FDPPI sets up association to aid compliance with law

Bengaluru: The Federation of Data Protection Professionals of India on Saturday announced the launch of its new division, the Association of Independent Data Auditors of India, aimed at equipping data auditors with the necessary skills and building capacity in India’s data protection ecosystem.

The Digital Personal Data Protection Act (DPDP Act) was passed in 2023, and rules have since been framed. Under the law, which will come into effect in May 2027, companies are mandated to appoint independent data auditors. However, the role and responsibilities of these auditors remain unclear. According to industry observers, this uncertainty could slow implementation and lead to weak compliance, even as firms are expected to strengthen data governance practices — potentially increasing the risk of data breaches and regulatory penalties.

Speaking at the event, FDPPI chairman Vijayashankar Naavi said the effort is focused on preparing for what lies ahead. “We need to create a credible ecosystem of independent data auditors before enforcement gathers pace,” he said.

Any professional, including freshers, can join the community as probationary independent data auditors, he added. “They can learn, associate with others and grow into future independent data auditors.”

Naavi further emphasised that professionals must lead bureaucrats in the effective implementation of auditing frameworks, as they are better equipped to handle data protection. To this end, FDPPI is working towards creating a convergence platform for data auditors, information security auditors and privacy auditors. “AIDAI aims to bring together data audit seekers and providers,” he said.

FDPPI has also developed a framework to provide a jurisprudential interpretation of the DPDP Act, enabling data fiduciaries to work towards “compliance by design”.

The DPDP Act has been challenged in the Supreme Court of India, and petitioners argue that the Act enables excessive State surveillance, compromises the right to information (RTI), and lacks independence in the formation of the Data Protection Board. FDPPI has filed an intervention defending the Act.