Camera and Microphone Permission Audit
Liability Check
Accessing a user's camera or microphone without rock-solid consent isn't just bad UX; it's a direct pathway to DPDP fines up to ₹250 Crore. These permissions touch the most intimate aspects of personal data – get it wrong, and you're in deep trouble.
Why Camera and Microphone Permission Audit is at Risk
Applications utilizing cameras for **KYC capture**, video calls, or microphones for voice commands and recordings handle some of the most sensitive personal data. Under the DPDP Act, processing **audio-visual data**, especially **biometric information** like facial scans or voice prints, requires explicit, informed, and purpose-specific consent. Storing such data without robust security, clear retention policies, and verifiable deletion protocols exposes your business to monumental risk. The Data Protection Board will scrutinize *how* consent is obtained, *what* data is captured, *where* it's stored, and *when* it's deleted.
Common Violations
- 1.Requesting camera/microphone permissions *before* explaining the exact purpose and necessity to the user.
- 2.Retaining captured video/audio beyond the stated purpose, e.g., storing KYC videos indefinitely after verification.
- 3.Allowing third-party SDKs within your app to access camera/microphone data without explicit user consent.
The Immediate Fix
Conduct an immediate audit of all your app's camera and microphone access points. Map out the full data lifecycle: consent prompt wording, data capture, storage location, processing, and deletion. Ensure every step has a clear, documented legal basis under DPDP.
Get DPDP Updates for Camera and Microphone Permission Audit
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Need help checking your business?
- Start with the free self-check to find questions for your team.
- Our paid gap assessment takes four weeks. We check your apps, documents and records, then list what needs fixing.
- Fixing the agreed gaps takes two to three months. A final assessment checks the completed work.
Save your results and discuss the questions with your team.
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?