Compliance is a state, not an event
You can complete a form once. You cannot complete handling personal data. The system changes: a new vendor, a new market, or a new feature that collects something it did not collect last quarter. Each change can silently invalidate an obligation you were passing.
A control that operated in March is not evidence that it operated in September. An assertion is not evidence. The finding "consent taken before collection" carries a date, and over time it becomes a statement about history, not about current operations.
Why we built a review clock into the engine
Every engagement our engine tracks has a snapshot. When the last snapshot is older than the review policy (180 days), the engagement surfaces in review_status, oldest first. It is not an alarm; it is a queue. Re-assessment is scheduled, not discovered.
Two consequences follow:
- Trend, not snapshot. Because assessments repeat, we can show
compliance_trend: is this getting better or quietly worse? A one-time audit cannot answer that. - Change-triggered re-assessment. When the regulation moves or a system changes, the affected obligations can be re-run instead of the whole engagement.
The decay you should expect
Three things rot fastest:
- Evidence. The person who knew where the file was has left. The file was never linked from the policy.
- Alignment. The notice now describes a flow that changed. The words and the system have drifted apart.
- Coverage. A new processor was onboarded without its contract, or a new data field was added without a purpose statement.
None of these announce themselves. All of them are visible on a second pass.
What to do about it
- Put a date on every control, not just the policy. "Last evidenced" is the field that matters.
- Schedule re-assessment. Quarterly for the high tiers, at least annually for the rest, and immediately on a material change.
- Re-run the affected obligations when something changes, rather than waiting for the cycle. This approach is targeted, and it keeps the record current.
- Watch the trend. A single pass tells you where you are. The direction tells you whether the programme works.
DPDP is not a deadline you meet. It is a discipline you keep, with the evidence to prove it again next year.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Engagements carry a 180-day review policy. Not legal advice. www.dpdpdone.com