Get Your DPDP Act Quote

Name *Email *Phone / WhatsApp *

What do you need? *Which standard? *

A specialist responds within 2 business hours ·

DPDP Act 2023 · Digital Personal Data Protection (India)India

We test your DPDP Act duties before the Board asks

India’s Digital Personal Data Protection Act 2023 makes almost every organisation handling Indian personal data a Data Fiduciary. SIS assesses your notice, consent, retention, breach intimation and grievance processes against what your systems and contracts really do.

!A customer contract now carries DPDP clauses and an audit right, and nobody has tested whether you would pass.
!You have been notified, or expect to be notified, as a Significant Data Fiduciary and must appoint an independent data auditor.
!Consent for marketing was collected years ago through a checkbox nobody can now produce evidence for.
!Personal data flows to call centres, business correspondents or franchise partners with no data processing contract in place.
!A breach happened and nobody was clear who intimates the Data Protection Board or the affected individuals.
!You process children’s data and have no mechanism for verifiable parental consent or the advertising restrictions.

What it is

Indian legislation governing digital personal data. It defines Data Fiduciaries and Data Processors, requires itemised notice and valid consent, limits retention, mandates security safeguards, breach intimation and a grievance redress route.

Who issues it

Nobody certifies DPDP compliance; it is law, not a certification scheme. SIS conducts an independent third-party audit against the Act and issues an assessment report and statement of conformity.

Validity

The report reflects the scope and date of assessment. Reassess annually, after material system changes, and as the phased obligations come into force.

Who can apply for ISO/IEC 22000 Certification?

Any organisation processing digital personal data of individuals in India: banks, telecom operators, hotels, hospitals, edtech, SaaS providers and government programmes.

8of 25 industries

Industries that require ISO 22000 Certification

DPDP Act is applicable across 8 of the 25 industries SIS covers. The pages below set out the specific reason it comes up in each one.

Hospitality IndustryPublic SectorTelecommunication IndustryEducation IndustryInformation Technology IndustryBanking and Finance+2 more

What DPDP Act Actually Requires

An organisation must understand the requirements for ISO 22000 certification to implement it effectively.

Role & Scope Determination

Establish where you act as Data Fiduciary and where as Data Processor, which entities and systems are in scope, and whether Significant Data Fiduciary duties apply.

Notice & Consent Records

Itemised notice in plain language, available in English or a language in the Eighth Schedule, with consent that is specific, withdrawable, and evidenced per individual.

Purpose Limitation & Erasure

Personal data used only for the notified purpose, and erased when consent is withdrawn or the purpose is served, unless a law requires it to be kept.

Rights & Grievance Redress

A published route for access, correction, erasure and nomination requests, a responsive grievance mechanism, and records showing requests answered within the stated period.

Safeguards & Breach Response

Reasonable security safeguards proportionate to the data held, plus a tested procedure to intimate the Data Protection Board and every affected Data Principal.

Processor Contracts & Oversight

Processing by vendors, agents and franchise partners only under a valid contract, with oversight that checks what they actually do with the data.

How DPDP Act Compliance Assessment Works

A clear, step-by-step process from your first call to a completed engagement.

Scoping & Role Mapping

We identify the entities, systems and processing activities in scope, whether you act as Fiduciary or Processor for each, and whether Significant Data Fiduciary duties are in play.

3–5 days

Data Discovery & Gap Assessment

A marketing team swears the database is consented; discovery finds the same numbers in a call-recording archive nobody owns. Each duty in the Act is then measured against what exists.

2–4 weeks

Independent Compliance Audit

Evidence testing on site and remotely: notice and consent artefacts, retention and deletion records, grievance logs, breach drills, safeguard configuration and the contracts covering every processor.

2–5 audit days

Assessment Report & Statement

The report is scored duty by duty against the Act, so a customer exercising an audit right reads the same document your board does. Closing the non-conformities remains your work.

Report in 10 working days

A first assessment typically runs four to eight weeks, and the one thing that shortens it is having the vendor contracts and the system list ready on day one; a Board notice with a date on it changes the sequence, not the amount of work.

Industries That Need DPDP Act

🏨

Hospitality Industry

Open full page →

Why it applies hereIndian properties collecting guest identity, contact and loyalty data are data fiduciaries under the DPDP Act. Compliance requires clear notice, valid consent, defined retention, breach reporting and a grievance mechanism across PMS, WiFi capture, CCTV and marketing databases. Group-level chains face the added obligation of governing data handled by franchise and outsourced operators.Typical trigger: Indian regulatory obligation

🏛️

Public Sector

Open full page →

Why it applies hereGovernment bodies handling citizen personal data must meet DPDP Act obligations on notice, purpose limitation, retention, security safeguards, breach reporting and grievance redress, including for data held by empanelled vendors. Programme design and vendor contracts both need to reflect these duties from the outset rather than after deployment.Typical trigger: Citizen data programmes; vendor contracts

📡

Telecommunication Industry

Open full page →

Why it applies hereTelecom operators are significant data fiduciaries under the DPDP Act, handling identity documents, usage data and location information at national scale. Obligations on notice, consent, retention, breach reporting and grievance redress extend to distribution partners and outsourced call centres, which is where most gaps are found.Typical trigger: Indian regulatory obligation; partner ecosystem

🎓

Education Industry

Open full page →

Why it applies hereInstitutions processing student personal data are data fiduciaries under the DPDP Act, with heightened obligations where children are involved, including verifiable parental consent and restrictions on tracking and targeted advertising. Admissions systems, learning platforms and alumni databases all fall in scope.Typical trigger: Indian obligation; children's data rules

💻

Information Technology Industry

Open full page →

Why it applies hereTechnology firms serving Indian customers act as data processors and often as fiduciaries for their own user data. DPDP Act obligations cover notice, consent, retention, security safeguards, breach reporting and grievance redress, and flow into customer contracts, subprocessor agreements and product design.Typical trigger: Indian customer contracts; product design

🏦

Banking and Finance

Open full page →

Why it applies hereBanks are significant data fiduciaries under the DPDP Act, with obligations on notice, consent, retention, security safeguards, breach reporting and grievance redress that extend to business correspondents, recovery agents and technology vendors, where most gaps are found.Typical trigger: Indian obligation; agent and vendor ecosystem

🍽️

Hotel, Restaurant and Leisure Service

Open full page →

Why it applies hereVenues collecting guest identity, contact, loyalty and CCTV data are data fiduciaries under the DPDP Act. Obligations on notice, consent, retention, breach reporting and grievance redress extend to franchise operators, outsourced marketing and booking partners handling the same data.Typical trigger: Indian obligation; franchise and partner data

🧳

Tourism Industries

Open full page →

Why it applies hereOperators collect traveller identity documents, contact details, payment information and itinerary data, often sharing it with hotels, transporters and overseas partners. DPDP Act obligations on notice, consent, retention, breach reporting and grievance redress apply across that whole chain, including partners abroad.Typical trigger: Traveller data; partner sharing

Commonly taken alongside

ISO/IEC 27701Privacy Information Management ISO/IEC 27001Information Security Management VAPTVulnerability Assessment & Penetration Testing Cyber SecurityCyber security assessment & certification

ISO/IEC 27001 provides the security safeguards the Act demands and ISO/IEC 27701 turns them into a certifiable privacy management system, so the same data map and control set serves the audit and both certifications instead of being rebuilt three times.

Not Sure Which Certification You Need?

Three questions. The selector reads the same industry-to-standard mapping this whole site is built on, then shortlists what applies to you.

Question 1 of 3

Which sector best describes your organisation?

Scope the DPDP audit before the Board notice arrives

The work is decided by how many systems hold personal data and how many vendors touch it, not by headcount. Those two numbers give you a duration and a fee.

Get My Free Quote →

What DPDP Act Changes for Your Business

More than a certificate — a testimony that you have raised the bar and built customer confidence.

📑

Audit rights you can meet

Customer and partner contracts carrying DPDP obligations and audit rights get answered with an independent report rather than a self-assessment questionnaire filled in by your own team.

🧯

Penalties adjudicated on evidence

The Act’s schedule sets financial penalties up to ₹250 crore for failing to take reasonable security safeguards. Demonstrated diligence is what the Board weighs when it adjudicates.

🔎

Data you forgot about

Most organisations discover personal data in places nobody listed: old CRM exports, WiFi capture logs, call recordings, and spreadsheets on the desktops of departed employees.

🤝

Vendor risk closed off

Call centres, recovery agents, franchise operators and technology vendors are where most gaps sit. The assessment forces the contracts and the oversight into existence.

⏱️

Breach response that works

Intimation duties to the Board and to every affected individual are unforgiving of confusion. A tested procedure with named owners is the difference between hours and days.

🧩

A base for other regimes

Data mapping, retention schedules and processor contracts built for DPDP carry over directly into GDPR work and into ISO/IEC 27701 certification.

Frequently Asked Questions

Straight answers to what buyers ask before they commit to DPDP Act.

Is there such a thing as a DPDP certificate?

Not under the Act. The DPDP Act creates obligations and a Data Protection Board to adjudicate breaches of them; it does not establish a certification scheme, and no body can issue a certificate that discharges your duties. What an independent audit gives you is documented third-party evidence of diligence, which is what customers ask for in contracts and what counts when compliance is questioned.

Does the Act apply to us if we are outside India?

It applies to digital personal data processed within India, and to processing outside India where it relates to offering goods or services to individuals in India. A SaaS company hosted abroad with Indian users is in scope. So is an offshore processing centre handling Indian customer records for a client, though there the primary duties usually sit with the Data Fiduciary that engaged you.

Are we allowed to transfer personal data outside India?

The Act permits transfer of personal data outside India except to countries the central government restricts by notification. That is a lighter position than a localisation mandate, but sectoral regulators impose their own rules, and banking, telecom and payments obligations frequently go further. Check the sectoral requirement as well as the Act before designing a hosting arrangement.

What are the penalties?

The Act’s schedule sets monetary penalties by duty breached, with the highest, up to ₹250 crore, attached to failure to take reasonable security safeguards to prevent a personal data breach. Separate amounts apply to breach intimation failures and to obligations concerning children. Penalties are imposed by the Data Protection Board after inquiry, and demonstrated diligence is a factor it weighs.

We already hold ISO/IEC 27001. How much of DPDP is covered?

The security safeguards side is largely covered, which is a genuine head start. What ISO/IEC 27001 does not give you is consent management, itemised notice, retention and erasure tied to purpose, Data Principal rights handling or grievance redress. ISO/IEC 27701 extends the same system into privacy and closes most of that distance, which is why the two are commonly taken together.

Who has to appoint an independent data auditor?

Only entities notified as Significant Data Fiduciaries carry that specific duty, along with appointing an India-based Data Protection Officer answerable to the board and conducting periodic impact assessment and audit. Notification is based on factors including the volume and sensitivity of data processed. Organisations that expect to be notified generally start the independent audit cycle before rather than after the notification arrives.

DPDP Act certification across Canada

Pick your region to see the industries concentrated there and the standards their buyers and regulators ask for most.

Calgary / Southern Alberta Edmonton / Northern Alberta Toronto / GTA Ottawa / National Capital Windsor–London Corridor Montréal / Québec Vancouver / British Columbia Saskatchewan Winnipeg / Manitoba

Book an independent DPDP compliance audit

An independent audit against the Act itself, not a maturity score borrowed from another regime, so the gaps you are shown are the ones that matter when the Board asks.

Get My Free Quote → WhatsApp Us