Client one-pager, vendor and data protection audit

Vendor data protection audit — what it is and why you need it

What it is. You hold personal data about your customers and employees, and you have given some of it to vendors — a payroll bureau, a call centre, a cloud provider, a marketing agency. Under India's data protection law the responsibility for what those vendors do with that data stays with you: if your vendor loses it, that is your failure in law, not theirs. This engagement checks what each vendor actually holds, how it is protected, who can see it, what happens when something goes wrong, and whether your contract with them says what it needs to say.

Where the law stands today. The data protection Act is in force but its substantive obligations are being switched on in stages — the main set, including the annual assessment and audit duties for larger data handlers, applies from May 2027. What binds you today is the national cyber agency's incident reporting rules, which require reporting within six hours and log retention for 180 days, the existing sensitive-data security rules, your sector regulator's outsourcing rules, and your contracts. We audit against those, and assess your readiness for what is coming.