Data Audit (SDF)

Section 10(2)(c)(ii) of India's DPDP Act obliges a Significant Data Fiduciary (SDF) to undertake a periodic data audit. The provision originally read 'periodic audit'; the DPDP (Removal of Difficulties) Order 2026 (S.O. 5458(E) of 5 October 2026) reworded it to 'periodic data audit' to clarify scope — the audit is a data audit, not a general compliance audit. Rule 13 of the DPDP Rules 2025 (in force from 13 May 2027) operationalises the duty: the SDF must appoint an independent data auditor, conduct the audit on a periodic cadence, cover processing activities, consent flows, DSR workflows, breach history, security controls and SDF-specific controls such as DPIAs and algorithmic risk assessments, and furnish the audit report to the Data Protection Board on request.

The auditor must be independent — the SDF cannot rely on an internal audit function to satisfy Rule 13. The Act does not create a Board-maintained auditor panel; the SDF is responsible for selecting a qualified independent auditor and documenting the basis for the appointment. The audit output is one of the primary pieces of evidence a Board inquiry will inspect, so the audit scope, methodology, findings and remediation workflow should be structured for external review from day one — not reformatted after the first inquiry notice arrives.