As Indian Data Fiduciaries try to find the ways to achieve DPDPA Compliance, the challenge stares at them. There is no precedence for them to follow. Even if they think GDPR is a good path, what is good for GDPR in EU may not be good for DPDPA in India. The law is different and the people are different. Hence a strategy for implementing DPDPA compliance has to find its own path.
FDPPI has found that Indian Banks are keen on DPDPA compliance and but are struggling to find the right path. Banks (like many other organizations) function at the branches but are Governed from the HO. Data exchange with the Data Principal happens at the Branch level where there is autonomy for collection, processing, disclsoure and grievance redressal. While the HO may set policies, implementation has to happen at the branch level.
SBI therefore is a conglommerate of 23000 branches where personal data of customers is processed. Any methodology for implementation and audit of DPDPA which does not recognize DPDPA compliance of the Bank as an aggregation of 23000 branch units is likely to be inefficient and unsustainable.
Implementation is the responsibility of the Banks. They may chose any path to reach the goal as it suits them.
But FDPPI and AIDAI have taken upon themselves to develop a system of Data Audit that is effective for Banks which have autonomous branch units where Personal Data is processed.
This is a combination of a “Standard for Compliance” and a “Standard for conducting Audits”.
Data Governance and Protection Standard of India (DGPSI) is already known to the market as the standard for DPDPA Compliance. Now AIDAI, (Association of Independent Data Auditors), a division of FDPPI has introduced a Standard Audit methodology named DA-SOP600 to enable independent audits at branch level to be aggregated at the enterprise level just as Statutory Financial audits udner ICAI guidlines under SA600 is handled.
The launch of Data Auditor SOP600 by AIDAI (Association of Independent Data Auditors of India), is a watershed moment in the history of DPDPA compliance in India. This has created the path for DPDPA compliance in Banking organziations In India which have customer interface at branch level, ATM level, Business Correspondent level etc.
It is said that SBI function with 23000+ branches, 63000+ ATMs, 82000+ Business correspondent outlets. All these are Personal Data Collection and Processing points which needs to be factored in for DPDPA compliance.
Banks like Canara Bank/PNB may have 10000+ branches and other Banks may have lesser number of Customer interface points. But the scale of the problem is mind boggling.
How is it appropriate to consider SBI or any other Bank as a single Data Fiduciary where a single DPO will manage the compliance and a single Data Auditor will audit?
SOP600 is a solution which AIDAI has found for conducting Data Audits. But it also holds the key for compliance.
It addresses a practical problem that is likely to become increasingly important as organisations move from a centralised model of data governance to a distributed operational model, where individual branches, business units, departments and locations independently interact with Data Principals.
Much of the discussion around data protection compliance tends to happen at the corporate or enterprise level. Policies are framed at the Head Office, Privacy notices are approved centrally, Data protection officers and legal teams sit at the enterprise level. Technology controls may also be centrally designed.
But the actual interaction with the Data Principal take place very often, at the branch. It is a point of data collection, data use, data disclosure and Data Principal interaction.
The DPDPA compliance posture of the organisation cannot therefore be understood merely by looking at what the Head Office says it does.
The idea behind Data Auditor SOP600 is significant because it attempts to establish a standardised audit approach for branch and sub-unit environments.
The objective is not to replace the enterprise audit.
It is to create a mechanism through which the activities of autonomous units can be examined systematically and then aggregated into the enterprise-level audit perspective.
This is a fundamentally different way of looking at data protection auditing.
Instead of asking only, “Is the organisation compliant?”, the auditor can progressively ask, “Are the units through which the organisation interacts with Data Principals following the prescribed data protection practices?”
And then:
“What does the combined evidence from these units tell us about the enterprise’s overall DPDPA compliance posture?”
That is a much more operational approach to data governance.
What is important to note is that this principle not only assists the Auditing but also gives a direction to the implementation team of how to implement the DPDPA Compliance.
The designation SOP600 itself is symbolic of the philosophy behind the initiative. The objective is not simply to create another Standard Operating Procedure. It represents an attempt to institutionalise a repeatable and scalable audit methodology.
AIDAI, as the Association of Independent Data Auditors of India and a division of FDPPI, has an additional responsibility in this ecosystem.
The purpose of an auditor is not merely to identify non-compliance.
An auditor must also operate within a framework that promotes:
SOP600, as part of the emerging AIDAI framework and its Code of Ethics, seeks to create such a common professional path for empanelled auditors.
This is important because the credibility of an audit ecosystem ultimately depends upon the consistency of the audit process.
Two auditors examining comparable environments should not produce dramatically different outcomes merely because they follow completely different methodologies.
Standard Operating Procedures help reduce such variability.
Perhaps the most important message emerging from SOP600 is this:
DPDPA compliance cannot remain confined to the legal, IT or privacy department of an enterprise.
It has to reach the operational edge of the organisation. The branch manager, The customer-service executive, The sales employee, The HR representative, The field officer, The person receiving the KYC document, The person responding to a Data Principal’s request, The person deciding whether information can be disclosed.
These are the people who convert a policy into actual behaviour.
Therefore, the effectiveness of the DPDPA framework ultimately depends upon what happens at the point of data interaction.
Traditional auditing often follows a top-down model. The enterprise is examined as a single entity. SOP600 introduces the possibility of a bottom-up evidence architecture.
The auditor can examine the operational units and then build the enterprise picture from the evidence emerging from those units.
This does not eliminate the need for enterprise-level auditing. On the contrary, it strengthens it.
Whether SOP600 ultimately becomes a widely adopted industry practice will depend on how the framework is implemented, tested, refined and accepted by Data Fiduciaries and the professional community.
But its significance as an experiment in structured, distributed and aggregatable data auditing is difficult to ignore.
The initiative raises an important question for every large Data Fiduciary:
Do you really know how personal data is being handled at every operational point where your organisation meets a Data Principal?
If the answer is uncertain, perhaps the next generation of DPDPA audits will have to look beyond the Head Office.
The future of data protection assurance may lie not only in auditing the enterprise — but in auditing the enterprise through its operational units.
And that is the path that SOP600 seeks to create.
Treading a path which nobody else has trodden is always a challenge. But an innovator does not wait for someone else to build the road. He creates the road. And once the road is created, others can follow.
SOP600 is one such attempt to create a new road for the Indian data protection profession.
The path is open.
Let the auditors walk it.
Let the Data Fiduciaries test it.
Let the profession improve it.
And ultimately, let the objective remain what it has always needed to be, A more accountable, trustworthy and data-responsible India.
Naavi
Indian Banks are on a money spending spree to demonstrate their commitment to implementation of DPDPA. The Boards of the Banks appear to have not spared any effort to sanction budget for DPDPA Compliance.
But are the Banks spending their money wisely?
It appears that Banks are now investing their DPDPA budget mostly on purchase of software and in some cases hardware also. There is some investment on training and awareness but the level is very low when compared to the investments being made for IT.
DPDPA compliance is more of Governance than IT. Hence the prioritization of spending the DPDPA investment needs to be relooked by these Banks.
I urge the Chairmen of Banks and the Directors to review their proposed budget on DPDPA Compliance and check it against the above recommendations. This will a decision that is sustainable beyond your terms.
Naavi
Join a discussion on the new concept of DPDPA Audit for Banks … and other entities with multiple Data Processing units.
Naavi
As part of the new developments in FDPPI, a new system of Data audit for large organizations involving multiple Branch units has been introduced.
Many major Banks like Canara Bank and SBI have already announced substantial investments in software for compliance. Many of them have also engaged the services of Big4 auditing agencies.
We are aware that neither the software companies nor the Big4 audit firms have fully integrated the concepts that FDPPI is proposing. They may also defend their current software or systems as adequate for organizations like SBI or Canara Bank.
We at FDPPI have however decided that such enterprise level audits have to follow the model of “Aggreagtion of Branch level Audits” . FDPPI has prepared its audit system for this purpose and introduced the standard procedures to make such audits to be conducted on a common standard and under a common organizational control of AIDAI.
AIDAI has actually published a new Code of Ethics for its empanelled Data Auditors which incorproates the principles of Lead Enterprise Data Auditor and Compenent Data Auditors.
We expect the Big4 to follow suit.
We hope the Banks posess the necessary knowledge to ask the right questions with their consultants to ensure that they are not finalizing compliance decisions solely because the audit is being performed by an organization which has large turnover. Going by some of the developments at NABARD and Bank of Baroda, it is difficult to be confident that there is a satisfatory level of understanding of the DPDPA problem at some of these Banks before they entered into multi crore contracts at public cost.
It will be after 2 years that we will be reviewing the effectiveness of the current decisions made by these Banks when customer complaints may start showing up at DPB.
Many of these banks may require “Peer Audit” either before completing their exercise of initial audit before 13th May 2027 or there after.
AIDAI/FDPPI however believes that we need to build a strong army of data auditors who can undertake the audits of multiple compliance units which can be aggregated into an enterprise level audit.
We are also conducting a specific training program to introduce the framework AIDAI-SOP-DA 600 and the modified Code of Ethics in our special Jnaana Vardhini session on 16th September 2026.
These will be the standards for the future and defining the course of DPDPA Compliance in India.
Naavi
(Comments are welcome)
Software is a necessary requirement of DPDPA compliance but neither it is sufficient nor the first priority.
Going by newspaper reports it appears that Banks in India are showcasing their DPDPA compliance by installing the necessary software and hardware to enable DPDPA compliance.
A report in Business Standard today indicates that SBI is targeting its compliance program to be completed by end of 2026, five months ahead of the due date for implementation. The report highlights that SBI has “Procured” software and hardware as part of its preparations for compliance and installation and deployment eis expected to be completed by Decmber.
Similarly, Canara Bank recently announced that it has awarded a contract of Rs 52 crores to a software company for DPDPA compliance.
While it is encouarging to note the large investments being committed and the desire to meet the deadline, it is not clear if Banks are adopting a path to compliance which is likely to lead them to a software dependent business model.
Most of the Banks have not completed their employee awareness program and now if they are already committing to the purchase of software, they are likely to encounter problems sooner or later when the dynamic industry needs to make changes.
Banks in India have a unique problem in DPDPA compliance since data processing occurs at hundreds of branches while the compliance may be focussed on the CBS system as if the Data Center is the unit of compliance.
What the Banks may be initially doing is to send out notices to all their current customers like the renewal of KYC and most of the investments may represent this cost. This is only one part of the requirement. What is more critical is the abilit to meet the Data Access Requests, Grievance redressal etc.
We need to be war of some of the Banking giants creating a wrong path to compliance and claiming that what they are doing only is the correct path. It will require some complaints and enquiry by DPB and appeals at TDSAT and Supreme Court before their approach gets a validity.
Let us wait and see how things proceed…
Naavi
