Data Privacy | ISO 27701 and DPDP
ISO 27701 and the DPDP Act: Using Privacy Certification to Prove Indian Compliance
Indian companies now face a question they could previously avoid: how do you prove you handle personal data responsibly? The Digital Personal Data Protection Act created statutory duties, enterprise clients ask about them in due diligence, and boards want something more substantial than an assurance from the IT team. ISO 27701 certification in India has become the most practical answer, because it converts privacy management from a set of intentions into an audited system.
This guide explains what ISO 27701 is, how it maps to DPDP obligations, where the standard stops short of the law, and how Indian organisations should sequence the two. If the Act itself is new to your team, start with our DPDP guide and then return here.
Table of Contents
What ISO 27701 Actually Is
ISO/IEC 27701 is an extension of ISO 27001. It takes the information security management system you already run and adds the requirements and guidance needed to operate a Privacy Information Management System, usually shortened to PIMS. You cannot certify to it on its own. Either you hold ISO 27001 already and extend the scope, or you implement both together, working through the security requirements first.
The extension does three things. It adapts existing security requirements so they account for personal data specifically. It adds guidance for organisations acting as a controller, meaning those who decide why and how personal data is processed. And it adds separate guidance for processors, meaning those who process on someone else's instructions. That split matters in India, where an IT services firm is often a processor for overseas clients and a controller for its own employee and marketing data at the same time. Our overview of the standard explains the structure, and our requirements guide walks through the clauses.
Where It Maps to DPDP Obligations
The DPDP Act uses its own vocabulary. A Data Fiduciary decides the purpose and means of processing, a Data Processor acts on instructions, and the individual is a Data Principal. Our explainer on fiduciary and principal roles sets out the distinction. ISO 27701 does not use those terms, but its controller and processor guidance lines up closely with them.
| DPDP obligation | What ISO 27701 provides | Gap you must close separately |
|---|---|---|
| Lawful basis and consent | Controls for identifying purposes and managing consent records | Mapping bases to Indian legitimate uses in the Act |
| Notice to data principals | Requirements for transparent information to data subjects | Wording and languages suited to Indian notice expectations |
| Data principal rights | Processes for access, correction, erasure and objection | Statutory timelines and grievance redressal mechanism |
| Security safeguards | Full ISO 27001 control set adapted for personal data | None in substance; this is the strongest overlap |
| Breach reporting | Incident management including privacy breach handling | Reporting format and timelines set under Indian law |
| Processor obligations | Contractual and operational controls over processors | Agreements drafted to DPDP terminology and duties |
| Significant Data Fiduciary duties | DPO role, impact assessments, audit mechanisms | Indian residency and specific designation requirements |
Read across the table and the pattern is clear. ISO 27701 supplies the machinery: the inventory, the roles, the records of processing, the rights handling workflow, the breach procedure and the supplier controls. What it cannot supply is the Indian legal specificity, because it is an international standard rather than a national compliance programme.
What Certification Does Not Do
Being direct about this saves disappointment later. An ISO 27701 certificate does not make you DPDP compliant, and no auditor will say it does. The Act imposes obligations that exist regardless of whether you hold any certificate, and a regulator assessing a breach will look at your compliance with the statute, not at your certification status.
What certification does is change the quality of your evidence. Instead of asserting that you handle personal data properly, you can show an independently audited system with records of processing, documented lawful bases, rights requests logged and resolved, processor agreements in place and breach procedures tested. When a client's privacy team, an insurer, an acquirer or a regulator asks how you manage personal data, that evidence answers in a form everyone recognises.
Why Indian Companies Are Choosing It Now
Three groups are moving first. IT services firms and business process providers certify because overseas clients increasingly ask for privacy assurance alongside security, and a PIMS answers the processor questions in a vendor questionnaire directly. Technology and SaaS companies certify because privacy appears in enterprise procurement and in investor diligence. And larger domestic organisations in financial services, healthcare and retail certify because their DPDP exposure is substantial and the board wants external validation of what the compliance team reports.
There is a practical driver too. Companies that already hold ISO 27001 find the extension far cheaper than building a separate privacy programme, because the governance, risk assessment, internal audit and management review machinery already exists. Organisations running personal data in public cloud environments often add ISO 27017 cloud security controls alongside.
What Implementation Actually Involves
The work starts with scope and roles. You define which entities, services and processing activities the PIMS covers, then determine for each activity whether you act as a controller or a processor, because the guidance and the evidence differ. Indian IT and BPO firms usually find they are both, and that the two roles need separating in the documentation rather than blurred together.
The record of processing activities comes next and does the heaviest lifting. It lists what personal data you hold, where it came from, why you process it, who you share it with, where it goes and how long you keep it. Building it honestly is tedious and almost always surfaces surprises: a marketing tool nobody disclosed, employee data in a spreadsheet, a vendor with access that was never contracted. This single document then serves the standard, your DPDP accountability and most client questionnaires.
From there the controls go in. Notices get rewritten in language people can actually read. Consent capture is rebuilt so it is specific and recorded. Rights handling becomes a workflow with owners and deadlines rather than an email someone forwards. Retention schedules are defined and, more importantly, enforced, because a schedule that nothing acts on is worse than none. Processor agreements are issued or updated. Privacy impact assessments are introduced for higher risk processing.
Finally the management system closes the loop. Internal audit and management review extend to cover privacy alongside security, and the certification body then audits the combined system in two stages.
How to Sequence the Work
- Establish or confirm an ISO 27001 management system, since ISO 27701 extends it rather than replacing it
- Determine your role per processing activity, controller or processor, because the guidance differs
- Build the record of processing activities, which serves both the standard and DPDP accountability
- Map lawful bases against Indian requirements rather than assuming international equivalence
- Implement rights handling with the timelines and grievance route the Act expects
- Put processor agreements in place using DPDP terminology, not generic privacy clauses
- Extend the internal audit and management review to cover privacy before the certification audit
Most organisations with a working ISMS reach the extension audit in three to five months. Those implementing both standards together should plan six to nine. Our cost guide explains the drivers, and our penalties note sets out what non compliance risks on the statutory side.
How Univate Helps
Univate implements ISO 27701 as an extension of the security system you already run, or builds both together where that is the better route. We define the PIMS scope, establish controller and processor roles, build the record of processing, map lawful bases to the Act, draft notices and processor agreements, implement rights and breach handling, then run the internal audit and prepare you for certification. The programme sits inside our wider data privacy practice, draws on classification work where sensitive data needs identifying, and is sequenced by our GRC team where several frameworks are in play. Companies with European exposure should review whether GDPR applies to them, since the same PIMS supports both, and our comparison of the two laws explains where they diverge. The technical safeguards sit alongside our cybersecurity services.
Final Thoughts
ISO 27701 is the bridge between knowing what the DPDP Act requires and being able to show you do it. It will not substitute for Indian legal compliance, and any consultant suggesting otherwise is selling something. Used properly, though, it turns privacy from a policy statement into an operating system with records, owners and audits behind it, which is exactly what clients, boards and regulators are increasingly asking Indian companies to produce.
Frequently Asked Questions
Can we certify to ISO 27701 on its own?
No. ISO 27701 is an extension of ISO 27001, so you either hold the security certification already and extend its scope, or you implement both together and certify them as one system.
Does ISO 27701 make us DPDP compliant?
No. The DPDP Act creates statutory obligations that apply regardless of certification. ISO 27701 provides the management system, records and evidence that make demonstrating many of those obligations far easier, but Indian legal specifics must be addressed directly.
What is the difference between a controller and a processor under the standard?
A controller decides why and how personal data is processed, which corresponds broadly to a Data Fiduciary under the DPDP Act. A processor acts on another organisation's instructions. ISO 27701 provides separate guidance for each role, and many Indian firms are both.
How long does ISO 27701 certification take?
Organisations with a working ISO 27001 system typically reach the extension audit in three to five months. Those implementing both standards together should plan six to nine months.
Who issues the certificate?
An independent accredited certification body, after auditing the combined management system. A consultant prepares you for that audit but does not certify you, which is what keeps the certificate meaningful to clients.
Will clients accept ISO 27701 instead of a privacy questionnaire?
It rarely replaces the questionnaire entirely, but it answers a large share of it and shortens the review. Enterprise privacy teams treat an audited PIMS as considerably stronger evidence than self reported answers.
Does it help with GDPR as well?
Yes. The standard was designed to support multiple privacy regimes, and its controller and processor guidance maps usefully onto GDPR obligations. Indian companies serving European clients commonly use one PIMS to address both.
What does ISO 27701 certification cost in India?
There is no fixed price. Cost reflects the scope of personal data processing, number of sites, your existing ISO 27001 maturity and the certification body's audit days. A scoped quote after a gap assessment is the reliable way to budget.
