A privacy audit should test evidence, not the length of a policy

A policy can say that access is removed when staff leave. An audit asks whether the last few departures actually lost access to the systems containing personal data. That shift from stated intention to observed evidence is what makes an audit useful.

DPDP imposes additional audit requirements on Significant Data Fiduciaries. Section 10, rule 13 and the October 2026 textual correction provide the relevant framework. As of 22 October 2026, the substantive SDF duties are scheduled for May 2027 under the commencement notification. A voluntary privacy review for another organisation should not be advertised as a universally mandated annual DPDP audit.

Define what the review will test

Start with the services, locations, systems, vendors and period in scope. Identify the applicable legal provisions and the organisation’s own commitments. A scope statement that says only “privacy compliance” is too broad to tell a reviewer what evidence to seek.

For a hypothetical online retailer, the review might cover checkout, marketing preferences, customer support, delivery sharing and account closure. Employee records could be a separate workstream. Explain exclusions so management does not mistake a limited review for assurance over every activity.

For an SDF, independence and the statutory data-audit requirements need proper attention. A team reviewing its own implementation can perform useful checks, but it should not mislabel those checks as an independent audit.

Sample the customer journey

Choose a small, justified sample that includes ordinary cases and exceptions. For consent, compare the relevant notice version, interface and recorded action. For withdrawal, trace the event through campaign systems and processors. For erasure, examine the decision, retention exception and actual system treatment.

The sample should help test a real risk. Selecting only the neatest records will produce a misleading result. Include a changed email address, an old account, a manual counter entry or another case that exercises the handoffs.

Do not expose more personal data to the reviewer than necessary. Use masked evidence, controlled access or dummy demonstrations where suitable, while preserving enough reliability to test the claim. The audit itself is a processing activity that needs sensible handling.

Compare three kinds of evidence

First, examine design evidence: policies, workflow instructions, contracts and configured rules. These show what should happen. Second, examine operating evidence: logs, tickets, approvals and observed actions. These show what happened. Third, examine exception evidence: failures, escalations and unresolved issues. These show how the organisation responds when the normal route breaks.

In the retailer example, an account-closure policy may be well written while a vendor export remains active. The finding should identify that specific gap, the affected workflow and the evidence. “Improve compliance” is too vague to drive a repair.

Similarly, a missing signature on a low-risk internal checklist may matter less than a live public customer folder. Findings should explain significance rather than treat every documentation defect as equally consequential.

Do not let security assurance swallow privacy scope

A penetration test, security certification or cloud-provider report can contribute evidence. None automatically proves that the retailer gave an adequate notice, used a valid ground, honoured a request or applied the correct retention decision.

Map each assurance item to what it actually covers. Ask about the period, systems, exclusions and remediation status. A certificate can be current while a newly introduced workflow falls outside its assessment.

The corrected Act wording refers to data audit, and rule 13 concerns effective observance of the Act and Rules. The review should therefore connect technical safeguards with the broader processing lifecycle.

Close findings with evidence

Assign an owner, action and completion condition to each finding. A screenshot of a newly created policy is not evidence that every relevant vendor received the instruction. A closed ticket is not necessarily evidence that a permission was removed.

Retest the risk that produced the finding. If a former contractor retained access, check the account and the departure workflow. If withdrawals missed scheduled exports, test a new withdrawal through that route.

For SDFs, rule 13(2) also requires significant observations to be furnished to the Board by the person conducting the assessment and audit. Prepare reporting with the actual scope and findings, avoiding a claim of perfect compliance unsupported by the evidence. A useful audit leaves management with a clearer view of what works, what does not and what was demonstrably repaired.