Digital Personal Data Protection Act (DPDPA), 2023 & ISO 27001:2022 (ISMS)
The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first comprehensive law dedicated to the privacy of digital personal data. Enacted on 11 August 2023, it establishes a framework for processing personal data while balancing individual privacy rights with the necessity of lawful data usage.
The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, marking the full operationalisation of the Act with a phased compliance timeline extending to 13 May 2027.
Mapping
the Digital Personal Data Protection Act (DPDPA), 2023 (India's primary
data protection law) with ISO 27001:2022 (the international standard for
Information Security Management Systems) reveals a powerful synergy.
The DPDPA sets the legal "what" and "why" for personal data protection, while ISO 27001 provides the systematic "how" to implement security controls.
Here is a detailed mapping of key DPDPA obligations to relevant ISO 27001:2022 clauses and controls.
Foundational Overlap: Principles & Framework
|
Concept |
DPDPA 2023 |
ISO 27001:2022 |
Synergy |
|
Accountability |
Section 8(4): Data Fiduciary is
responsible for compliance. |
Clause 5.1: Leadership must ensure and
be accountable for the ISMS. |
ISO 27001's management framework
operationalizes DPDPA accountability. |
|
Lawful Basis |
Section 6: Requires consent or
legitimate uses for processing. |
A.5.34: Privacy and protection of PII -
Requires implementing controls for handling PII per legal requirements. |
ISO 27001 controls help enforce lawful
processing rules. |
|
Purpose Limitation |
Section 5: Personal data to be used
only for specified, lawful purpose. |
A.5.10: Acceptance of use policies
& A.5.33: Protection of records ensure data use is controlled and logged. |
— |
Mapping
of Key DPDPA Provisions to ISO 27001
|
DPDPA Section & Obligation |
ISO 27001:2022 Clause / Control |
Explanation & Implementation
Guidance |
|
Data Principal Rights (Ch. II) Right to access, correction, erasure,
grievance redressal. |
A.5.3: Contact with authorities A.5.35: Responding to PII requests A.8.3: Information access restriction A.8.10: Information deletion. |
ISO 27001 mandates processes for
handling requests from data subjects (termed "PII principals") and
ensuring data can be accessed, corrected, and deleted securely as per policy. |
|
Data Fiduciary Duties (S.8) 1. Security Safeguards (S.8(5)) 2. Breach Notification (S.8(6)) 3. Appointment of DPO (S.8(7)) |
A.5.7: Threat intelligence A.5.5: Information security roles (DPO). Clause 6: Planning to address risks
& opportunities. A.5.24: ICT readiness for business
continuity. A.5.26: Response to information
security incidents. A.5.27: Learning from incidents. A.5.31: Identification of documented
information. |
Security: ISO
27001's Annex A is a comprehensive control set for security (encryption,
access control, etc.). Breach: Incident
management process (A.5.26, A.5.27) directly supports breach identification,
assessment, and notification. DPO: The standard
requires defining relevant security roles and responsibilities. |
|
Consent & Notice (S.5, S.6) Valid consent, clear notice in simple
language. |
A.5.12: Classification of information
(to identify PII). A.5.34: Privacy and protection of PII
(requires notifying purpose of use). A.5.10: Acceptance of use policies. |
Data classification is the first step
to identify what needs consent. A.5.34 explicitly requires controls for
obtaining consent, providing notice, and allowing data subject choice. |
|
Data Processor Duties (S.9) Processor must follow fiduciary's
instructions. |
A.5.19: Orderly removal of
assets. A.5.20: Addressing security in
agreements. A.5.21: Managing information security
in the ICT supply chain. A.5.22: Monitoring, review, and change
management of supplier services. |
ISO 27001's supplier security controls
ensure processors are bound by contracts (A.5.20) and their performance is
monitored (A.5.22). This fulfills the fiduciary's duty to ensure
processor compliance. |
|
Significant
Data Fiduciary (S.10) Additional obligations: DPO, Data Protection Impact Assessment
(DPIA), Audit, etc. |
Clause 6.1.2: Information security risk
assessment (includes privacy risks). A.5.5: Information security roles
(DPO). A.5.28: Collection of evidence (for
audits). Clause 9.2: Internal audit. Clause 9.3: Management review. |
The risk assessment process in ISO
27001 must include privacy risks, effectively constituting a DPIA. The
standard's mandates for internal audit, management review, and defined roles
perfectly align with SDF obligations. |
|
Transfer
Restrictions (S.16) Cross-border transfer to notified countries. |
A.5.20: Addressing security in
agreements. A.5.21: ICT supply chain
security. A.5.33: Protection of records. |
Supplier and contractual controls
(A.5.20, A.5.21) are critical for ensuring equivalent protection when data is
transferred internationally. |
How ISO
27001:2022 Supports DPDPA Compliance: A Framework View
1. Risk-Based Approach: Both are risk-based. ISO 27001's Clause 6.1 (risk assessment) is the engine for identifying risks to personal data confidentiality, integrity, and availability, forming the basis for all controls.
2. PDCA Cycle: ISO 27001's Plan-Do-Check-Act model
provides a continuous improvement framework for a DPDPA compliance program.
Plan: Establish context, leadership
commitment, and assess risks (DPIA).
Do: Implement controls (security, consent mgmt., process for
rights).
Check: Monitor via audits (Clause 9.2) and
measure effectiveness.
Act: Take corrective action from breaches, audits, or changes in law.
3. Documented Information: ISO 27001 requires maintaining records (policies, procedures, logs) which serve as evidence of compliance for the Data Protection Board under the DPDPA.
4. Integrated Implementation: Instead of building separate silos, organizations can integrate DPDPA requirements into their existing ISO 27001 ISMS. This is efficient and effective.
Key
Gaps & Considerations
•
Scope:
ISO 27001 covers all
information security, not just personal data. The organization must scope
and prioritize controls (like A.5.34) for PII within the ISMS.
•
Legal
Specifics: ISO 27001
does not specify the exact wording for consent or notice (that's DPDPA's
domain). It provides the control framework to implement them.
• Penalties & Board Orders: ISO 27001 is a management standard, not a law. It helps prevent breaches but does not address legal penalties from the DPDPB.
Compliance checklist for a CCTV network
This compliance checklist integrates the legal requirements of India’s Digital Personal Data Protection (DPDP) Act, 2023 with the technical and operational controls of ISO/IEC 27001:2022 (specifically Control A.7.4).
1. Governance & Transparency (DPDPA 2023 / ISO
Control A.5.1)
·
Purpose
Specification: Clearly
document why the CCTV is being used (e.g., security, operational safety, or
crime prevention). Using footage for undisclosed "profiling" or
"tracking" is prohibited.
·
Visible
Signage: Install
clear, visible notices at all entry points. These must be in English and
the relevant local language (from the Eighth Schedule of the
Constitution).
·
Privacy
Notice Details: Ensure
the notice contains:
o The specific personal data collected
(e.g., facial images/biometrics).
o How individuals can exercise their rights (access, correction, erasure).
2.
Operational Security (ISO Control A.7.4 & A.8.16)
·
Comprehensive
Coverage: Conduct
a risk assessment to identify high-priority areas and eliminate "blind
spots" without encroaching on private areas like restrooms or changing
rooms.
·
Access
Control (ISO A.5.18): Restrict
live feeds and recorded footage access to authorized personnel only.
Implement Multi-Factor Authentication (MFA) for digital access to
NVR/DVR systems.
·
Device
Health Monitoring: Regularly
test and document that cameras, sensors, and alarms are functional. Auditors
will look for maintenance logs and evidence of "active" monitoring
rather than just hardware presence.
· Encryption: Secure all data in transit (camera to server) and at rest (stored footage) using robust encryption standards.
3. Data Retention & Deletion (DPDPA 2023 / ISO
Control A.8.10)
·
Specific
Retention Period: Define
a clear retention cycle—commonly 30 to 90 days—unless needed for an
active investigation. Keeping footage "indefinitely" without a legal
reason is a violation.
·
Automated
Deletion: Implement
automated "purge" mechanisms to ensure data is deleted once the
retention period ends or the purpose is served.
· Chain of Custody: If footage is shared with law enforcement, maintain a secure, timestamped log of the transfer to fulfill "Accountability" requirements
4.
Incident & Breach Management (ISO Control A.5.24)
·
Breach
Detection: Establish
a Security Operations Centre (SOC) or team to monitor for
unauthorized access to video feeds.
· Mandatory Notification: In the event of a data leak (e.g., footage leaked online), you must notify the Data Protection Board (DPB) and affected individuals without undue delay (within 72 hours as per draft rules)
5.
Specialized Requirements
·
STQC
Certification: Ensure
CCTV cameras have mandatory STQC certification as required under
Indian surveillance standards.
· Parental Consent: If surveillance is primarily targeted at children (e.g., in schools), verifiable consent from a parent or guardian is required, and any processing harmful to the child's well-being is strictly prohibited.
Compliance
checklist for a ACCESS CONTROL network
Implementing network-connected Access Control Systems (ACS)—such as biometric scanners, RFID badge readers, and smart locks—introduces major compliance liabilities. Because an ACS processes highly sensitive personal data (including fingerprints, facial geometry, and real-time physical tracking logs), it must be heavily guarded under DPDPA, 2023 and ISO 27001:2022.
1.
Regulatory & Privacy Checklist (DPDPA Alignment)
Biometric
data is classified as sensitive data, requiring the highest standard of user
consent and data minimization.
·
Explicit
Consent Architecture:
Obtain explicit, written, or digital consent before capturing biometrics
(fingerprints or facial scans).
·
Alternative
Access Provision:
Offer a non-biometric alternative (like a PIN code or RFID card) if an
individual refuses biometric enrollment.
·
Clear
Purpose Specification:
Provide a written privacy notice detailing exactly why access logs are kept and
who can view them.
·
Strict
Access Log Retention:
Automatically purge routine movement logs after a defined period (e.g., 90
days) unless legally required.
·
Data
Principal Erasure:
Establish a clear process to permanently wipe an employee's biometric templates
from all readers immediately upon separation.
· Third-Party Processor Agreements: Sign strict data processing contracts if using a third-party cloud-based access control vendor.
2. Data
& Cyber Security Checklist (ISO 27001 Alignment)
This
section ensures the access control software, controllers, and reader networks
cannot be intercepted or hacked.
·
Network
Segmentation: Place
all IP-based door controllers and management servers on a dedicated, isolated
VLAN away from corporate data.
·
Encrypted
Device Communications:
Ensure reader-to-controller communication uses secure protocols (like OSDP)
instead of vulnerable legacy Wiegand wiring.
·
Template
Encryption: Verify
that biometric data is stored only as irreversible cryptographic hashes, never
as raw fingerprint or facial images.
·
Server
Access Security:
Enforce Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC)
for the ACS management software dashboard.
·
API
Security & Integrity:
Encrypt and authenticate all API connections between the ACS and secondary
systems like HR payroll.
· Firmware Vulnerability Management: Run automated monthly checks to patch vulnerabilities on edge controllers and readers.
3.
Physical & Operational Security Checklist
This
section protects the physical infrastructure supporting the electronic access
environment.
·
Tamper-Evident
Enclosures: Lock all
master control panels inside a secure, monitored server room or restricted IT
closet.
·
Fail-Safe
vs. Fail-Secure Mapping:
Configure doors to unlock automatically during fire alarms (fail-safe) but
remain locked during power cuts (fail-secure).
·
Independent
Power Redundancy:
Backup the entire ACS network with central UPS units and dedicated local
batteries inside controller enclosures.
·
Tamper
Alerts Enabled:
Configure the system to trigger immediate silent IT/Security alerts if a reader
housing is physically pried open.
·
Regular
Hardware Audits:
Conduct quarterly physical inspections to check for card cloning
vulnerabilities or physical door bypass risks.
Conclusion
An ISO 27001:2022 certified ISMS is a robust, evidence-ready foundation for complying with the security and procedural mandates of the DPDP Act 2023. Organizations can leverage their ISMS to:
• Fulfil the security safeguards obligation.
• Systematically manage consent, rights, and breaches.
• Conduct DPIAs as part of risk assessment.
• Manage processors through supplier controls.
• Demonstrate accountability and due diligence to regulators.
Treat the DPDPA as the legal requirement and ISO 27001 as the operational blueprint to build a resilient, compliant, and trustworthy data protection regime.
