Evidence
When someone asks what you did, show them the record.
Most DPDP work is done in good faith and proven badly. TrustOS keeps the evidence at the moment the work happens, so a review is answered from records made at the time.
In short
What evidence does TrustOS keep?
A record made at the time for each duty: notice versions and who saw them, consents and withdrawals, each request from receipt to closure, erasure confirmations from each system, breach timelines and the notices sent, and vendor assessments. A review by the Board, an auditor or a customer is answered from those records as an evidence pack.
What is kept
Evidence for each duty, made at the time
Every task in TrustOS closes with its proof attached and linked to the duty it supports. Sample entries below.
| Area | What TrustOS keeps | Sample entry |
|---|---|---|
| Data inventory | Systems, data categories, purposes and owners, with each review and who confirmed it | Loan app reviewed by Karan Joshi, 2 Sep 2026 |
| Notices | Every published version, in each language, with who approved it and when | Notice v5, Hindi, approved by legal on 18 Sep |
| Consent | Tamper evident consent records with the notice version the person saw, the channel and the time | WhatsApp offers withdrawn 10 Oct, 09:14, Privacy Centre |
| Withdrawal | The work created in each system and processor, and each confirmation | 6 of 6 systems confirmed by 10:44 |
| Rights requests | Request, identity check, actions, reply sent and dates, for every channel | REQ-2026-0421 answered on day 3 |
| Grievances | Each grievance, the owner, the response and the time taken against your published period | GRV-2026-0077 closed on day 9 |
| Erasure | The erasure plan, connector logs, processor confirmations, and the reason for anything kept | KYC archive kept under a legal duty to retain |
| Breach response | The incident record from awareness, tasks, findings, intimations sent and the report to the Board | Detailed report filed at hour 61 |
| Processors | Contracts, due diligence, assessments and review dates for each vendor | Payroll vendor review signed off 14 Oct |
Evidence in motion
A withdrawal leaves a confirmation from every system
The evidence for a single withdrawal is the record of the choice, the work created in each system that used it, and each system's confirmation. Sample data.
Answering a review
From the question to a signed pack
- Step 1The question arrivesFrom audit, a partner, the Board or a customer
- Step 2Agree the scopeWhich duty, which period, which products
- Step 3Assemble the packRequests, actions, approvals and logs, indexed
- Step 4Review and sign offThe DPO checks it before it leaves
- Step 5Share and trackRead only access, findings become tasks
Who asks
Six kinds of review, one record behind them
Internal audit
Asks for proof that every erasure in the last six months was completed in all systems. Answered with a pack scoped to erasure requests for the period.
A bank or enterprise partner
Sends a due diligence questionnaire before renewing a contract. Answered with the requirement map, current evidence for each control, and processor reviews.
An independent data auditor
For a Significant Data Fiduciary, the yearly audit. Given read only access to a defined scope for a fixed period, with queries and answers recorded.
The Data Protection Board
Inquires into a complaint or a breach. Answered with the request or incident record, built at the time, and the actions that followed.
A Data Principal's complaint
A customer says their withdrawal was ignored. The consent record, the work created and each system's confirmation answer it in minutes.
Your own board
Wants to know where the programme stands. The quarterly report shows open items, overdue work and audit findings by owner.
Before anyone asks
Gaps show up early, while there is time to fix them
A duty with no recent evidence shows as a gap to its owner. Fixing it months before an audit is cheaper than explaining it during one.
Evidence shows what was done and when. Whether that meets the law is for your legal advisers, auditors and, if it comes to it, the Data Protection Board.
Questions
About evidence and verification
What does verifiable mean for an evidence pack?
Each file in a pack has a hash, a short fingerprint of its contents, listed in a signed index. If a file changes after the pack is issued, its fingerprint no longer matches, and the auditor can see that without trusting whoever sent it.
How long is evidence kept?
You set retention for evidence like any other record. The DPDP Rules ask for certain logs and related data to be kept for at least a year; your counsel may advise longer for some records.
Can an auditor log in?
Yes. You can give an internal or external auditor read only access to a defined scope for a fixed period. What they look at and ask is recorded with the audit.
What about work done before TrustOS?
Older policies, contracts and logs can be uploaded and linked to the duties they support, marked with their original dates so it is clear they were not created in TrustOS.
See it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.