Most compliance audits follow the same pattern: an external auditor, a quarterly review cycle, a spreadsheet of findings, and a remediation plan that takes two months to execute. By the time fixes are in place, the underlying data has changed.
Under the DPDPA, this model has a structural problem. The regulation requires ongoing compliance. Purposes can be added or changed at any time. Collection points evolve with product development. Legitimate Interest justifications need to be tested against actual processing activities — not declared once and forgotten.
What AI Insights Does
AI Insights is truConsent's embedded compliance auditing layer, under Audits & Assessments. It runs automated checks across two registries — Purposes and Collection Points — and surfaces issues in real time, not at audit time.
Checks re-run automatically whenever an underlying record is saved or updated. Every result is stored with a timestamp, so the DPO can track how a purpose's compliance status has changed over time and produce evidence of remediation.
Architecture note: AI Insights runs inference in AWS ap-south-1 / ap-southeast-1 — satisfying DPDPA data residency requirements. No data leaves Indian cloud regions.
The Four Checks
Check A — LI Justification Adequacy (Section 7)
Runs on every Purpose where the legal basis is Legitimate Interest. Evaluates the free-text LI justification against a three-part test:
- Purpose Test: Is a specific, concrete legitimate interest articulated? Generic phrases like "business purposes" are insufficient.
- Necessity Test: Is processing demonstrably required for that interest?
- Balancing Test: Does the justification acknowledge the Data Principal's rights?
Scoring is 1–10. Score 7–10 = Satisfactory (green). Score 4–6 = Warning (amber). Score 1–3 = Insufficient (red).
Check B — Data Minimization (Section 6(1))
Runs on every Purpose that has Data Elements linked. Section 6(1) requires that only personal data "as is necessary" for the stated purpose be collected. In practice, purposes accrete data elements over time and no one audits whether each element is still necessary.
Check B evaluates each linked data element for necessity and proportionality. Highly sensitive fields with no clear justification, and elements with generic names (like "field1"), are flagged for immediate DPO review.
Check C — Profile-Based Conversion (Section 6(2))
Runs on all purposes regardless of legal basis. Identifies purposes with behavioural, marketing, or audience-segmentation characteristics that are better served by profile-based consent rather than transactional one-time consent.
A purpose configured as one-time consent but used for recurring behavioural analytics creates a consent validity problem. Check C flags these cases and recommends conversion.
Check D — Purpose Bundling (Section 6)
Runs at the Collection Point level. The DPDPA requires that consent be specific — a Data Principal must be able to consent to each purpose independently. Bundling unrelated purposes into a single collection point undermines this.
Check D evaluates coherence of purposes mapped to each collection point, produces a coherence score (1–10), and recommends which purposes should be split. A "Split Collection Point" action is available directly from the findings screen.
From Periodic Audit to Continuous Compliance
The shift AI Insights enables is posture, not just speed. A DPO can open the AI Insights dashboard at any time and see the current compliance status of every purpose and collection point, filtered by asset, legal basis, or check type.
When a developer adds a new data element, Check B re-runs automatically. When a new LI justification is added, Check A evaluates it immediately. When a product team maps additional purposes to a collection point, Check D assesses the updated set.
AI Insights does not replace DPO judgement — it amplifies it. The platform surfaces the issues; the DPO decides the action. Every AI recommendation is reviewable, every verdict can be overridden, and every decision is logged in the audit trail. Human-in-the-loop by design.
See AI Insights in a live demo — book a truConsent walkthrough