The Act punishes the absence of a record
Read the obligations rather than the penalties. A large share of what the Act requires is demonstrable process: that a notice was given in a language the data principal understands, that consent was obtained before collection, that a grievance route exists and was published, and that a record was kept of what happened.
None of that is a security control. All of it is a record. The failure mode is not a breach, but an organisation that did the right things and cannot show it, or did some of them and cannot show which.
| Obligation scope | Metric |
|---|---|
| Total framework obligations | 211 |
| Obligations in the workhorse tier (₹50 crore) | 151 |
Under our framework's counts, 151 of the 211 obligations sit in the ₹50 crore tier (the workhorse tier, not the headline one). Much of it is precisely this kind of demonstrable process.
Why the record goes missing
Three ordinary reasons explain missing records, and none of them are malicious:
- It was never created. The consent was taken in a flow nobody instrumented. The notice was updated but the version history was not.
- It exists in the wrong place. A screenshot in someone's inbox is not a record with a date and an owner.
- It contradicts the claim. The policy says English and Hindi; the site ships English only. The gap between the document and the system is the finding.
The asymmetry a regulator will exploit
An organisation can assert compliance in a sentence. To test it, the regulator asks for one artefact.
If the artefact does not exist, the assertion does not just fail: it becomes the evidence.
This is why the first high-profile action is more likely to be about a missing record than a sophisticated intrusion.
What to do about it
- Instrument the moments, not the policy. Log when a notice was shown, in which language, at which version. That is the evidence.
- Give every claim a date and an owner. An undated document is a draft.
- Keep the contradictory version. If the site and the policy disagree, that is a finding you can fix now, or have found for you later.
- Test your own record before someone else does. Ask for last quarter's consent evidence and see whether you can produce it in ten minutes.
The first penalty will not announce itself with a breach. It will announce itself with a request for a file.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Not legal advice. www.dpdpdone.com