DPDP Insights › Questions › What evidence should exist before management accepts that we are ready?

What evidence should exist before management accepts that we are ready?

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)

Short answer: Evidence for each duty, not status colours

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

Why it matters

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met.

Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(6) · Rule 7: On becoming aware of a personal data breach, tell each affected person and the Data Protection Board without delay. Send the Board a detailed report within 72 hours, or a longer period if the Board allows on request.
Section 8(9)–(10) · Rules 9, 14: Publish the business contact of a DPO or another person who can answer questions about personal data. Run a working grievance process and reply within a reasonable period, not more than 90 days.

A worked example

Before a hospital's management signs off DPDP readiness, the DPO attaches one item per duty: dated notices, the request register, signed lab contracts, the drill report. Two duties have nothing attached and are shown as open.

Steps

List the duties that apply.
For each, name the piece of evidence that would satisfy an auditor.
Ask owners to attach it.
Mark duties without evidence as open, not ready.
Review the list before each management sign-off.

Evidence to keep

Duty-to-evidence list
Attached evidence
Sign-off record

Common mistakes

Accepting 'done' without seeing anything
Counting policies as evidence
One sign-off and no review after

Who does what

Internal audit head: Ask for the evidence list before you accept any readiness statement.
CFO / Finance head: Fund evidence, not just policies. Evidence is what makes the spend count.
Internal audit department: Ask for the evidence list first.

What a good answer from management sounds like

“Each duty has a named piece of evidence attached. Duties without evidence are shown as open, and we review the list before every sign-off.” Effort and time: Medium · 4 to 8 weeks.