Ask a company whether it has a consent notice under the Digital Personal Data Protection Act 2023. The leadership or technical team will say yes. Ask that same company to produce the notice, the date it went live, and the exact passage showing consent is gathered before data collection begins. The room gets quiet.
Neither answer is a lie. The first response is an assertion. The second response is evidence. Compliance is the continuous work of closing the gap between them, and that gap remains invisible until someone asks for the verifiable quote.
Compliance is a claim until evidence proves it.
The gap between policies and verifiable systems
This gap is not unique to India or to the DPDP Act 2023. It is the standard finding of every technical audit across regulatory regimes. Auditors routinely encounter a policy document that asserts one procedure, an active software system that runs another, and a filing system that records neither.
What makes India's Digital Personal Data Protection Act 2023 different is the timing. The Act is enacted, the Rules are being operationalised, and a generation of organisations is preparing to assert compliance before building the underlying records. Purchasing a policy template produces a paper binder, but an operational audit tests whether the system reflects the text.
When an inquiry occurs, the Data Protection Board of India will not evaluate an organisation based on intentions. It will examine defensible records. If an organisation relies on assertions, it discovers too late that unverified statements carry zero weight during an official inquiry.
The two ceilings that govern defensible evidence
Two operating ceilings keep our evaluation work honest, and both limits impose real constraints on what our tools report.
First, a scanner cannot prove a control operates. You can point an automated tool at a website and confirm a consent banner is present on the page. You cannot point that same tool at the website and conclude that the underlying control functions correctly over time. Observation proves presence, but operation requires evidence of behaviour across cycles.
Our scanner runs 16 automated checks, and we cap every finding it generates at "present". The scanner cannot confirm that consent is collected before personal data is ingested, that a withdrawal request is honoured across backend databases, or that data retention ends when the purpose expires. We report the lower verifiable state rather than claim a higher one we cannot prove.
Second, an assertion is not evidence. A statement that "the client confirmed compliance" or "the scanner found the banner present" remains a claim. Sufficiency is an independent determination, made strictly against a quoted passage from a verifiable record.
In our audit engine, an assessment without a direct quote is refused by the software. It is not discouraged or flagged for review; it is rejected. That structural refusal prevents an auditor or an organisation from entering a flattering answer when the supporting text does not exist.
The framework metrics behind the audit
Under the Digital Personal Data Protection Act 2023, penalties reach statutory ceilings as high as ₹250 crore. Headlines focus on that figure, but the operational failures that lead to penalties are rarely dramatic. They stem from simple, mundane record failures: a missing quote in an unread file, an English-only notice where a data principal requires a specified regional language, or a retention policy with no log showing that data was erased.
The table below outlines the structural metrics of the DPDP Done audit framework alongside the statutory context of the Act.
| Structural parameter | Framework metric | Evidentiary boundary |
|---|---|---|
| Statutory penalty ceiling | Up to ₹250 crore | Enforced through statutory findings, not assumptions |
| Framework audit domains | 18 domains | Structured across all statutory operational areas |
| Specific audit obligations | 211 obligations | Mapped directly to source legal texts |
| Foundation source documents | 4 source documents | Cited to the page with exact quoted passages |
| Automated scanner capability | 16 checks | Capped at presence; cannot determine operational execution |
These 211 obligations require direct proof rather than high-level summaries. An organisation cannot satisfy 18 domains of regulatory duties through narrative assertions. Each obligation demands cited text tied directly to operational systems.
What our engine does not claim
DPDP Done is not a law firm, and our assessments do not constitute legal advice. We are not a certification scheme, and our findings do not represent a government clearance or statutory safe harbour.
We do not claim that an artificial intelligence system can decide your legal standing. What we provide is narrower, technical, and verifiable:
- A structured framework of 18 domains and 211 obligations, drawn from four source documents and cited directly to the page.
- An evidence discipline that refuses to record an unsupported opinion as an audit finding.
- A cryptographic report that is digitally signed and verifiable, allowing any third party to validate the findings without relying on trust.
In our architecture, an organisation's own AI agent drives the audit through a remote Model Context Protocol (MCP) server. The DPDP Done engine supplies the rules, the framework, the evidence discipline, and the scoring. The resulting evaluation reflects verifiable facts extracted directly from the records you supply.
What to do if you are preparing for DPDP
Organisations preparing their operational posture under the DPDP Act 2023 should establish an audit trail before enforcement begins:
- Stop accepting assertions as audit findings. If a compliance claim lacks an exact quote, an implementation date, and a named technical owner, treat it as an intention rather than evidence.
- Distinguish control presence from operational execution. Identify which controls your systems display publicly and which controls produce logs proving they operate over time.
- Document language accessibility, active dates, and data deletions. Keep the logs that show personal data was removed after purpose completion, and record which languages your consent notices support.
- Make every internal compliance report independently verifiable. A compliance record that cannot be verified by an external reviewer is a corporate promise rather than an audit finding.
Compliance under India's DPDP Act 2023 is not a static form to sign and archive. It is an operational claim that your organisation can substantiate repeatedly, year after year, with the cited records intact.