Does ISO 27001 cover DPDP? Where it overlaps and where it does not

If your business holds ISO/IEC 27001 certification, a fair question is how much of the Digital Personal Data Protection Act, 2023 you have already done. The honest answer is: a useful part of the security work, and very little of the rest. Certification is good evidence of a working security programme. It is not evidence of DPDP compliance, and nothing in the Act or the Rules treats it as such.

Why the two only partly line up

ISO 27001 is a standard for managing information security risk. It asks you to protect the confidentiality, integrity and availability of information, whatever that information is, within a scope you choose. The DPDP Act is a law about how personal data is collected and used. It gives people rights, makes the business answerable for its purposes and its vendors, and applies to all digital personal data the business processes, not only what sits inside a certification scope. The overlap is real where DPDP asks for security. It is thin where DPDP asks about purpose, consent and rights.

Where ISO 27001 helps most

• Security safeguards. Rule 6 of the DPDP Rules lists encryption or masking, access control, logging and monitoring, and backups. The Annex A controls on cryptography (A.8.24), data masking (A.8.11), access control and access rights (A.5.15, A.5.18), logging and monitoring (A.8.15, A.8.16) and backups (A.8.13) usually cover much of this, if they are implemented across every system that holds personal data.
• Incident handling. Incident management planning and response (A.5.24, A.5.26) give you the machinery for handling a breach. DPDP then adds who must be told and how fast.
• Supplier controls. Supplier security and security terms in supplier contracts (A.5.19, A.5.20) are a good base for the processor contracts DPDP requires.
• Legal requirements and privacy. A.5.31 asks you to identify legal requirements, and A.5.34 to protect personal information as the law requires. These controls point towards DPDP but do not do the DPDP work themselves.

What ISO 27001 does not cover

• Notice and consent. An itemised notice at or before collection, consent that is specific and can be withdrawn as easily as it was given, and a record of it (Sections 5 and 6 of the Act, Rule 3).
• Rights of the person. A summary of the data and the processing, the identities of those it was shared with, correction, completion and erasure, nomination, and a grievance route answered within the 90 day limit in Rule 14.
• Breach reporting to people and the Board. ISO 27001 does not require you to notify each affected person and the Data Protection Board. DPDP does, with a detailed report to the Board within 72 hours (Rule 7).
• Retention tied to purpose. Erasing data once its purpose is served (Section 8(7) and Rule 8). The deletion control (A.8.10) helps with how to delete, not with when.
• Children's data. Verifiable parental consent, and no tracking, behavioural monitoring or targeted advertising directed at children (Section 9).
• Published contact and accountability. Contact details for privacy questions (Rule 9) and, for Significant Data Fiduciaries, a Data Protection Officer based in India, an independent data auditor and periodic impact assessments.

Scope is where most surprises sit

A certificate covers a defined scope: perhaps one product, one office or one set of systems. DPDP covers all digital personal data you process, including the HR system, the sales spreadsheets, the support inbox and the marketing tools that often sit outside the certification. The first step in any comparison is to set the certified scope against your full data inventory and mark everything that falls outside it.

Implemented and evidenced, not just listed

A control in your Statement of Applicability is a claim. What counts for DPDP is whether the control actually works for the personal data in question, and whether you can show it. An encryption control that covers production databases but not exported reports, or an access review that exists on paper but not in practice, will not carry the weight a regulator would expect.

Reuse, remediate, add

A practical way to sort the work is into three groups. Reuse the controls that already meet a DPDP requirement across the right scope, with evidence. Remediate the ones that help but fall short, such as a supplier security clause that says nothing about erasure or breach notice. Add what has no counterpart at all: notices, consent records, rights handling, grievance redressal and the route for reporting to the Board. For most certified businesses the first group is larger than expected on security and almost empty on everything else.

What about the GDPR?

If you also comply with the GDPR, the gap is smaller, because the GDPR already has notices, rights, processor contracts and breach reporting. But the details differ. DPDP relies mainly on consent and a short list of legitimate uses rather than the GDPR's six lawful bases, its breach reporting duty has no threshold of seriousness, and its timelines and rules on children are its own. A GDPR programme is a strong starting point, not a finished answer.