DPDPA 2023 & ISO 27001 2022

Digital Personal Data Protection Act (DPDPA), 2023 & ISO 27001:2022 (ISMS) 

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first comprehensive law dedicated to the privacy of digital personal data. Enacted on 11 August 2023, it establishes a framework for processing personal data while balancing individual privacy rights with the necessity of lawful data usage. 

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, marking the full operationalisation of the Act with a phased compliance timeline extending to 13 May 2027.

Mapping the Digital Personal Data Protection Act (DPDPA), 2023 (India's primary data protection law) with ISO 27001:2022 (the international standard for Information Security Management Systems) reveals a powerful synergy.

The DPDPA sets the legal "what" and "why" for personal data protection, while ISO 27001 provides the systematic "how" to implement security controls.

Here is a detailed mapping of key DPDPA obligations to relevant ISO 27001:2022 clauses and controls.

Foundational Overlap: Principles & Framework

Concept	DPDPA 2023	ISO 27001:2022	Synergy
Accountability	Section 8(4): Data Fiduciary is responsible for compliance.	Clause 5.1: Leadership must ensure and be accountable for the ISMS.	ISO 27001's management framework operationalizes DPDPA accountability.
Lawful Basis	Section 6: Requires consent or legitimate uses for processing.	A.5.34: Privacy and protection of PII - Requires implementing controls for handling PII per legal requirements.	ISO 27001 controls help enforce lawful processing rules.
Purpose Limitation	Section 5: Personal data to be used only for specified, lawful purpose.	A.5.10: Acceptance of use policies & A.5.33: Protection of records ensure data use is controlled and logged.	—

Mapping of Key DPDPA Provisions to ISO 27001

DPDPA Section & Obligation	ISO 27001:2022 Clause / Control	Explanation & Implementation Guidance
Data Principal Rights (Ch. II) Right to access, correction, erasure, grievance redressal.	A.5.3: Contact with authorities A.5.35: Responding to PII requests A.8.3: Information access restriction A.8.10: Information deletion.	ISO 27001 mandates processes for handling requests from data subjects (termed "PII principals") and ensuring data can be accessed, corrected, and deleted securely as per policy.
Data Fiduciary Duties (S.8) 1. Security Safeguards (S.8(5)) 2. Breach Notification (S.8(6)) 3. Appointment of DPO (S.8(7))	A.5.7: Threat intelligence A.5.5: Information security roles (DPO). Clause 6: Planning to address risks & opportunities. A.5.24: ICT readiness for business continuity. A.5.26: Response to information security incidents. A.5.27: Learning from incidents. A.5.31: Identification of documented information.	Security: ISO 27001's Annex A is a comprehensive control set for security (encryption, access control, etc.). Breach: Incident management process (A.5.26, A.5.27) directly supports breach identification, assessment, and notification. DPO: The standard requires defining relevant security roles and responsibilities.
Consent & Notice (S.5, S.6) Valid consent, clear notice in simple language.	A.5.12: Classification of information (to identify PII).  A.5.34: Privacy and protection of PII (requires notifying purpose of use).  A.5.10: Acceptance of use policies.	Data classification is the first step to identify what needs consent. A.5.34 explicitly requires controls for obtaining consent, providing notice, and allowing data subject choice.
Data Processor Duties (S.9) Processor must follow fiduciary's instructions.	A.5.19: Orderly removal of assets.  A.5.20: Addressing security in agreements.  A.5.21: Managing information security in the ICT supply chain.  A.5.22: Monitoring, review, and change management of supplier services.	ISO 27001's supplier security controls ensure processors are bound by contracts (A.5.20) and their performance is monitored (A.5.22). This fulfills the fiduciary's duty to ensure processor compliance.
Significant Data Fiduciary (S.10) Additional obligations: DPO, Data Protection Impact Assessment (DPIA), Audit, etc.	Clause 6.1.2: Information security risk assessment (includes privacy risks).  A.5.5: Information security roles (DPO).  A.5.28: Collection of evidence (for audits).  Clause 9.2: Internal audit.  Clause 9.3: Management review.	The risk assessment process in ISO 27001 must include privacy risks, effectively constituting a DPIA. The standard's mandates for internal audit, management review, and defined roles perfectly align with SDF obligations.
Transfer Restrictions (S.16) Cross-border transfer to notified countries.	A.5.20: Addressing security in agreements.  A.5.21: ICT supply chain security.  A.5.33: Protection of records.	Supplier and contractual controls (A.5.20, A.5.21) are critical for ensuring equivalent protection when data is transferred internationally.

How ISO 27001:2022 Supports DPDPA Compliance: A Framework View

1.           Risk-Based Approach: Both are risk-based. ISO 27001's Clause 6.1 (risk assessment) is the engine for identifying risks to personal data confidentiality, integrity, and availability, forming the basis for all controls.

2. PDCA Cycle: ISO 27001's Plan-Do-Check-Act model provides a continuous improvement framework for a DPDPA compliance program.

Plan: Establish context, leadership commitment, and assess risks (DPIA).

Do: Implement controls (security, consent mgmt., process for rights).

Check: Monitor via audits (Clause 9.2) and measure effectiveness.

Act: Take corrective action from breaches, audits, or changes in law.

3. Documented Information: ISO 27001 requires maintaining records (policies, procedures, logs) which serve as evidence of compliance for the Data Protection Board under the DPDPA.

4. Integrated Implementation: Instead of building separate silos, organizations can integrate DPDPA requirements into their existing ISO 27001 ISMS. This is efficient and effective.

Key Gaps & Considerations

•             Scope: ISO 27001 covers all information security, not just personal data. The organization must scope and prioritize controls (like A.5.34) for PII within the ISMS.

•             Legal Specifics: ISO 27001 does not specify the exact wording for consent or notice (that's DPDPA's domain). It provides the control framework to implement them.

•             Penalties & Board Orders: ISO 27001 is a management standard, not a law. It helps prevent breaches but does not address legal penalties from the DPDPB.

Compliance checklist for a CCTV network

This compliance checklist integrates the legal requirements of India’s Digital Personal Data Protection (DPDP) Act, 2023 with the technical and operational controls of ISO/IEC 27001:2022 (specifically Control A.7.4).

1. Governance & Transparency (DPDPA 2023 / ISO Control A.5.1)

·        Purpose Specification: Clearly document why the CCTV is being used (e.g., security, operational safety, or crime prevention). Using footage for undisclosed "profiling" or "tracking" is prohibited.

·        Visible Signage: Install clear, visible notices at all entry points. These must be in English and the relevant local language (from the Eighth Schedule of the Constitution).

·        Privacy Notice Details: Ensure the notice contains:

o   The specific personal data collected (e.g., facial images/biometrics).

o   How individuals can exercise their rights (access, correction, erasure).

2. Operational Security (ISO Control A.7.4 & A.8.16)

·        Comprehensive Coverage: Conduct a risk assessment to identify high-priority areas and eliminate "blind spots" without encroaching on private areas like restrooms or changing rooms.

·        Access Control (ISO A.5.18): Restrict live feeds and recorded footage access to authorized personnel only. Implement Multi-Factor Authentication (MFA) for digital access to NVR/DVR systems.

·        Device Health Monitoring: Regularly test and document that cameras, sensors, and alarms are functional. Auditors will look for maintenance logs and evidence of "active" monitoring rather than just hardware presence.

·        Encryption: Secure all data in transit (camera to server) and at rest (stored footage) using robust encryption standards.

3. Data Retention & Deletion (DPDPA 2023 / ISO Control A.8.10)

·        Specific Retention Period: Define a clear retention cycle—commonly 30 to 90 days—unless needed for an active investigation. Keeping footage "indefinitely" without a legal reason is a violation.

·        Automated Deletion: Implement automated "purge" mechanisms to ensure data is deleted once the retention period ends or the purpose is served.

·        Chain of Custody: If footage is shared with law enforcement, maintain a secure, timestamped log of the transfer to fulfill "Accountability" requirements

4. Incident & Breach Management (ISO Control A.5.24)

·        Breach Detection: Establish a Security Operations Centre (SOC) or team to monitor for unauthorized access to video feeds.

·        Mandatory Notification: In the event of a data leak (e.g., footage leaked online), you must notify the Data Protection Board (DPB) and affected individuals without undue delay (within 72 hours as per draft rules)

5. Specialized Requirements

·        STQC Certification: Ensure CCTV cameras have mandatory STQC certification as required under Indian surveillance standards.

·        Parental Consent: If surveillance is primarily targeted at children (e.g., in schools), verifiable consent from a parent or guardian is required, and any processing harmful to the child's well-being is strictly prohibited.

Compliance checklist for a ACCESS CONTROL network

Implementing network-connected Access Control Systems (ACS)—such as biometric scanners, RFID badge readers, and smart locks—introduces major compliance liabilities. Because an ACS processes highly sensitive personal data (including fingerprints, facial geometry, and real-time physical tracking logs), it must be heavily guarded under DPDPA, 2023 and ISO 27001:2022.

1. Regulatory & Privacy Checklist (DPDPA Alignment)

Biometric data is classified as sensitive data, requiring the highest standard of user consent and data minimization.

·        Explicit Consent Architecture: Obtain explicit, written, or digital consent before capturing biometrics (fingerprints or facial scans).

·        Alternative Access Provision: Offer a non-biometric alternative (like a PIN code or RFID card) if an individual refuses biometric enrollment.

·        Clear Purpose Specification: Provide a written privacy notice detailing exactly why access logs are kept and who can view them.

·        Strict Access Log Retention: Automatically purge routine movement logs after a defined period (e.g., 90 days) unless legally required.

·        Data Principal Erasure: Establish a clear process to permanently wipe an employee's biometric templates from all readers immediately upon separation.

·        Third-Party Processor Agreements: Sign strict data processing contracts if using a third-party cloud-based access control vendor.

2. Data & Cyber Security Checklist (ISO 27001 Alignment)

This section ensures the access control software, controllers, and reader networks cannot be intercepted or hacked.

·        Network Segmentation: Place all IP-based door controllers and management servers on a dedicated, isolated VLAN away from corporate data.

·        Encrypted Device Communications: Ensure reader-to-controller communication uses secure protocols (like OSDP) instead of vulnerable legacy Wiegand wiring.

·        Template Encryption: Verify that biometric data is stored only as irreversible cryptographic hashes, never as raw fingerprint or facial images.

·        Server Access Security: Enforce Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC) for the ACS management software dashboard.

·        API Security & Integrity: Encrypt and authenticate all API connections between the ACS and secondary systems like HR payroll.

·        Firmware Vulnerability Management: Run automated monthly checks to patch vulnerabilities on edge controllers and readers.

3. Physical & Operational Security Checklist

This section protects the physical infrastructure supporting the electronic access environment.

·        Tamper-Evident Enclosures: Lock all master control panels inside a secure, monitored server room or restricted IT closet.

·        Fail-Safe vs. Fail-Secure Mapping: Configure doors to unlock automatically during fire alarms (fail-safe) but remain locked during power cuts (fail-secure).

·        Independent Power Redundancy: Backup the entire ACS network with central UPS units and dedicated local batteries inside controller enclosures.

·        Tamper Alerts Enabled: Configure the system to trigger immediate silent IT/Security alerts if a reader housing is physically pried open.

·        Regular Hardware Audits: Conduct quarterly physical inspections to check for card cloning vulnerabilities or physical door bypass risks.

 

Conclusion

An ISO 27001:2022 certified ISMS is a robust, evidence-ready foundation for complying with the security and procedural mandates of the DPDP Act 2023. Organizations can leverage their ISMS to:

•             Fulfil the security safeguards obligation.

•             Systematically manage consent, rights, and breaches.

•             Conduct DPIAs as part of risk assessment.

•             Manage processors through supplier controls.

•             Demonstrate accountability and due diligence to regulators.

Treat the DPDPA as the legal requirement and ISO 27001 as the operational blueprint to build a resilient, compliant, and trustworthy data protection regime.

STQC Certification and CCTV

 STQC Certification and CCTV

CCTV is everywhere now, in metro stations, campuses, warehouses, and housing societies. With that spread comes a tougher question: can you trust what’s on the pole? The government wants a clear “yes”, which is why it’s pushing the market towards standardized, secure-by-design products. The big lever is STQC security certification. It’s not a nice-to-have anymore; it’s the new gate. Manufacturers, integrators, buyers, everyone’s playbook changes in 2025.

STQC, short for Standardization Testing and Quality Certification, is overseen by the Ministry of Electronics and IT (MeitY). Think of it as a seal that says, “This device was built properly and hardened against common attacks.” For surveillance, that covers cameras, DVRs, and NVRs. It looks at product quality, cybersecurity controls, and how data is handled. In other words: fewer soft spots, fewer nasty surprises once the kit goes live.

The Mandatory Requirement

Two dates matter. First, in June 2024, government buyers started insisting on STQC-aligned equipment. Only STQC-certified CCTV products are meant to be sold and integrated in India. No carve-outs for OEMs or import labels. No “we’ll update it later”. If it isn’t certified, it shouldn’t be on the invoice. Simple as that.

As of April 9, 2025, STQC certification is mandatory for all CCTV cameras manufactured, imported, or sold in India. 

·        Government Procurement: Mandatory since June 6, 2024. Any "Made in India" CCTV procured for government projects must strictly adhere to STQC-certified standards.

·        General Market: All IP-based CCTV cameras must comply by the April 2025 deadline to remain legally available for sale.

·        Full Enforcement: From April 1, 2026, no sale of non-compliant CCTV cameras will be allowed, as the previous transition relaxations have been formally withdrawn

Why STQC is mandatory for CCTV?
The Ministry of Electronics and IT (MeitY) made STQC (Standardisation Testing and Quality Certification) mandatory for CCTV systems to ensure:
🔹 Quality & Safety: Cameras must work well and be safe for public use.
🔹 No Spying Risk: To avoid hidden risks like data leaks or spying through poor-quality or foreign-controlled cameras.
🔹 Trusted Performance: STQC checks that the camera meets Indian government standards before it’s used in sensitive places.

✅ STQC = Government-approved safety and quality check for CCTV.

Key Requirements for STQC Certification

This mandate pulls the industry toward “secure by default”. Expect the following to show up in specs and test reports:

·        Secure boot and firmware verification so tampered code can’t sneak in.

·        No default or hardcoded passwords; each device has its own credentials.

·        TLS 1.2+ is a modern way to encrypt streams and management communications.

·        Access restrictions that are quite specific for local and remote logins, together with roles and logs.

·        BIS safety compliance (IS 13252 / IEC 60950-1) where applicable.

·        Chinese-origin OEMs are not eligible for STQC certification.

·        Independent testing at STQC-recognized labs, with proper documentation.

Yes, it’s technical. But it’s also practical. Locked ports. Signed updates. Patch paths that don’t open new holes. That’s how fleets stay healthy.

Who Needs to Comply with This Mandate?

Short answer: the entire chain.

·        Manufacturers, Indian and international, are bringing models to market.

·        OEM partners and importers are rebranding or expanding their ranges.

·        Distributors, retailers, and system integrators are selling or installing systems.

·        Buyers in public projects, smart cities, critical infrastructure, and enterprise.

If you touch CCTV in India, compliance isn’t an afterthought. It’s part of the offer.

What Happens If You Don’t Comply?

Doors close. Non-STQC products become out of bounds for sale and use. You risk being tossed out of tenders. Licenses and approvals can be questioned. Private buyers, especially corporate security teams, will quietly pass. And the reputational hit from a failed audit? That lingers. Why roll the dice when the rules are crystal clear?

Benefits of Using STQC-Certified CCTV Products

In short, here’s what that certification delivers in everyday operations.

·        Stronger cybersecurity out of the box; fewer field incidents, fewer emergency call-outs.

·        Buyer confidence, procurement checks get easier, especially in regulated sectors.

·        Policy alignment with Make in India and Atmanirbhar Bharat priorities.

·        Lower legal and operational risk, plus a smoother path through audits and renewals.

Certification Process for Manufacturers

To obtain the STQC Certificate for CCTV, companies must follow a structured procedure: 

1.   Technical Construction File (TCF): Submit a dossier detailing architecture, firmware versions with hash values, and Bill of Materials (BoM) down to the SoC level.

2.   Lab Testing: Samples are sent to BIS-approved or STQC-recognized labs for functional and cybersecurity stress tests.

3.   Factory Audit: STQC authorities may inspect manufacturing facilities to verify quality control and secure engineering processes.

4.   Labeling: Certified products must display: “This CCTV camera complies with Essential Requirement(s) for Security” on their packaging.

Essential Security Requirements (ER 01:2024)

The Standardisation Testing and Quality Certification (STQC) Directorate validates cameras against Essential Requirements (ER). These are not optional features but mandatory engineering controls: 

·        No Hardcoded Passwords: Each device must have unique credentials; "admin/admin" defaults are prohibited.

·        Secure Boot & Firmware: The camera verifies its own software integrity every time it starts up. Only cryptographically signed firmware can run, so nobody can inject malicious code.

·        Encryption: Mandatory use of TLS 1.2+ for streaming and management data to prevent interception.

·        Physical Security: Requirements for tamper-resistant enclosures and locked physical ports (like UART or JTAG).

·        Data Sovereignty: Prevents sensitive surveillance data from being transmitted to unauthorized foreign servers. Manufacturer debugging interfaces must be shut down before the camera leaves the factory. Open debug ports are one of the most common entry points for hackers.

·        Vulnerability disclosure policy – Brands must maintain a formal process for reporting and patching security flaws. This means ongoing accountability, not just a one-time test.

·        Supply chain transparency – Manufacturers must declare the origin of chipsets, PCBs, and processors. Think of it like ingredient labelling on food; now the government checks where your camera's brain comes from.

Impact of Non-Compliance

Failure to meet these standards results in significant market restrictions:

·        License Cancellation: Existing BIS licenses may be suspended or cancelled.

·        Customs Delays: Imported units lacking certification are often stalled at ports.

·        Tender Disqualification: Non-compliant brands are excluded from lucrative smart city and public infrastructure projects

How to Verify a Specific Model

Certification is awarded at the model level, not just the brand level. You can verify a specific camera by: 

1.   Checking the Packaging: Look for the mandatory text: "This CCTV camera complies with Essential Requirement(s) for Security".

2.   Official Portal: Visit the STQC Certified Products List and search by manufacturer name or certificate number.

Understanding BIS ER Approval

Until recently, a CCTV camera only needed to pass a basic electrical safety test (IS 13252) to be sold in India. That test checked whether the camera was safe to plug in: protection against electric shock, insulation, and fire hazards. That's it.

Alongside STQC, BIS ER (Bureau of Indian Standards – Electronics Registration) approval is another essential regulatory requirement for electronic surveillance equipment sold in India. 

The BIS ER approval indicate strengthens trust among distributors, channel partners, and enterprise buyers who prioritize regulatory compliance during vendor evaluation.

What BIS ER Approval Ensures

·        Conformity to Indian safety standards

·        Electrical safety compliance

·        Product testing through recognized labs

·        Mandatory registration before market sale

Key Aspects of BIS-ER-01 Certification

·        Objective: Adds a mandatory cybersecurity layer to existing electrical safety standards for IP cameras and security equipment.

·        Mandatory Status: Essential for legal sale or import of surveillance products in India.

·        Testing Focus: Evaluates debug interfaces, password complexity, and access controls.

·        Deadline/Timeline: The deadline for implementation was April 9, 2025.

·        Application: Often involves collaboration with BIS-designated labs for testing and submission through official channel

BIS guidelines are listed below to comply with the Essential Requirements for CCTV Cameras. 

While some of it may sound complicated, not to worry, we are here to simplify it for you.  Email us or call us – we are happy to discuss and guide you 

·        Existing licensees of ‘CCTV Cameras’ as per IS 13252 (Part 1) : 2010/ IEC 60950-1 : 2005 

o   Existing licensees of CCTV Cameras shall apply online through the “Apply for Standard Revision/ Amendment/ Essential Requirement” module along with test report for ER: 01.

o   Applicable Fees: 

§  Inclusion test report: INR 30,000/- + applicable taxes per test report 

§  Additional test report: INR 20,000/- + applicable taxes per test report 

o   All non-compliant models shall be deleted from the scope of License and registration shall be liable for cancellation after 09 April 2025.  

·        New Applicants of CCTV Cameras: 

o   Applications for CCTV Cameras may be submitted along with test report for ER: 01 in addition to test report as per IS 13252 (Part 1): 2010. 

o   Processing of Applications without test report for ER: 01 shall be permitted only upto 09 April 2025. 

o   In case of above point no. 3 (B) (ii), a declaration from the applicant will also be required to submit that they will implement the revised Standard by 09 April 2025. 

o   Beyond 09 April 2025, above point no. 3 (B) (ii) will not be valid and registration will not be granted to such applications which are not complying with ER: 01 

·        Change in Scope of License:

o   Inclusion applications for CCTV Cameras may be submitted along with test report for ER: 01 in addition to test report as per IS 13252 (Part 1): 2010. 

o   Processing of Applications without test report for ER: 01 shall be permitted only upto 09 April 2025. 

o   In case of above point no. 3 (C) (ii), a declaration from the applicant will also be required to submit that they will implement the revised Standard by 09 April 2025. 

o   Beyond 09 April 2025, above point no. 3 (C) (ii) will not be valid and registration will not be granted to such applications which are not complying with ER: 01. 

o   Existing Licensees shall not use the Inclusion module to apply for implementation of Essential requirements of registered models. Instead, they may use the module as already mentioned in 3 (A)(i). 

·        Models complying with the above Order may display the following on the packaging: “This CCTV camera complies with Essential Requirement(s) for Security”.  

·        Provision for generating Test Request for ER for Security of CCTV– ER: 01 has been made live on BIS Portal. 

STQC vs BIS ER – Which One Do You Need?
In today’s regulatory environment, certifications are not just about compliance—they’re about trust, credibility, and market access. Two certifications that often create confusion are STQC (Standardisation Testing & Quality Certification) and BIS ER (Bureau of Indian Standards – Essential Requirements). While both deal with product quality and safety, their application areas and target customers differ significantly.

STQC (Standardisation Testing & Quality Certification)
 • Primary Customers: Government departments, PSUs, and organizations working on e-Governance, IT infrastructure, and software/hardware systems.
 • Focus: IT systems, biometric devices, smart cards, e-sign, and other digital infrastructure components.
 • Why It’s Needed: Many government tenders and projects mandate STQC certification to ensure reliability, interoperability, and adherence to national security/quality standards.

BIS-ER ( Bureau of Indian Standards – Essential Requirements)
 • Primary Customers: Private manufacturers, importers, and businesses selling electronic/IT products in the Indian market.
 • Focus: Consumer electronics, IT equipment, household gadgets, and other electronic products listed under the Compulsory Registration Scheme (CRS).
 • Why It’s Needed: BIS ER is mandatory for commercial sale in India—without it, businesses cannot legally sell or market their products.

In simple terms
 • Government Projects → STQC Certification (trust + compliance in IT/e-governance ecosystem).
 • Market Access (Retail/Commercial) → BIS ER Certification (legally required for selling electronic products in India).

From Today onwards (April 1, 2026): what changes

The government gave the industry time to prepare. New BIS licences without ER-01 compliance stopped being issued from April 9, 2025. Brands that didn't get certified could sell existing warehouse stock for a while, but that grace period is now over.

From April 1, 2026, selling a non-compliant camera in India carries fines of up to 10× the product's value and up to 2 years in prison. BIS is already raiding warehouses.

Existing cameras already installed in your home or office are unaffected. The rule targets new sales, not existing use. And analog cameras are exempt; this applies only to IP (network-connected) cameras.