Last reviewed: 27 August 2026. Basis: DPDP Act, 2023 and DPDP Rules, 2025 (notified November 2025).
If you hold an ISO 27001:2022 certificate, in our reading you already have most of the reasonable security safeguards that Section 8 of the DPDP Act and the DPDP Rules, 2025 demand, because encryption, access control, logging, backup, processor contracts and incident management all trace to Annex A controls. What ISO 27001 does not give you is the privacy layer: notice, consent, data principal rights, purpose-bound retention, children’s data and Significant Data Fiduciary duties. This page provides an ISO 27001 DPDP mapping table, lists the gaps, explains where ISO 27701 fits, and shows how to run one audit calendar and one evidence set for both. Security obligations become enforceable in May 2027, so the mapping belongs in this financial year.
ISO 27001 vs DPDP: two different questions about the same data
ISO 27001 asks whether information is protected against loss of confidentiality, integrity and availability. The DPDP Act asks whether personal data of individuals is processed lawfully, transparently and only for the purpose it was collected. Security is one obligation among many in the Act, and the Act does not care whether you hold a certificate. It cares whether safeguards were in place and working when something went wrong.
The overlap is real. Section 8(5) obliges every data fiduciary to implement reasonable security safeguards, and the Rules spell out the minimum, which reads like a subset of Annex A. The divergence is scope: ISO 27001 covers whatever you put inside the certified scope, while DPDP covers all digital personal data you process, including systems your Statement of Applicability excluded.
The Schedule sets its highest cap, up to Rs 250 crore, for failure of security safeguards, and up to Rs 200 crore for failure to notify a breach. Our penalties Schedule explainer covers how the Board is expected to weigh gravity, duration and mitigation.
ISO 27001 DPDP mapping: safeguard by safeguard
The table maps each safeguard item in the DPDP Rules to the Annex A controls an auditor would expect evidence for. It is a working mapping, not a legal opinion; one Rule item usually needs several controls behind it.
| DPDP Rules safeguard | What the Rule expects | ISO 27001:2022 Annex A controls | Evidence you likely hold |
|---|---|---|---|
| Encryption, obfuscation, masking or tokenisation | Personal data unreadable to an intruder in storage and transit | A.8.24 (cryptography), A.8.11 (data masking), A.8.12 (data leakage prevention) | Cryptography policy, key management records, TLS baselines |
| Access control | Only authorised persons reach personal data, on a need basis | A.5.15 (access control), A.5.16 (identity management), A.5.18 (access rights), A.8.2 (privileged access), A.8.5 (secure authentication) | Joiner-mover-leaver records, quarterly access reviews, MFA reports |
| Logging and monitoring, logs retained at least one year | Detect, investigate and remediate unauthorised access | A.8.15 (logging), A.8.16 (monitoring), A.8.17 (clock synchronisation) | SIEM retention settings, log source inventory, NTP configuration |
| Backup and continuity | Continue processing and restore data after loss or compromise | A.8.13 (information backup), A.8.14 (redundancy), A.5.29 and A.5.30 (ICT continuity) | Backup schedules, restore test results, DR test reports |
| Contractual measures with processors | Processors engaged only under a valid contract, safeguards flowed down | A.5.19 (supplier relationships), A.5.20 (security in supplier agreements), A.5.21 (ICT supply chain) | Supplier register, security clauses in MSAs, vendor assessments |
| Breach detection, response and notification | Contain the breach, inform the Board and individuals without delay, detailed Board report within 72 hours | A.5.24 to A.5.28 (incident management, assessment, response, learning, evidence), A.5.34 (privacy and protection of PII) | Incident response plan, incident register, tabletop records |
| Organisational measures | Policies, roles, awareness and review that keep the above working | Clauses 5 to 10, A.5.1 (policies), A.5.2 (roles), A.6.3 (awareness) | ISMS manual, management review minutes, internal audit reports |
Two observations from applying this mapping at client sites.
First, the one-year log retention in the Rules is longer than the 180 days most Indian firms configured after the CERT-In Directions of April 2022. Your A.8.15 implementation probably satisfies CERT-In and falls short of DPDP. Change the retention setting, get the storage cost approved, and record the change in your logging standard.
Second, A.5.34 is the only Annex A control that references personal data directly, and it is a one-line requirement to identify and meet applicable privacy obligations. Under DPDP it becomes the hook on which the whole privacy programme hangs, so treat it as a pointer to a separate body of work rather than a control that is implemented because a policy exists.
The DPDP technical safeguards rule and where a certificate is not enough
The DPDP technical safeguards rule sets a floor, and the statute adds the word “reasonable”, which is where the Board’s judgement will come in. A certificate proves controls existed and were audited at a point in time. It does not prove they were applied to the right data. The most common finding in our posture checks is scope mismatch: the ISMS covers the corporate network and the flagship product, while the HR system, the marketing automation platform and the customer support tool, which hold most of the personal data, sit outside it.
The second gap is the processor chain. A.5.19 to A.5.21 require you to manage supplier security, but the Act goes further: a fiduciary may engage a processor only under a valid contract and remains fully responsible regardless of what the processor does. Every vendor touching personal data needs DPDP-specific clauses on purpose limitation, sub-processing, breach support and deletion at exit. Our vendor remediation guide explains how to prioritise the contract backlog by data volume rather than contract value.
The third gap is notification timing. A.5.26 asks you to respond to incidents; the Rules require intimation to affected data principals and the Board without delay, followed by a detailed Board report within 72 hours. Your ISO incident process may have no legal notification workstream, no Board report template and no decision rule for what counts as a personal data breach. Bolt these on to the existing runbook; our 72-hour breach response article sets out the decision tree.
ISMS privacy DPDP gaps: what ISO 27001 leaves open
The obligations below have no Annex A equivalent. An ISMS privacy DPDP extension has to be built, not mapped.
Notice (Section 5). Every consent request must be accompanied or preceded by a notice describing the data, the purpose, how to exercise rights and how to complain to the Board. ISO 27001 says nothing about what you tell individuals. Our Section 5 notice explainer is the drafting standard we use.
Consent (Section 6). Consent must be free, specific, informed, unconditional and unambiguous, with withdrawal as easy as giving it. That is a product and marketing design problem with records to prove it.
Legitimate uses (Section 7). Employment purposes, voluntary provision and other listed uses allow processing without consent, but you must show which basis applies to each activity. That needs a processing inventory, which an ISMS asset register only partly resembles.
Data principal rights (Sections 11 to 14). Access, correction, erasure, grievance redressal and nomination need a workflow, a published response period (the Rules cap it at 90 days), identity verification and a request log. The Your DPDP Rights page sets out what individuals can ask for.
Retention and purpose limitation (Section 8). Personal data must be erased when the purpose is served or consent is withdrawn, subject to legal retention. Specified large fiduciaries face the three-year inactivity erasure rule with 48 hours prior notice. A.5.33 protects records; it does not delete them when purpose ends.
Children (Section 9). Verifiable parental consent for anyone under 18, and no tracking or targeted advertising.
Significant Data Fiduciary duties (Section 10). A DPO based in India, an independent data auditor and periodic DPIAs. An information security officer and ISMS internal audits do not substitute. Run the SDF Classifier to see whether you are likely to be notified.
Each carries its own penalty band, from up to Rs 200 crore for children’s obligations and Rs 150 crore for SDF obligations to Rs 50 crore for the rest. The certificate on the wall does not reduce them.
ISO 27701 India: the privacy extension and whether you need it
ISO 27701 extends ISO 27001 with a privacy information management system. It adds privacy requirements to the management system clauses and two annexes of controls, one for PII controllers and one for PII processors. The controller annex covers exactly the gaps above: conditions for collection and processing, obligations to PII principals, privacy by design and default, and PII sharing and transfer.
For an ISO 27001 India certificate holder, 27701 is the most efficient route to a privacy programme because it reuses your risk methodology, document control, internal audit and management review. You add a privacy risk assessment, a processing inventory, privacy roles and the annex controls, and your certification body audits the combined system in one visit.
Two cautions. ISO 27701 was written with GDPR vocabulary, so translate: PII controller to data fiduciary, PII processor to data processor, PII principal to data principal. DPDP has no legitimate interests basis and no sensitive data categories, and consent plus legitimate uses are its only lawful routes, so several 27701 controls need narrowing. Our DPDP 101 guide summarises the Indian definitions. And 27701 certification is not required by the Act; the Board will treat it as a way of organising the work, not as a defence in itself.
Indicative cost for adding 27701 to an existing 27001 programme in a mid-sized Indian firm is Rs 8 lakh to Rs 25 lakh in advisory and internal effort, plus certification body fees, over four to eight months.
One audit calendar for ISO 27001 and DPDP
Two separate compliance cycles double the interruption to operations and produce findings that contradict each other. Align DPDP work to the ISMS rhythm you already keep.
| Quarter | ISMS activity | DPDP activity aligned to it |
|---|---|---|
| Q1 (April to June) | Risk assessment refresh, SoA review | Processing inventory refresh, DPIA for new high-risk processing, scope check of personal data systems |
| Q2 (July to September) | Internal audit cycle 1, supplier review | Processor contract audit, rights request log review, consent record sampling |
| Q3 (October to December) | Management review, incident tabletop | Breach notification drill including the Board report, retention and erasure evidence check, log retention verification |
| Q4 (January to March) | Surveillance or recertification audit | Annual DPDP review, independent data audit if SDF, training refresh, notice and consent UX review |
Use the Act and Rules Explorer when a control owner asks what the requirement actually says.
Evidence reuse: getting credit twice for the same work
The largest saving in a combined programme is evidence. Certification auditors and an independent data auditor under Section 10 want the same artefacts: a policy, proof it was applied, and proof someone checked. Access review records serve A.5.18 and the access control safeguard. SIEM retention configuration serves A.8.15 and the one-year log rule. Restore test reports serve A.8.13 and the backup safeguard. The supplier register with a clause tracker serves A.5.19 to A.5.22 and the valid-contract requirement. The incident register and post-incident reviews serve A.5.24 to A.5.27 and double as mitigation evidence when the Board determines a penalty.
Tag each evidence item in your GRC tool with both the Annex A reference and the DPDP section or rule, so one upload satisfies both audits. And add personal data fields to your asset register: data categories, purpose, lawful basis, retention period and processors. That turns an ISMS register into a processing inventory at marginal effort, and it is the document the Board will ask for first after a breach. Our DPDP Starter Templates include a processing inventory and processor agreement pack built to sit beside standard ISMS documentation.
Frequently Asked Questions
Does ISO 27001 certification satisfy the DPDP Act’s reasonable security safeguards?
In our reading it goes a long way if the certification scope covers every system holding personal data and the controls match the Rules’ listed items, particularly one-year log retention. It does not satisfy the Act by itself, because the Board will look at whether safeguards actually protected the data, not at the certificate. Notice, consent, rights and retention duties remain entirely outside ISO 27001.
Do we need ISO 27701 to comply with DPDP?
No. The Act does not require any certification. ISO 27701 is a structured way to build the privacy layer on top of an existing ISMS and reuse your audit machinery. Firms with a mature privacy function may prefer to map DPDP obligations directly without certifying.
Our logs are retained for 180 days to meet CERT-In. Is that enough for DPDP?
No. The DPDP Rules, 2025 require logs to be retained for at least one year, while the CERT-In Directions of April 2022 require 180 days within India. Configure retention to the longer period and keep logs in India to satisfy both.
When do the security safeguard obligations become enforceable?
Most substantive obligations, including security safeguards and breach notification, become enforceable 18 months after the Rules were notified in November 2025, which is May 2027. Consent manager provisions come earlier, at 12 months. Starting the mapping now leaves time for a full audit cycle before the deadline.
Related explainers
Next step
If you hold ISO 27001 and want to know precisely how much of the DPDP security bar you already clear, our Cybersecurity Posture Check tests your controls against the DPDP Rules safeguard list, checks scope coverage of personal data systems and returns a prioritised gap list with evidence reuse noted. Book it through Aizzentec services.