Your Annual DPDP Review
A new app or supplier may change where customer data goes. Use this review to check the changes and plan the fixes.
What to review
For example, your team may have added a new tool for sending customer messages. Check what data it receives, who can see it and what happens when someone asks you to stop.
Problems to look for
- 1.A new app or supplier is missing from your data list.
- 2.The privacy policy describes a process your team has changed.
- 3.Last year’s fixes were marked done without checking the result.
The Immediate Fix
Ask each team what changed since the last review. Use one customer account and one staff record to check the steps below.
What to check
- Data and apps
- List what personal data you keep, why you need it and where it is stored.
- Customer choices
- Compare the words on your forms with the choices saved in your systems.
- Old records
- Check when each type of record should be deleted and whether deletion works.
- Customer requests
- Check who receives a request, answers it and saves the reply.
- Suppliers
- Check what each supplier can use and how access ends when the contract ends.
- A data leak
- Practise who investigates, calls the legal team and contacts affected people.
- Fixes
- Give each fix a person and a date. Check the result before marking it done.
These are suggested yearly checks. Your legal team can confirm which DPDP and industry rules apply. DPDP Act and its start dates.
Reviewed 5 September 2026.
Get DPDP Updates for Your Annual DPDP Review
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Need help checking your business?
- Start with the free self-check to find questions for your team.
- Our paid gap assessment takes four weeks. We check your apps, documents and records, then list what needs fixing.
- Fixing the agreed gaps takes two to three months. A final assessment checks the completed work.
Save your results and discuss the questions with your team.
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?