Compliance is a claim until evidence proves it.
Why we did it
We had two reasons, one commercial and one honest.
Commercial: a compliance vendor that cannot demonstrate its own compliance is selling a mirror it will not look into. The demo nobody else can give is running our own engine on our own operation.
Honest: we are a Data Fiduciary for our auditors' account data and a Data Processor for their audit records. That is a real position under the Act, not a footnote on a marketing page. It carries obligations, and we would rather find our own gaps than have them found by others.
What we checked first
We started with the obligations a website makes visible. These are the controls a customer or a regulator can check without asking us for anything:
- A Rule 3 notice: published, in English and Hindi, with a language switch.
- A working rights route: a mechanism that files a request, not a paragraph telling you to email someone.
- A specific withdrawal path: a route to take consent back, distinct from the general rights route.
- A published grievance contact: who to write to, and where.
- Transport security: TLS on every public surface.
Those map to statutory obligations, and each has a test type. A notice is a DOC check, but a rights mechanism is E2E. It has to work, not merely exist.
What we found, and what we changed
We are not going to pretend the first pass was clean. The useful part of a self-audit is the gap, so we published it in the same places our customers publish theirs: a finding with a code, a condition, and a closure. The full findings register lives with the engagement record, not in this post.
The point is not that we passed. It is that the artefact (a signed, evidenced report) exists, and anyone can verify it.
The honest limit
Two ceilings govern every audit result:
- An assertion is not evidence.
- A scan shows that a control is present, never that it operates.
Hosting a notice shows that text is present on a server. It does not prove backend workflows honour what the notice promises. A working rights form confirms receipt, but verifying operational closure requires human audit evidence.
What this means for you
- Do the visible obligations first. A notice, a rights route, a withdrawal path, and a published contact are cheap, checkable, and often the first thing asked for.
- Distinguish a route that exists from a route that works. The second is the one that gets tested.
- Publish your findings, not just your passes. The gaps you log honestly are worth more than confident claims you cannot support.
If you are choosing a DPDP tool, ask it to audit itself first. Ours does.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Not legal advice, not a certification scheme. www.dpdpdone.com