Mapping DPDP to ISO 27001 and SOC 2: collect evidence once
Reviewed against the law as of 28 September 2026
How DPDP and CERT-In obligations map to ISO 27001:2022, NIST CSF 2.0 and SOC 2, and how to use one control library and one set of evidence.
Indian companies that sell to enterprises often face four sets of expectations at once: the DPDP Act, the CERT-In Directions, and a customer asking for ISO 27001 certification or a SOC 2 report. Treated separately, that is four spreadsheets of evidence. Treated as one control library, most of the work is shared.
Where they overlap
| Control area | DPDP / CERT-In | ISO 27001:2022 Annex A | NIST CSF 2.0 | SOC 2 |
|---|---|---|---|---|
| Asset and data inventory | Know what you hold (supports sections 5, 8, 11) | A.5.9, A.5.12 | ID.AM | CC6.1, C1.1 |
| Access control and MFA | Reasonable security safeguards, section 8(5) | A.5.15 to A.5.18, A.8.2, A.8.5 | PR.AA | CC6.1 to CC6.3 |
| Encryption | Safeguards in the DPDP Rules | A.8.24 | PR.DS | CC6.1, CC6.7 |
| Logging and monitoring | One year (DPDP Rules), 180 days in India (CERT-In) | A.8.15, A.8.16 | DE.CM | CC7.2 |
| Clock synchronisation | NIC or NPL time (CERT-In) | A.8.17 | PR.PS | CC7.2 |
| Backups | Continuity in the DPDP Rules | A.8.13 | PR.DS | A1.2 |
| Vulnerability management | Safeguards against breaches | A.8.8 | ID.RA, PR.PS | CC7.1 |
| Suppliers | Processors under valid contract, section 8(2) | A.5.19 to A.5.22 | GV.SC | CC9.2 |
| Incident response | Board and CERT-In reporting | A.5.24 to A.5.28 | RS.MA, RS.CO | CC7.3 to CC7.5 |
| Retention and deletion | Erasure, section 8(7) | A.5.33, A.8.10 | PR.DS | C1.2, P4.2, P4.3 |
| Privacy of personal data | Most of the Act | A.5.34 | GV.OC | P1 to P8 |
The references index the official standards, which are published by ISO, NIST and the AICPA; read them for the actual requirements.
Where DPDP goes further
Frameworks certify management systems and controls. They do not cover:
- notices in Indian languages and consent that meets section 6;
- Consent Managers;
- the ninety-day response limit for rights requests;
- notifying every personal data breach to the Board and each affected person;
- children's data rules, with the age of eighteen;
- CERT-In's six-hour reporting and log localisation.
Where frameworks go further
ISO 27001 and SOC 2 cover areas the DPDP Act does not spell out: physical security, HR screening and training, change management, capacity planning, and the management system itself (risk assessment, internal audit, management review).
One library, one set of evidence
The efficient approach:
- Define each control once, with a test and the evidence it needs.
- Map it to every obligation it supports, with the strength of the mapping.
- Collect evidence automatically where possible, and hash it.
- Report per framework from the same results, showing gaps where no control exists yet.
TrustNiq works this way: its control library is mapped to the DPDP Act, DPDP Rules and CERT-In Directions, with ISO 27001:2022 Annex A, NIST CSF 2.0 and SOC 2 read from the same results. Requirements with no control show as gaps, never as passes. See pricing.
Frequently asked questions
Does ISO 27001 certification mean we meet the DPDP Act?
No. ISO 27001 covers much of the security safeguards duty, but DPDP also requires notice, consent, rights, breach notification to the Board and individuals, erasure and children's protections, which ISO 27001 does not certify.
Which framework should we start with?
For Indian companies, start with the legal obligations: DPDP and CERT-In. Then add ISO 27001 or SOC 2 if customers require a certificate or report, reusing the same controls.
Sources
- ISO/IEC 27001:2022 (ISO)iso.org
- NIST Cybersecurity Framework 2.0nist.gov
- AICPA SOC 2 resourcesaicpa-cima.com
- Digital Personal Data Protection Act, 2023meity.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.