Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsCompare
The DPDP Act is a law about personal data. ISO/IEC 27001 is a voluntary standard for managing information security. ISO 27001 helps you meet the security safeguards in Rule 6, but it does not make you compliant with the Act.
Checked against the Act and Rules text on 26 October 2026. Not legal advice.
In short
No. ISO 27001 can carry most of the security floor in Rule 6, but it does not cover the rest of the Act, and no official source treats certification as DPDP compliance.
In force now: the Board provisions and definitions (from 13 November 2025). 13 November 2026: Rule 4 (Consent Managers). 13 May 2027: Rules 3, 5 to 16, 22 and 23, and Sections 3 to 17 of the Act, including Section 8(5), Section 8(6), Section 10, Rule 6, Rule 7 and Rule 13. Some sources count from 14 November 2025, which would make the later dates 14 November 2026 and 14 May 2027. Check the Gazette.
A proposal to shorten the 18-month period to 12 months was reported to have been floated in January 2026. As of 26 October 2026, we found no amending notification. A Lok Sabha answer of 12 August 2026 (Unstarred Question 3960) still places security safeguards and breach notification in the eighteen-month phase, and Consent Managers in the one-year phase.
We found no official notification designating any Significant Data Fiduciary. The Data Protection Board has been constituted but, according to a LiveLaw report of 10 October 2026, has not been made functional, and the Kerala High Court said it expects the Board to be functional within eight weeks. The Removal of Difficulties Order, 2026 (5 October 2026) changes the wording of Sections 9(1) and 10(2)(c)(ii) only.
We found no statement from MeitY or the Board that ISO 27001 certification counts as evidence of DPDP compliance. Re-check before you rely on this.
| Point | DPDP Act 2023 and Rules 2025 | ISO/IEC 27001:2022 |
|---|---|---|
| What it is | An Indian law | A voluntary international management standard |
| Protects | Personal data and the rights of Data Principals | All information assets of the organisation, in any form |
| Core question | Is personal data processed lawfully, fairly and with rights respected? | Does the organisation manage information security risk through an ISMS? |
| Who must comply | Every Data Fiduciary and, through the Fiduciary, its Data Processors | Only organisations that choose to adopt and certify it |
| Checked by | The Data Protection Board, after a complaint or an intimation (s.27) | An accredited certification body, by audit |
| Penalty | Up to Rs 250 crore (s.8(5)) and Rs 200 crore (s.8(6)); other bands in the Schedule | No statutory penalty; the certificate can be lost |
| Named standard | Rule 6 names no ISO or other standard | Not applicable |
| Output | No certificate. Evidence of compliance is your own records | A certificate with a stated scope |
The two overlap on security and diverge almost everywhere else. A law about people's rights over their data cannot be satisfied by a standard about how well an organisation protects its information.
No. An ISO 27001 ISMS can carry most of the security floor in Rule 6. It does not deliver the legal duties around notice, consent, children, rights, grievance, erasure periods or reporting a breach to the Board.
Section 8(5) requires reasonable security safeguards to prevent a personal data breach, including at processors. Rule 6(1) lists the minimum content. The table maps each item to the closest ISO/IEC 27001:2022 Annex A controls.
A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.
| Rule 6(1) item | Closest Annex A controls | Rating | What to add for the DPDP Act |
|---|---|---|---|
| (a) Encryption, obfuscation, masking or virtual tokens | A.8.24, A.8.11, A.5.34 | Covered | Show that every store of personal data is in scope. Document the masking or tokenisation design. |
| (b) Controls on access to computer resources | A.5.15, A.5.16, A.5.17, A.5.18, A.8.2 to A.8.5 | Covered | Include systems run by your processors. |
| (c) Logs, monitoring and review to detect, investigate and remediate unauthorised access | A.8.15, A.8.16, A.8.17, A.5.25 to A.5.27 | Covered | Logs must show who accessed personal data, not only system events. |
| (d) Continued processing if confidentiality, integrity or availability is compromised, such as backups | A.8.13, A.8.14, A.5.29, A.5.30 | Covered | Test restores of personal data, and record the results. |
| (e) Retain logs and personal data for one year, unless another law requires otherwise | A.8.15, A.5.33 | Partly | ISO leaves the retention period to you. Set at least one year and align with Rule 8(3). |
| (f) Contract with each Data Processor that provides for reasonable security safeguards | A.5.19 to A.5.23 | Partly | Add DPDP terms: Rule 6 safeguards, breach cooperation for Rule 7, erasure on instruction (s.8(7)(b)). |
| (g) Appropriate technical and organisational measures to ensure effective observance of the safeguards | Clauses 4 to 10, Annex A | Covered | Make sure the ISMS scope and risk assessment cover personal data processing. |
Control numbers follow ISO/IEC 27001:2022 Annex A, which uses the same numbering as ISO/IEC 27002:2022. We checked them against a published control list, not the paywalled ISO text. Ratings are our reading, not an official view. Verify against your own Statement of Applicability.
A certificate does not tell you which systems are in scope. Read your scope statement and Statement of Applicability. If a system holding personal data sits outside the ISMS scope, Rule 6 still applies to it.
| DPDP duty | Source | ISO 27001 | Why |
|---|---|---|---|
| Reasonable security safeguards | s.8(5), Rule 6 | Covered | Core strength of an ISMS. Gaps are in retention and processor terms |
| Processor contract with safeguards | s.8(2), Rule 6(1)(f) | Partly | Supplier controls exist, but not DPDP-specific terms |
| One-year retention of logs and personal data | Rule 6(1)(e), Rule 8(3) | Partly | ISO does not set periods |
| Breach intimation to the Board and each affected person | s.8(6), Rule 7 | Partly | Incident process yes, regulator and person notices no |
| Erasure and the Third Schedule periods | s.8(7), Rule 8 | Partly | A.8.10 (information deletion) helps, the legal triggers are separate |
| Notice before consent | s.5, Rule 3 | Not covered | Not an ISMS topic |
| Consent, withdrawal, legitimate uses | ss.6, 7, Rule 3 | Not covered | Not an ISMS topic; ISO 27701 helps with records |
| Consent Managers | s.6(7) to 6(9), Rule 4 | Not covered | Registration regime under the Act |
| Accuracy of data used for decisions | s.8(3) | Not covered | Not covered as a duty |
| Contact point and grievance mechanism | s.8(9), 8(10), Rules 9, 14 | Not covered | Not covered |
| Children and persons with disability | s.9, Rules 10 to 12 | Not covered | Verifiable consent and tracking limits are outside ISO 27001 |
| Data Principal rights: access, correction, erasure, nomination | ss.11 to 14 | Not covered | Rights workflows are outside ISO 27001 |
| Transfers outside India | s.16, Rule 15 | Not covered | Not covered |
| Significant Data Fiduciary duties | s.10, Rule 13 | Not covered | DPO, data auditor, DPIA, algorithmic diligence, localisation. See below |
The penalties map the same way. A failure on s.8(5) can reach Rs 250 crore and on s.8(6) Rs 200 crore. Both are duties where an ISMS helps, but only s.8(5) is largely met by it.
| Step | What Rule 7 requires | ISO 27001 closest | Rating |
|---|---|---|---|
| Detect | Know quickly that personal data has been accessed or lost | A.8.15, A.8.16, A.6.8 | Covered |
| Assess and respond | Understand nature, extent, timing and location of the breach | A.5.24 to A.5.27 | Covered |
| Tell each affected person | Without delay, in a concise, clear and plain manner, with consequences, mitigation, safety steps and a contact | No equivalent control | Not covered |
| First notice to the Board | Without delay, describing the breach and its likely impact | No equivalent control | Not covered |
| Detailed report to the Board | Within 72 hours of awareness (or a longer period the Board allows on written request): facts, mitigation, findings on who caused it, remedial measures, report on notices to Data Principals | A.5.28 (evidence collection) helps | Partly |
Add three artefacts to your ISMS incident procedure: a draft Data Principal notice, a Board intimation template, and a 72-hour report template. Record the time you became aware, because the clock starts there.
Read the full rule in the Personal Data Breach explainer. CERT-In's separate 6-hour incident reporting also applies where it covers the incident.
India's earlier data law sits in Section 43A of the IT Act and the 2011 SPDI Rules. Rule 8 of those Rules names a standard. It is the only Indian rule we found that names ISO/IEC 27001.
Rule 8(2) says the international standard IS/ISO/IEC 27001 is one such standard of reasonable security practices.
Rule 8(4) deems an organisation that implements it to have complied with reasonable security practices, if the certification or audit is by an independent auditor approved by the Central Government and is carried out at least once a year or when there is a significant upgrade of processes and computer resources.
We found no separate instrument dealing with the text of the SPDI Rules themselves. Some articles say they are already repealed, and others say they are untouched. Section 44(2) omits Section 43A but does not name the SPDI Rules themselves. Take legal advice on the transition.
Our 2027 compliance roadmap and compliance checklist cover the privacy layer.
A Significant Data Fiduciary has duties under Section 10 and Rule 13 that no ISMS addresses. An ISO audit is not a DPDP data audit.
| Duty | DPDP source | ISO 27001 closest | Difference |
|---|---|---|---|
| Data Protection Officer, based in India, responsible to the board | s.10(2)(a) | ISMS manager or CISO roles | The DPO is a statutory role and the grievance contact. The ISO role is internal |
| Independent data auditor | s.10(2)(b) | Certification body audit | The auditor evaluates compliance with the DPDP Act, not conformity to ISO 27001 |
| Data Protection Impact Assessment | s.10(2)(c)(i), Rule 13(1) | Risk assessment (clause 6.1.2) | DPIA looks at risk to the rights of Data Principals; an ISMS risk assessment looks at risk to the organisation's information |
| Periodic data audit and report to the Board | s.10(2)(c)(ii), Rule 13(1), 13(2) | Internal audit and management review (clauses 9.2, 9.3) | Rule 13 sets at least once in 12 months from notification and a report of significant observations to the Board |
| Algorithmic software due diligence | Rule 13(3) | None | Not an ISMS topic |
| No transfer of specified data outside India | Rule 13(4) | None | Applies to data the Central Government specifies |
As of 26 October 2026 we found no notification designating a Significant Data Fiduciary. See Significant Data Fiduciary and Data Protection Officer.
ISO/IEC 27701 is the privacy information management standard. The 2019 edition was an extension to ISO 27001. The 2025 edition, published on 14 October 2025, is, according to ISO, an independent management system standard, so ISO 27001 certification is not a prerequisite.
| Point | ISO/IEC 27001 | ISO/IEC 27701:2025 | DPDP Act |
|---|---|---|---|
| Subject | Information security | Privacy information management for PII controllers and processors | Personal data processing and rights |
| Helps with | Rule 6 safeguards | Records of processing, consent records, rights handling, processor oversight | Legal duties, in full |
| Certificate | Yes | Yes | None exists |
| Same as legal compliance? | No | No | Not applicable |
27701 helps you organise privacy work, but we found no DPDP mapping annex in the standard, and a certificate does not decide what the Board will accept. See our note on DPDP compliance certification.
The proposal to shorten the runway to 12 months is not in force. Plan to the notified dates and watch for an amending notification.
| Claim you may hear | What the sources show |
|---|---|
| “We are ISO 27001 certified, so we are DPDP compliant.” | No. The Act has duties on notice, consent, rights and reporting that ISO 27001 does not address. |
| “The DPDP Act requires ISO 27001.” | No. Rule 6 names no standard. |
| “ISO 27001 is evidence of reasonable safeguards, so the Board must accept it.” | We found no official statement to that effect. Treat a certificate as supporting evidence only, and keep your own records. |
| “Report the breach within 72 hours of the breach.” | The 72-hour report runs from when you become aware. A first notice is due without delay. |
| “The SPDI Rules are already repealed.” | Section 43A is omitted only when Section 44(2) commences. Take advice on the transition. |
| “ISO 27701 is only an add-on to ISO 27001.” | That was true of the 2019 edition. The 2025 edition is standalone. |
| “Safeguards breaches cost Rs 200 crore.” | The Schedule sets Rs 250 crore for s.8(5) and Rs 200 crore for s.8(6). |
No. Rule 6 sets its own minimum safeguards and names no standard.
No. It can support your case on security safeguards, but it does not address notice, consent, rights, grievance or breach reporting, and we found no official statement that the Board treats it as proof.
It can cover most of Rule 6(1) if personal data systems and processors are in scope. Items (e) one-year retention and (f) processor contract terms usually need extra work.
It helps with privacy governance, records and rights handling, but it is not legal compliance, and we found no DPDP mapping annex in the standard.
No. ISO sets no regulator or victim notification deadline. Rule 7 requires notice to each affected person and the Board without delay, and a detailed report to the Board within 72 hours of awareness.
The deemed-compliance route in SPDI Rule 8(4) depends on Section 43A, which the DPDP Act omits when Section 44(2) commences on 13 May 2027. DPDP Rule 6 has no equivalent.
No. They must appoint a Data Protection Officer and an independent data auditor, and carry out a DPIA and audit under Section 10 and Rule 13.
We found none. Compliance is shown by your own records and, if needed, to the Board. See our note on DPDP compliance certification.
A.8.15 (logging) and A.8.16 (monitoring) map to Rule 6(1)(c). Rule 6(1)(e) also requires logs to be kept for one year, which ISO leaves to you.
This page explains the law in plain language and is not legal advice. Where a point depends on facts, take advice from a qualified Indian lawyer. Ratings and items marked as practice are our reading and suggestions, not requirements of the Act or Rules.
Newsletter
Know what changed. Know what to do next.
Practical updates on India's DPDP Act: important regulatory developments, implementation priorities and tools you can use at work.
Consultant-led and partner-backed.