Data Protection Compliance
Data protection compliance assessment for the DPDP Act and GDPR
An independent check of how your organisation collects, uses, protects and deletes personal data.
- Valid for
- 1 year
- Guidelines
- CERT-In
- Verification
- QR and register
Accredited and empanelled
What is Data protection compliance?
A data protection compliance assessment examines how your organisation handles personal data against India's Digital Personal Data Protection Act, 2023, the EU General Data Protection Regulation, or both. Assessors review your records, notices, consent flows, contracts and security controls, and interview the people who run them.
The result is a report of gaps and recommendations, and a certificate recording the framework assessed, the assessment date and the report reference. It reflects your practices on the assessment date and is typically renewed each year.
This is an independent assessment, not a legal opinion and not certification under a GDPR approved certification mechanism. Regulators judge compliance case by case, so the assessment is best used to find and close gaps and to show customers and boards the diligence you have done.
Who it is for
- Indian businesses preparing for DPDP Act obligations
- Companies serving customers in the EU or monitoring people there
- SaaS providers acting as data processors for clients
- Healthcare, education and financial organisations holding sensitive personal data
- Outsourcing and BPO firms handling client data across borders
What sets audit time and cost
Typically three to six weeks from kick-off to report, depending on the number of business units, systems and processing activities in scope.
- Number of processing activities and business units
- Framework assessed: DPDP Act, GDPR or both
- Number of systems and vendors holding personal data
- Volume and sensitivity of personal data, such as health or financial data
- Number of locations and countries involved
- Maturity of existing records and policies
Why it matters
What Data protection compliance gives you
- 01
A clear gap list
Each gap is tied to a specific obligation and rated, so your legal, IT and operations teams know what to address first.
- 02
Evidence for customers
A dated, independent assessment helps answer privacy questionnaires and data processing agreement reviews.
- 03
Accurate data maps
The assessment tests whether your records of personal data reflect what systems and teams actually do.
- 04
Board-level visibility
Findings are summarised for management, showing where personal data risk sits in the organisation.
The audit
What our auditors examine
- 01
Notice and consent
Privacy notices, consent capture and withdrawal, and how consent records are kept and linked to processing.
- 02
Purpose and data minimisation
Whether each processing activity has a stated lawful purpose and collects only the data that purpose needs.
- 03
Rights of individuals
Processes for access, correction, erasure and grievance handling, and the time taken to respond to requests.
- 04
Processors and cross-border transfers
Contracts with vendors and processors, transfer mechanisms and the controls placed on third parties.
- 05
Security safeguards and breach response
Access control, encryption, logging and the procedure for detecting, assessing and notifying personal data breaches.
- 06
Retention and deletion
Retention schedules and evidence that personal data is erased once its purpose has been served.
How the audit runs
Audits follow CERT-In guidelines from scoping to the final certificate, with re-testing until findings are closed.
01
Scoping
We agree the applications, URLs, APIs, networks or assets in scope, the test environment and the rules of engagement.
02
Testing
Auditors test against CERT-In guidelines and recognised methods such as the OWASP Testing Guide, using automated tools and manual techniques.
03
Findings report
Each finding comes with its severity, evidence and the risk it poses. Your team fixes them in the audited environment.
04
Re-testing
We re-test until findings are closed or formally accepted, and record the version that was finally audited.
05
Certificate and report
The final report and certificate are issued, and the certificate is listed in the public register with a QR code for verification.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 27701
Certification of how your organisation governs personal data, as a controller, a processor or both.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
Security audits
Web application security audit
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
Security audits
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
Industries we audit for
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
Data protection compliance questions
We audit; we do not consult.
To keep audits independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your Data protection compliance audit
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.