Download an audit pack
One ZIP of your DPDP evidence for an auditor or the Board.
When an auditor, a customer's due-diligence team or the Data Protection Board asks for proof, download one audit pack: your DPDP evidence for a period, in one ZIP.
Program, then Audit & Evidence Locker. Choose a period (last 30 or 90 days, this or last financial year (April to March), or custom dates in India time, both days included), then Download audit pack. Only admins can download it, because it holds the consent ledger and the audit log. Each download is logged and listed under Packs downloaded. The period can be at most 3 years.
What is inside
| Folder | Files |
|---|---|
01-consent | The consent ledger (new consents and re-consents), re-consent campaign results, and webhook deliveries |
02-notices | Privacy notice versions in force in the period, each in full, and the policy library with text |
03-rights | Rights requests and grievances, on time, late or overdue |
04-retention | Retention schedules and deletions done in the period |
05-breaches | The breach register, with Board, CERT-In and people notices |
06-registers | Records of processing and cross-border transfers, as of the export |
07-audit-log | Every recorded action: sign-ins, changes, exports and views |
manifest.json, README.txt, summary.pdf | Each file's row count, size, SHA-256 and description, and a cover page with the period's figures |
Left out on purpose: requesters' emails and messages, webhook payloads, and browsers in the audit log. The consent ledger keeps the person's id because it is the evidence of their consent.
Check a file
Every file's SHA-256 is in the manifest, the README and the summary. Recompute it (shasum -a 256 FILE on macOS and Linux, certutil -hashfile FILE SHA256 on Windows) and compare. A match shows the file is exactly as exported.
An archive over 4 GB is refused, so choose a shorter period.