Can management trust the DPDP position it is shown?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)
Short answer: Only as far as the evidence behind it
Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.
Why it matters
Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real.
- Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 10 · Rule 13: The government may notify organisations as Significant Data Fiduciaries based on the volume and sensitivity of data and the risk involved. They need a DPO based in India, an independent data auditor, and a yearly impact assessment and audit. None had been notified when this page was last reviewed.
A worked example
A PSU board is shown a readiness summary. A director asks which parts were tested. The answer: vendor contracts and logs were sampled; notices and deletion rest on statements. The minutes record both.
Steps
- Ask for the position split into tested, stated and not looked at.
- Ask for two or three samples you can see.
- Ask who reviewed the evidence.
- Ask what changed since the last review.
- Record the answers in minutes.
Evidence to keep
- Position with tested and stated parts
- Samples seen
- Minutes
Common mistakes
- Trusting a single summary slide
- No difference between stated and tested
- No record of what management saw
Who does what
- Internal audit head: Your report is one of the few independent views management gets. Say what was tested and what was not.
- Company secretary: Minutes should record what evidence the board saw, not only what it was told.
What a good answer from management sounds like
“The position we see separates what was tested from what was only stated, and we look at samples each quarter.” Effort and time: Light · each review.