Platform · Evidence and audit
Answer an auditor's question with the record, in minutes.
Every task in TrustOS ends with evidence attached, so proof is gathered as the work happens. When an auditor, the board or the Data Protection Board asks, you assemble an evidence pack for a period or a question, and it can be verified cryptographically.
The problem
Audit season means rebuilding the year from inboxes
An insurer's internal auditor asks for proof that every erasure request in the last six months was completed in all systems. The privacy team spends ten days pulling ticket exports, email approvals and screenshots from the CRM, and still cannot show what happened to three requests handled by a person who has since left. The work was done. The proof was never kept in one place.
What the DPDP Act asks
The DPDP Act places accountability on the Data Fiduciary, and the Data Protection Board can inquire into complaints and breaches and ask what was done. Significant Data Fiduciaries must also have a yearly audit by an independent data auditor. In both cases the question is the same: can you show, with records made at the time, that the duty was met.
A plain summary. It is not legal advice. Read the DPDP Act guide.
What it does
What evidence and audit gives your team
Evidence at the point of work
Closing a task asks for its proof: the connector log, the approved notice version, the signed contract or the message sent. Evidence is linked to the requirement it supports, so it is never filed under the wrong heading.
Requirement map
Duties under the DPDP Act and Rules are listed with the controls, owners and evidence that meet them. A gap shows as a requirement with no recent evidence, which is easier to fix in June than in March.
Evidence packs
Pick a period and a scope, such as erasure requests from April to September, and TrustOS assembles the requests, actions, approvals and logs into one pack with an index an auditor can follow.
Verification of packs
Each pack carries cryptographic hashes of its contents. An auditor can check that a file has not changed since the pack was made, without having to trust the person who sent it.
Auditor access
Give an internal or external auditor read only access to a defined scope for a fixed period. Their queries and the answers given are recorded with the audit.
Management reporting
A quarterly view for the board or risk committee shows open requests past due, breaches and their status, overdue processor reviews and audit findings still open, by owner.
How the work moves
Step by step, inside TrustOS
- Step 1Map the dutiesPrivacy and legal list the duties that apply and link each one to controls and owners.
- Step 2Collect as you goTasks across TrustOS close with evidence attached, so the record builds through the year.
- Step 3Spot the gapsRequirements without current evidence are flagged to their owners well before any audit.
- Step 4Build the packFor an audit or an inquiry, choose the scope and period, review the assembled pack and sign it off.
- Step 5Track the findingsAudit observations become tasks with owners and dates, and close with their own evidence.
Records it keeps
The evidence builds as you work
- Requirement and control map with owners
- Evidence items linked to the duty and the task they prove
- Evidence packs with index, hashes and sign off
- Auditor access grants, queries and responses
- Audit findings, actions and closure evidence
- Quarterly management reports as issued
Who uses it
The teams who rely on it most
The first team usually leads the work. The others act on what it assigns.
Questions
About evidence and audit
Does an evidence pack prove we comply with the DPDP Act?
It shows what was done and when, with records made at the time. Whether that meets the law is for your legal advisers, auditors and, if it comes to it, the Data Protection Board to judge.
What does cryptographic verification mean here?
Each file in a pack has a hash, a short fingerprint of its contents, listed in the index. If anyone changes a file after the pack is issued, its fingerprint no longer matches, and the auditor can see that.
Can we bring in evidence from before TrustOS?
Yes. Older policies, contracts and logs can be uploaded and linked to the duties they support, marked with their original dates so it is clear they were not created in TrustOS.
Keep going
Related modules and reading
Module
Rights and grievances
Every request and complaint in one queue, with owners, due dates and a reply on file.
Learn moreModule
Breach response
Run a personal data breach from first alert to Board report with one clock.
Learn moreModule
Processors and assessments
Know which vendors handle your personal data, on what terms, and what could go wrong.
Learn moreGuide
Preparing evidence for review and audit
Management, internal auditors, enterprise customers and the Data Protection Board all ask for evidence, and each wants something different from the same records. Records kept as the work happens let you assemble a package for any of them.
Learn moreArticle
Building DPDP Act compliance that survives an audit
An examiner does not ask whether you have a retention policy. They pick a data category and ask to see proof it was deleted. A programme built in the right order can answer.
Learn moreGuide
Connecting TrustOS to the systems you already run
An erasure that someone says they did is weaker evidence than one the system itself confirms. TrustOS connectors are scoped, approved and checked, and systems without a connector are still covered.
Learn moreSee it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.