Can a policy show that a control actually works?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)
Short answer: No; operation needs records
No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.
Why it matters
Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
A worked example
A bank's access policy says rights are reviewed every quarter. Internal audit asks for the last two review sign-offs; one quarter has none. The policy is fine; the control did not run that quarter.
Steps
- For each policy, write the record that would show it working.
- Check whether that record exists for the last quarter.
- Where it does not, start producing it.
- Sample a few records every quarter.
- Keep the samples with the policy.
Evidence to keep
- Policy-to-record map
- Quarterly samples
- Gaps and actions
Common mistakes
- Approving policies with no record behind them
- Showing a policy when asked for evidence
- Records that exist only before an audit
Who does what
- Internal audit head: Test operation, not existence. Pick five records and trace each one end to end.
- Chief compliance officer: A policy is a starting point. Ask for the record that shows it working.
- Internal audit department: Test five samples end to end.
- Training and L&D department: Show that training changed behaviour, for example fewer wrong sends.
What a good answer from management sounds like
“For each policy we can show the record that proves it ran last quarter, and internal audit samples them.” Effort and time: Medium · ongoing.