ISO 27001 in India
What an ISMS does for your DPDP security duty, and what it does not
The Digital Personal Data Protection Act, 2023 (DPDP Act) asks every data fiduciary to protect personal data with reasonable security safeguards. An information security management system (ISMS) built to ISO 27001 is a strong way to run that duty and to keep the evidence. It is not a DPDP programme. Consent, notices and rights sit outside it.
Back to ISO 27001 services01 · The duty
One duty the ISMS was built for
Protect personal data you hold or control, including what processors handle.
Section 8(5) of the Act puts the duty on the data fiduciary: put reasonable security safeguards in place so that a personal data breach is prevented, covering data in its possession or under its control, including processing done by a data processor on its behalf. Section 8(6) then deals with a breach that has happened: the Board (formally the Data Protection Board of India) and the affected people must be told.
That is the part of the law an ISMS fits. Risk assessment, controls, supplier management and incident handling are what ISO 27001 organises. Our guide to the safeguards duty explains it in full; this page is about how the ISMS carries it.
02 · What the Rules list
The measures the Rules name
A minimum set, not a full security programme.
- Protecting the data itselfMeasures such as encryption, obfuscation, masking or virtual tokens.
- Controlling accessAccess controls on the computer resources that hold personal data.
- Seeing what happensLogs, monitoring and review to detect and investigate unauthorised access.
- Keeping service goingMeasures such as backups so processing can continue after a compromise.
- Keeping the recordsRetaining logs and related data for a set period, reported as one year, for detection and investigation.
- Binding processorsContract terms that require processors to take reasonable safeguards.
- Organisational measuresAppropriate technical and organisational measures to make the safeguards work.
03 · Mapping
Safeguards mapped to Annex A
Each measure has a home in the ISMS, and a record to show.
| Measure in the Rules | Annex A controls | Evidence the ISMS produces | Gap to watch |
|---|---|---|---|
| Encryption, masking, tokens | 8.24 Use of cryptography; 8.11 Data masking | Crypto standard, key inventory, masking in test data | Personal data in logs and exports left in clear |
| Access control | 5.15 Access control; 5.18 Access rights; 8.2 Privileged access rights; 8.5 Secure authentication | Access reviews, joiner and leaver records | Support tools with broad read access |
| Logs and monitoring | 8.15 Logging; 8.16 Monitoring activities | Log sources list, alert review records | Retention set shorter than the Rules' period |
| Continuity and backups | 8.13 Information backup; 5.30 ICT readiness for business continuity | Restore tests, recovery objectives | Backups that keep data past its erasure date |
| Processor contracts | 5.19 to 5.22 supplier controls | Supplier register, signed terms, reviews | Processors with no security clause at all |
| Knowing where personal data is | 5.9 Inventory of information; 5.12 Classification; 5.34 Privacy and protection of PII | Asset register flagging personal data | Shadow copies in spreadsheets and SaaS tools |
| Breach readiness | 5.24 to 5.28 incident controls | Incident procedure, exercise records | No step that asks whether personal data was involved |
The ISMS only carries the duty for what is in its scope. If personal data lives in systems outside the scope, the mapping above does not reach it.
04 · Not covered
What an ISMS does not cover
Most of the Act is about fairness to people, not security.
An ISMS can evidence
- Safeguards chosen from a risk assessment
- Controls that run and are reviewed
- Supplier and processor security
- An incident process that can feed breach intimation
The Act still requires
- Valid consent or a legitimate use for each purpose
- Notices in the form the Rules set
- Honouring data principal rights to access, correct and erase data, plus grievance redressal
- Verifiable parental consent for children's data
- Erasure when the purpose ends
- Breach intimation to the Board and to people, in the form the Rules set
Board reporting here means the Data Protection Board, not your company board. ISO/IEC 27701 extends an ISMS into privacy management, but even that does not make a programme compliant by itself.
05 · Scoping for DPDP
Shaping the ISMS so it carries the duty
Small changes make the ISMS useful for DPDP evidence.
- Scope covers personal data. Every system that holds customer or employee personal data is inside, or the gap is recorded.
- Harm to people in the risk method. Rate impact on data principals, not only on the business.
- The Act in the legal register. Under 5.31, assigned to a named owner and given a review date tied to the Rules' phase-in.
- Processors marked in the supplier register. So contract terms and reviews follow the DPDP role.
- Incident triage asks the DPDP question. Was personal data affected? If so, start the breach path.
- Telling the Board you are certified. A certificate is evidence of a system. The Act asks whether safeguards were reasonable for this data.
- Scope set for a customer, not for data. An ISMS scoped to one product may leave HR and support data outside.
- Retention that conflicts. Security wants long logs; the Act wants data gone when its purpose ends. Decide both on purpose.
- Reasonable security safeguards, in practiceWhat the duty asks, and how ISO 27001 and SOC 2 evidence it.
- The DPDP Act, 2023 in plain wordsWho it covers, the key terms, and how the law is laid out.
Sources: the Digital Personal Data Protection Act, 2023; the Digital Personal Data Protection Rules, 2025 (MeitY notification), at the level noted in the review flags; ISO/IEC 27001:2022 Annex A control titles, described in our own words.
Questions about ISO 27001 and DPDP
Does ISO 27001 make us DPDP compliant?
No. It can evidence the security duty only.
ISO 27001 can show you run reasonable security safeguards for data in scope. Consent, notices, rights, children's data, retention and breach intimation are separate duties that the Act sets and the ISMS does not test.
Is there a DPDP certificate?
No. The Act does not create one.
There is no DPDP certification. Some fiduciaries face audits if notified as significant data fiduciaries. Evidence from an ISMS can support those, but it does not replace them.
Should we add ISO 27701?
Worth considering if privacy evidence matters to buyers.
ISO/IEC 27701 adds privacy management to an ISMS and helps organise consent, rights and processor work. It still has to be mapped to the Act's own requirements, which differ in places.
Do processors need their own ISMS?
The Act binds the fiduciary; contracts bind the processor.
The fiduciary stays responsible for safeguards over data processors handle. Many fiduciaries ask processors for ISO 27001 or SOC 2 evidence as part of supplier review.
Use the ISMS you have as DPDP evidence.
An ISO 27001 gap analysis maps your controls to the safeguards duty and lists the DPDP work that sits outside them. Counsel should confirm how the Act applies to your contracts.