Guide
Record-keeping under DPDP
Under DPDP the fiduciary carries the burden of proving notice and consent. Good records turn an audit or a dispute into a lookup.
Short answer
The DPDP Act puts the burden of proving notice and consent on the Data Fiduciary (s.6(10)), and the Rules set retention periods for some records. Rule 6 requires logs and personal data to be kept for one year, unless another law requires otherwise, to detect and investigate unauthorised access. Rule 8(3) requires personal data, traffic data and logs of processing to be kept for at least one year for the Seventh Schedule purposes. Keep evidence of consents, notices, requests, grievances, breaches and processors, and keep it apart from personal data you must erase.
Why records matter under DPDP
Section 6(10) makes you prove that you gave notice and obtained consent. You are responsible for processing by your processors (s.8(1)), and Rule 23 covers calling for information from Data Fiduciaries. A Significant Data Fiduciary must also carry out a DPIA and an audit every twelve months (Rule 13).
Records to keep
| Record | What it shows | Source |
|---|---|---|
| Records of processing | Systems, data, purposes, grounds, processors and retention | s.8(1) |
| Notice versions | What people were told and when, in each language | s.5, Rule 3 |
| Consent records and events | Who consented to what and when, and later withdrawals | s.6(10) |
| Legitimate-use register | Which purposes rely on s.7, and why | s.4, s.7 |
| Request and grievance logs | Dates received, verified, answered and closed | Rule 14, s.13 |
| Breach records | Time of awareness, intimations sent, detailed report | s.8(6), Rule 7 |
| Security logs | Access to personal data, kept for one year | Rule 6 |
| Processing logs and traffic data | Kept for at least one year for the Seventh Schedule purposes | Rule 8(3) |
| Processor contracts and assessments | Valid contracts with security terms | s.8(2), Rule 6 |
| Retention and erasure logs | What was erased, when and why | s.8(7), Rule 8 |
| Children's consent records | Parent verification route and decision | s.9(1), Rule 10 |
Evidence vs personal data
Evidence should prove what happened without keeping more personal data than needed. Use masked IDs such as DPR-1042 (sample) and references to records, not copies of documents.
Section 8(7) requires you to erase personal data when consent is withdrawn or the purpose is no longer served, unless a law requires retention. For the classes in the Third Schedule (certain e-commerce entities, social media intermediaries and online gaming intermediaries at or above user thresholds), Rule 8 sets erasure three years after the person last approached you or exercised their rights, with at least 48 hours' notice. The logs that Rule 6 and Rule 8(3) require are a separate category: keep them for their stated purpose and period.
Steps to set up record-keeping
- 01List the records
Start from the table above and add any records your sector regulator requires.
- 02Name an owner per record
Legal for notices and contracts, product for consent, security for logs and breaches, the privacy lead for requests and grievances.
- 03Set retention for each record
Write down how long each record is kept and why, separately from the personal data it describes.
- 04Make records tamper-evident
Keep logs append-only or with change history, so you can show nothing was edited after the event.
- 05Test retrieval
Each quarter, pick a sample person and produce their consent history, the notices they saw and their requests within a working day.
- Records of processing current and reviewed
- All notice versions archived
- Consent events logged per person and purpose
- Request and grievance logs with dates
- Breach log with awareness times
- Security and processing logs kept for at least one year
- Processor contracts on file
- Erasure logs kept
Extra records for Significant Data Fiduciaries
- The notification that designated you, and its date
- DPO appointment and board reporting line (s.10(2)(a))
- Independent data auditor appointment (s.10(2)(b))
- DPIA and data audit every twelve months, and significant observations furnished to the Board (Rule 13)
- Algorithmic due diligence records (Rule 13)
- Where specified personal data and traffic data are kept, if localisation applies (Rule 13)
The SDF self-assessment helps you judge whether to prepare these now.
How TruePrivacy helps
Records of processing syncs processing activities from discovery and exports them. Consent management keeps an event log of every grant, withdrawal, rejection and update, and the audit trail logs every action with before and after values, exportable as CSV.
Retention applies rules per data category, connected system or processing activity, logs each execution and flags items that need a manual purge. Audit, access and consent logs are kept for at least one year (Rule 6, Rule 8(3)).
For SDFs, the SDF workspace holds the designation, DPO, auditor and yearly clocks. Related template: the DPIA template for SDFs.
How long must DPDP logs be kept?
Rule 6 requires logs and personal data to be kept for one year to detect and investigate unauthorised access, unless another law requires otherwise. Rule 8(3) requires personal data, traffic data and logs of processing to be kept for at least one year for the Seventh Schedule purposes.
Who has to prove that consent was given?
The Data Fiduciary. Section 6(10) puts the burden of proving notice and consent on it.
Do we need a record of processing activities?
It is the practical way to show what you process and why, which you need to prove notice and consent (s.6(10)) and to answer access requests (s.11).
Should evidence contain personal data?
Only what is needed. Use masked IDs and references, erase the underlying personal data when the purpose is served (s.8(7)), and keep the logs the Rules require.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin