The SDF “Data Audit”: How Significant Data Fiduciaries Should Prepare

If your organisation is, or may be, notified as a Significant Data Fiduciary (SDF), the October 2026 Removal of Difficulties Order removed any doubt about one obligation: the periodic audit under Section 10(2)(c)(ii) is a data audit.

The legal requirement

Under Section 10 of the DPDP Act and Rule 13 of the DPDP Rules 2025, an SDF must:

• Appoint a Data Protection Officer based in India, responsible to the Board of Directors.
• Appoint an independent data auditor to evaluate compliance.
• Conduct a Data Protection Impact Assessment (DPIA) and a data audit at least once every twelve months, and furnish the significant observations to the Data Protection Board.
• Exercise due diligence on algorithmic software to confirm it does not pose a risk to Data Principals' rights.
• Comply with any directions that specified personal data, and its traffic data, must not be transferred outside India.

Failure to meet these additional obligations can attract a penalty of up to ₹150 crore.

Not sure whether you are an SDF? Read Are you a Significant Data Fiduciary?

Why your ISO 27001 audit is not enough

An ISO 27001 or SOC 2 audit tests your security management system. A DPDPA data audit has to test lawfulness of processing, which is a wider set of questions:

Question	ISMS audit	DPDPA data audit
Are controls protecting data effectively?	✓	✓
Was a valid notice given, and consent obtained or a legitimate use relied on?	✗	✓
Is data limited to the specified purpose?	✗	✓
Are erasure and retention periods honoured?	Partly	✓
Are rights requests answered within the published timelines?	✗	✓
Are children's and guardian consents verifiable?	✗	✓
Were breaches intimated to the Board and to individuals correctly?	Partly	✓

Your ISMS evidence is still valuable, because it covers the "reasonable security safeguards" part. But it is only one chapter of the data audit.

A sensible audit scope

1. Processing inventory. Every processing activity, its purpose, its lawful basis, its data categories and its systems.
2. Notices and consent. A sample of consent records traced from notice version to consent artefact to downstream use, including withdrawal.
3. Retention and erasure. Evidence that data is erased when the purpose is served, with the 48-hour pre-erasure notice where the Third Schedule applies.
4. Rights handling. The request log, response times and outcomes.
5. Children and guardians. The verification method and its records.
6. Processors. Contracts, instructions and evidence of oversight.
7. Breaches. The incident log, Board intimations and individual notices.
8. Algorithms. Due-diligence records for models that make or support decisions about people.
9. Cross-border transfers. Destinations and any restrictions that apply.

Getting ready

• Pick the auditor early. Independent data auditors with DPDPA experience will be in short supply in 2027.
• Run a dry-run audit in Q1 2027, before the obligations commence, so findings can be fixed in time.
• Pair the audit with the DPIA. The DPIA identifies the risks and the audit tests the controls. See our DPIA guide.
• Automate evidence. Auditors sample, and sampling only works if every record is timestamped and retrievable.

Saakshi, Data Adhikaar's audit agent, keeps an always-on evidence Vault mapped to each DPDPA obligation, so the data audit becomes an export rather than a scramble. See also our guide on SDF obligations.

Position as of 15 October 2026. Not legal advice.