Understand the processing reality behind your DPDP position.

The measurement problem

A questionnaire of 120–150 items has a structural defect: it collects self-reported control descriptions and treats them as evidence of compliance state. Four failures follow, and they are predictable rather than accidental.

1. i

   Respondent displacement

   The person who can answer whether retention is enforced on a given store is rarely the person the form was assigned to. Answers regress to the organisational average rather than to ground truth.

   Research note · The Governance Denominator Problem · Infrastructure Visibility Challenges
2. ii

   Construct drift

   Do you have a retention policy and is personal data in this system deleted at end of purpose are different constructs. The first is almost always yes. The second is frequently no. Instruments written against clause language measure the first and report on the second.

   Research note · Beyond the DPDP Checklist · Beyond the Data Register
3. iii

   Absent evidence linkage

   Responses are not bound to artefacts. A yes stands whether or not a processing agreement, a consent record, a deletion job or a transfer register exists behind it. The instrument cannot separate an implemented control from an intended one.

   Research note · Can You Trust the Clocks that Created the Evidence?
4. iv

   Non-repeatability

   Two assessors, or one assessor at two points in time, produce materially different output from the same organisation. Without a fixed administration protocol there is no baseline, and without a baseline remediation cannot be measured.

   Research note · IT Documentation for Audits

What the instrument resolves

Each construct maps to enforceable obligation and is assessed against evidence held by the organisation, inside the organisation's own control boundary.

Administration

The instrument is administered by the organisation. InfraVeritas holds no access to client systems at any stage of the assessment.

1. Scoping

   The construct set is bounded to the entity, business lines and systems in scope. Out-of-scope declarations are recorded and carried forward.

2. Distributed response

   Items are routed to the role that holds the answer. Where a respondent cannot answer within their own knowledge, the item is escalated to a named colleague inside the instrument rather than estimated, and the escalation is logged. This is the largest single source of accuracy gain over a form: unanswerable items become visible instead of becoming false positives.

3. Evidence binding

   Responses that assert a control carry an artefact reference. Every upload and download is OTP-authenticated and logged. Artefacts remain within the client's control boundary.

4. Reconciliation

   Where responses conflict across respondents — and on inventory and retention they routinely do — the conflict is surfaced and resolved by a named accountable owner. Unresolved conflicts are reported as unresolved. They are not averaged.

5. Position

   Output is an evidenced position per construct, with the basis of each conclusion stated.

Invite the person who holds the answer. Not the one holding the form.

The largest single accuracy loss in a data protection assessment is the moment a respondent estimates at an item that belonged to another function. The instrument closes that gap by design. Where an item exceeds the assigned respondent's own knowledge, they invite a named colleague from the department that holds the answer — into that item alone, or into the group of items where their operational knowledge sits.

1. Scoped invitation

   A colleague is invited into a single item, a group of items, or the full assessment workspace — never wider than the scope declared. Access ends when the assigned scope closes.

2. Role-bound access

   An invitee joins as Contributor (may answer and attach evidence) or Compliance Observer (may view and comment). The role is recorded against every subsequent action.

3. One-time verification, separate identity

   A single-use verification code is issued to the invitee's own work email. The inviting respondent's credentials are not shared, seen or reused. Each session is a distinct identified actor.

4. Cryptographic time-stamping

   Every upload, every download and every recorded contribution carries an HMAC-SHA-256 signature bound to the actor, the time and the artefact hash. The resulting audit record is deterministic and non-repudiable.

5. Contributions surface separately; nothing is silently merged

   Conflicting contributions from different respondents on the same item remain unresolved until an accountable owner resolves them under their own name. Reconciliation is a decision, and the record reflects that.

The audit record is retained as part of the assessment baseline. A future assessor, a regulator asking who answered what and when, or a board asking on what basis a position was taken, is answered from the same record — not from recollection.

What the instrument does not establish

• It is not a legal opinion on statutory interpretation.
• It does not certify compliance. The Act provides for no such certification, and any offer of one misdescribes the statute.
• It performs no technical control testing — no penetration testing, no configuration scanning, no code review.
• It does not discover data. It relies on the organisation's disclosure; undisclosed processing remains undisclosed.
• It does not substitute for the independent audit obligation where an entity is notified as a Significant Data Fiduciary.
• Its conclusions are bounded to the scope declared at commencement and to the state of the environment during the assessment window.

What is produced

Where the instrument comes from

DPDPiq is an instrument of the IGaaS practice at InfraVeritas 360. IGaaS is a pre-compliance discipline: it establishes whether foundational governance holds before an entity enters a formal audit, across a control model of twelve governance domains and more than fifty frameworks including ISO 27001, SOC 2, GDPR, NIST CSF, CERT-In and DPDP.

We don't do compliance. We make you ready for it. DPDPiq applies that discipline to a single statute, at the depth the statute requires.