Accountability under the DPDP Act isn’t just about doing the right thing — it’s about being able to show you did. That’s what recordkeeping is actually for.
WHAT'S WORTH KEEPING
CONSENT LOGS
What, when, and how withdrawn
A record of what someone agreed to, not just the current state of their preferences.
RETENTION
A minimum one-year floor
The Rules set a baseline retention period — three years for certain categories of entity.
DECISIONS
Why a basis was chosen
A documented reason a particular lawful basis applied to a particular category of data.
If the Data Protection Board ever opens an inquiry, the organisations in the strongest position aren’t necessarily the ones that made the fewest mistakes — they’re the ones that can produce a clear, dated record of what they did and why. Evidence turns “we believe we were compliant” into something a regulator can actually verify.
An audit trail isn’t paperwork for its own sake. It’s the difference between describing your compliance and proving it.
SOURCES The DPDP Rules, 2025 — official text, MeitY — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf