIIPC's critical information infrastructure framework.
Plant control, grid and pipeline systems may be notified; personal data in them follows DPDP too.
NCIIPC
CEA (Cyber Security in Power Sector) Guidelines, 2021
Cyber security requirements for power sector utilities, including incident reporting and supply chain controls.
Power PSUs and discoms can use this evidence for DPDP Rule 6.
Central Electricity Authority
Aadhaar Act, 2016
Aadhaar-linked subsidies such as LPG must store Aadhaar numbers securely and limit sharing.
Distributor systems and counters must not keep Aadhaar copies.
UIDAI
Labour Codes (in force from 21 November 2025)
Registers for workers and contract labour, health and safety records for hazardous work.
Set retention for worker and contract labour records against the codes and state rules.
Ministry of Labour
SEBI LODR Regulations (listed PSUs)
Listed PSUs follow disclosure and governance rules.
Board-level reporting on data protection fits into existing risk committee work.
SEBI
RTI Act, Section 8(1)(j) as amended
Personal information is exempt from RTI disclosure since 13 November 2025.
PSU CPIOs should apply the new wording with reasoned orders.
SFLC.in summary
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
