# DPDPA to ISO 27001:2022 Annex A — Comprehensive Mapping Matrix
**Version:** 1.2
**Date:** 2026-10-17
**Source:** StateCheck Security DPDPA Content System
**Purpose:** Engineering-focused compliance mapping for audit readiness
---
## Overview
This matrix provides a control-by-control mapping between India's Digital Personal Data Protection Act (DPDPA) 2023 obligations and ISO 27001:2022 Annex A controls. It is designed for security architects, CISOs, and compliance engineers who need to:
1. Understand which existing ISO 27001 controls satisfy DPDPA requirements
2. Identify gaps that require new DPDPA-specific controls
3. Build audit evidence packages demonstrating compliance with both frameworks
4. Prioritize implementation efforts based on coverage and effort estimates
---
## Coverage Legend
- **Full** — ISO 27001 control directly satisfies the DPDPA obligation with minimal extension
- **Partial** — ISO 27001 provides a foundation but requires DPDPA-specific enhancements
- **Gap** — No ISO 27001 counterpart; requires net-new control implementation
---
## Mapping Matrix
| # | DPDPA Section | DPDPA Obligation | ISO 27001:2022 Control ID | ISO 27001 Control Name | Coverage | Implementation Notes | Technical Patterns | Evidence for Audit | Priority | Effort |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Section 5(1) | **Notice Requirements** — Provide Data Principal with clear notice of personal data collected, purposes, manner of exercising rights, complaint mechanism | -- | -- | **Gap** | ISO 27001 has no concept of individual notice. Implement multilingual privacy notices (English + Eighth Schedule languages per S.5(3)). Notice must be provided before or with consent request. | • Privacy notice templates in all required languages
• Notice versioning and audit trail
• API endpoints for programmatic notice delivery
• CMS integration for notice display | • Timestamped notice delivery logs per Data Principal
• Notice template versions with approval dates
• Evidence of multilingual support
• User journey documentation showing notice placement | **High** | **High** |
| 2 | Section 6(1) | **Consent Management** — Obtain free, specific, informed, unconditional, and unambiguous consent; limited to data necessary for specified purpose | -- | -- | **Gap** | ISO 27001 does not address consent lifecycle. Build consent management platform with purpose-bound granularity, immutable audit trail, and Consent Manager interoperability (S.6(7)-(9)). Withdrawal must be possible "with the ease of doing so being comparable to the ease with which such consent was given" (S.6(4)). | • Purpose-scoped consent API
• Immutable consent event store (append-only log)
• Consent withdrawal endpoints with equivalent UX
• Integration with registered Consent Managers
• Consent verification middleware | • Consent grant/revoke timestamps with IP, user-agent
• Purpose-to-data mapping documentation
• Consent Manager registration certificates
• Consent withdrawal workflow evidence
• Audit log proving "ease comparable" requirement | **High** | **High** |
| 3 | Section 6(1) | **Purpose Limitation & Data Minimization** — Limit personal data collection to what is necessary for specified purpose | A.5.12 | Classification of information | **Partial** | ISO 27001's A.5.12 requires data classification by confidentiality/integrity/availability. Extend schema to include "personal_data_dpdpa" tier with purpose-bound access controls and retention policies. | • Extended data classification policy
• Purpose tagging in data schemas
• RBAC with purpose-based permissions
• Data minimization reviews in design phase
• Automated PII discovery tools | • Data classification policy with DPDPA tier
• Schema documentation showing purpose fields
• Access control matrices showing purpose enforcement
• Design review records demonstrating minimization
• PII discovery scan results | **High** | **Medium** |
| 4 | Section 8(3) | **Data Accuracy and Completeness** — Ensure personal data used for decisions or disclosed is complete, accurate, and consistent | A.5.14 | Information transfer | **Partial** | A.5.14 covers secure transfer but not accuracy obligations. Implement data quality checks, validation rules, and correction workflows. Add accuracy attestation to data transfer protocols. | • Data validation rules at ingestion
• Accuracy verification workflows
• Data quality monitoring dashboards
• Automated accuracy checks before disclosure
• Correction request handling system | • Data validation rule definitions
• Data quality metrics and dashboards
• Correction request logs with resolution times
• Accuracy attestations in transfer records
• Data quality audit reports | **Medium** | **Medium** |
| 5 | Section 8(5) | **Reasonable Security Safeguards** — Protect personal data by taking reasonable security safeguards to prevent breach | Multiple (A.5.*, A.8.*) | Security controls (general) | **Full** | ISO 27001's core purpose aligns directly with this. Your certified ISMS provides strong evidence of "reasonable safeguards." Ensure controls are risk-proportionate to volume/sensitivity of personal data, and check them against the Rule 6(1) minimum list (encryption/masking/tokens, access control, logs and monitoring, backups, one-year log retention under 6(1)(e), processor contract clauses). | • ISO 27001:2022 certified ISMS
• Risk assessment covering personal data
• Security controls from Annex A
• Proportionate control selection
• Continuous monitoring and improvement | • ISO 27001 certification (valid certificate)
• Risk assessment documentation
• Statement of Applicability (SoA)
• Surveillance audit reports
• Incident metrics showing control effectiveness | **High** | **Low** (if ISO certified) |
| 6 | Section 8(6) | **Breach Notification** — Notify Data Protection Board AND affected Data Principals of personal data breaches in prescribed form/manner | A.5.24, A.5.26 | Incident management planning and preparation; Response to information security incidents | **Partial** | A.5.24/A.5.26 cover incident management but not regulatory notification. Extend incident response playbook with DPDPA branch per Rule 7: initial intimation to the Board (7(2)(a)) and each affected Data Principal (7(1)) "without delay", then the detailed Board report within 72 hours of awareness (7(2)(b)), extendable on written request. | • DPDPA-specific incident response branch
• Breach classification criteria (S.2(u) definition)
• Board notification templates/forms
• Individual notification automation
• Evidence preservation procedures | • Incident response playbook with DPDPA section
• Breach notification logs (Board + individuals)
• Prescribed form submissions to Board
• Timeline documentation (notification speed)
• Post-incident review reports | **High** | **Medium** |
| 7 | Section 8(7) | **Data Erasure on Purpose Completion** — Erase personal data upon consent withdrawal OR when purpose no longer served (whichever earlier), unless legal retention required | A.8.10 | Information deletion | **Partial** | A.8.10 covers secure deletion but not DPDPA-specific triggers. Implement automated erasure evaluation: (1) consent withdrawal, (2) purpose completion per S.8(8) inactivity period. Cascade to backups and Data Processors (S.8(7)(b)). Respect the Rule 8(3) one-year minimum retention of personal data, traffic data and processing logs. | • Automated erasure trigger evaluation
• Purpose expiry calculation (S.8(8) logic)
• Consent withdrawal webhooks
• Cascading deletion across systems
• Legal hold exception handling
• Backup erasure within defined SLA | • Erasure trigger implementation documentation
• Automated job logs showing deletions
• Legal hold registry and exceptions
• Data Processor deletion confirmations
• Backup erasure SLA compliance records
• Audit trail of all erasures | **High** | **High** |
| 8 | Section 12 | **Right to Correction and Erasure** — Data Principal can request correction, completion, updating, erasure of personal data | A.8.10 | Information deletion | **Partial** | A.8.10 provides deletion mechanism but not request handling. Build DSAR (Data Subject Access Request) API for correction and erasure requests. Respond within prescribed timelines. Maintain audit log. | • DSAR request API endpoints
• Authentication for request validation
• Cross-system request routing
• Timeline tracking and SLA enforcement
• Request status dashboard for Data Principals | • DSAR request logs with timestamps
• Response time metrics vs. prescribed timeline
• Correction/erasure confirmation records
• Authentication logs for request validation
• Audit trail of all DSAR processing | **High** | **High** |
| 9 | Section 11 | **Right to Access** — Data Principal can request information about personal data processed and details of processing | -- | -- | **Gap** | ISO 27001 has no access request provision. Implement self-serve API/dashboard for Data Principals to export their personal data payload and processing summary. | • Data export API (machine-readable format)
• Self-serve portal for access requests
• Processing summary generation
• Data lineage documentation
• Access request authentication | • Access request logs with fulfillment records
• Data export payloads (sample/test exports)
• Processing summary templates
• Access fulfillment timeline metrics
• Authentication and authorization logs | **High** | **Medium** |
| 10 | Section 8(1)-(2) | **Data Processor Governance** — Data Fiduciary remains responsible for processing by Data Processors; must engage under valid contract | A.5.19 | Information security in supplier relationships | **Full** | A.5.19 directly addresses supplier security requirements. Ensure Data Processing Agreements (DPAs) explicitly reference DPDPA obligations, erasure requirements, and subprocessor restrictions. | • DPA templates with DPDPA clauses
• Supplier security assessment process
• Subprocessor approval workflow
• Data Processor audit rights
• Breach notification obligations in contracts | • DPA executed contracts with DPDPA terms
• Supplier security assessment results
• Subprocessor registry and approvals
• Supplier audit reports
• Breach notification test records | **High** | **Low** (if A.5.19 implemented) |
| 11 | Section 16 | **Cross-Border Transfer Restrictions** — Central Government may restrict transfers to certain countries by notification | -- | -- | **Gap** | ISO 27001's A.5.14 (Information transfer) covers secure transfer mechanisms but not jurisdictional restrictions. Implement infrastructure controls to enforce country restrictions per MeitY notifications. Monitor notification gazette for updates. | • Cloud provider region policies (AWS SCPs, Azure Policy, GCP Org Policies)
• VPC endpoint policies blocking restricted regions
• Application-layer geo-validation
• Data residency middleware
• Continuous MeitY notification monitoring | • Infrastructure policy configurations
• Restricted destination list (current version)
• MeitY notification monitoring logs
• Transfer logs showing destination validation
• Policy enforcement test results | **Medium** | **Medium** |
| 12 | Section 9 | **Children's Data Processing** — Verifiable parental consent required for processing data of children (under 18); prohibition on tracking, profiling, targeted advertising | -- | -- | **Gap** | ISO 27001 has no age-specific controls. Implement age verification, parental consent workflows, and behavioral restriction enforcement for under-18 users. | • Age verification mechanism
• Parental consent request and approval workflow
• Tracking/profiling disable for under-18
• Targeted ad exclusion rules
• Age-segregated data processing environments | • Age verification implementation documentation
• Parental consent records with verification
• Configuration showing disabled tracking for children
• Ad targeting exclusion rules
• Age-based processing segregation evidence | **High** (if processing children's data) | **High** |
| 13 | Section 13 | **Grievance Redressal Mechanism** — Provide readily available means for Data Principals to file grievances; respond within prescribed period | -- | -- | **Gap** | ISO 27001 does not cover external grievance handling. Build grievance submission portal, ticketing system, and response SLA tracking. Rule 14(3) sets a reasonable period not exceeding 90 days, to be published on your website or app. | • Grievance submission portal
• Ticketing/case management system
• SLA tracking and escalation
• Grievance response templates
• Grievance officer assignment | • Grievance submission logs
• Response time metrics vs. prescribed period
• Grievance resolution records
• Availability/uptime metrics for portal
• Grievance officer appointment documentation | **Medium** | **Medium** |
| 14 | Section 10(2)(a) | **Data Protection Officer (DPO) for Significant Data Fiduciaries** — Appoint DPO based in India with contact details published | A.5.2 | Information security roles and responsibilities | **Partial** | A.5.2 covers role definition but not DPDPA-specific DPO requirements. Define DPO role with Board reporting line, India residency, and published contact details. | • DPO role definition and charter
• DPO appointment with Board approval
• India residency verification
• Published contact details (website, privacy policy)
• DPO training and competency requirements | • DPO appointment letter
• DPO charter/terms of reference
• India residency evidence (employment contract, ID)
• Published contact details (screenshots/URL)
• DPO activity reports to Board | **High** (if SDF) | **Low** |
| 15 | Section 10(2)(c)(i) | **Data Protection Impact Assessment (DPIA) for Significant Data Fiduciaries** — Conduct periodic DPIA covering Data Principal rights and processing risk assessment | Clause 6.1.2, A.5.34 | Information security risk assessment; Privacy and protection of PII | **Partial** | Clause 6.1.2 covers information security risk assessment and A.5.34 covers PII protection, but neither is a privacy-specific DPIA. Extend risk methodology to include Data Principal rights impact, processing purpose analysis, and mitigation measures. | • DPIA methodology document
• DPIA template covering S.10(2)(c)(i) requirements
• Periodic DPIA schedule
• Risk mitigation tracking
• DPIA review and approval workflow | • DPIA methodology documentation
• Completed DPIA reports (periodic)
• Risk register with Data Principal rights risks
• Mitigation implementation evidence
• Board/DPO approval records for DPIAs | **High** (if SDF) | **Medium** |
| 16 | Section 10(2)(b) | **Independent Data Audit for Significant Data Fiduciaries** — Appoint an independent data auditor; DPIA and audit once every 12 months, with significant observations reported to the Board (Rule 13(1)–(2)) | A.5.35 | Independent review of information security | **Full** | A.5.35 covers independent review. Ensure auditor scope explicitly includes DPDPA personal data processing compliance, not just information security. Auditor must assess data lifecycle, consent, rights fulfillment. | • Independent auditor selection criteria
• Audit scope covering DPDPA obligations
• Annual audit schedule
• Audit report review process
• Corrective action tracking | • Independent auditor engagement contracts
• Annual audit reports with DPDPA findings
• Auditor independence attestation
• Corrective action closure evidence
• Board reporting of audit results | **High** (if SDF) | **Low** (if A.5.35 implemented) |
| 17 | Section 8(4) | **Technical and Organisational Measures for Purpose Binding** — Implement appropriate technical and organisational measures to ensure effective observance of the Act and Rules, including processing only for the specified purpose (S.4(1), S.6(1)) | A.5.12 | Classification of information | **Partial** | A.5.12 provides information classification but not purpose/notice enforcement. Implement purpose-binding middleware that blocks processing if purpose not in original consent scope. | • Purpose-binding enforcement layer
• Consent scope validation before processing
• Processing audit logs with purpose tracking
• Purpose drift detection
• Notice-to-processing alignment monitoring | • Purpose-binding configuration
• Processing audit logs with purpose validation
• Purpose drift alerts and resolutions
• Alignment audit between notice and actual processing
• Rejected processing attempts (unauthorized purposes) | **High** | **Medium** |
| 18 | Section 6(10) | **Proof of Notice and Consent** — Where consent is the basis of processing, the Data Fiduciary must be able to prove that notice was given and consent obtained | -- | -- | **Gap** | ISO 27001 does not address consent records. Build an immutable consent audit log retained for at least the life of the processing (and not less than the Rule 8(3) one-year minimum). Consent Managers separately keep consent records for at least 7 years (First Schedule, Part B, item 4(c)). | • Immutable consent event store
• Consent metadata (timestamp, IP, user-agent, notice version, purpose)
• Retention policy for consent records
• Consent audit trail query API | • Consent record schema documentation
• Sample consent records with full metadata
• Retention policy for consent records
• Audit log immutability evidence (append-only storage)
• Consent record query results (test cases) | **High** | **Medium** |
| 19 | Section 6(7)-(9) | **Consent Manager Registration** — Data Principal may give, manage, review or withdraw consent through a Consent Manager registered with the Board | -- | -- | **Gap** | ISO 27001 does not address Consent Manager integration. If using Consent Managers, verify registration on the Board's website (Rule 4(2)(a)) and interoperability with the standards the Board publishes (First Schedule, Part A, item 9). Rule 4 applies from 13 Nov 2026. | • Consent Manager selection criteria
• Registration verification process
• Interoperability API integration
• Data Fiduciary-CM contract terms
• Consent portability implementation | • Consent Manager registration certificates
• CM-DF contracts
• Interoperability test results
• Consent portability evidence
• CM audit trail integration | **Medium** (if using CM) | **Medium** |
| 20 | Section 8(8) | **Purpose Expiry Definition** — Purpose deemed no longer served if Data Principal has not approached for performance AND not exercised rights for prescribed period | -- | -- | **Gap** | ISO 27001 has no purpose expiry calculation. Implement automated purpose expiry evaluation based on last interaction date + prescribed period per Data Fiduciary class and purpose. Rule 8(1) and the Third Schedule prescribe 3 years only for e-commerce entities and social media intermediaries with 2 crore+ registered users and online gaming intermediaries with 50 lakh+; warn the Data Principal 48 hours before erasure (Rule 8(2)). | • Purpose expiry calculation engine
• Last interaction tracking (approach + rights exercise)
• Prescribed period configuration per fiduciary class
• Automated expiry evaluation job
• Integration with erasure trigger system | • Purpose expiry algorithm documentation
• Prescribed period configuration (source: Rules)
• Last interaction tracking logs
• Expiry evaluation job execution logs
• Erasure triggers from purpose expiry | **High** | **Medium** |
---
## Implementation Priority Summary
### Immediate (Priority: High, Effort: Low-Medium)
1. **A.5.19 Extension** — Update DPAs with DPDPA clauses
2. **A.5.2 Extension** — Define DPO role (if SDF)
3. **A.5.35 Extension** — Scope audits to include DPDPA (if SDF)
4. **Data Classification Extension** — Add personal_data_dpdpa tier to A.5.12
### Phase 1 (Priority: High, Effort: High)
5. **Consent Management Platform** — Gaps #1, #2, #18
6. **Data Erasure Automation** — Extension of A.8.10 for Sections 8(7), 12
7. **DSAR Fulfillment System** — Gaps #8, #9
8. **Breach Notification Extension** — Extension of A.5.24/A.5.26 for Section 8(6)
### Phase 2 (Priority: Medium-High)
9. **Cross-Border Controls** — Gap #11
10. **Children's Data Protections** — Gap #12 (if applicable)
11. **Grievance Redressal** — Gap #13
12. **DPIA Methodology** — Extension of Clause 6.1.2 and A.5.34 (if SDF)
13. **Purpose Expiry Automation** — Gap #20
### Phase 3 (Priority: Medium, conditional)
14. **Consent Manager Integration** — Gap #19 (if using CMs)
15. **Data Accuracy Workflows** — Extension of A.5.14
---
## Gap Analysis Summary
| Coverage | Count | Percentage |
|---|---|---|
| **Full Coverage** | 3 | 15% |
| **Partial Coverage** | 8 | 40% |
| **Gap (New Controls Required)** | 9 | 45% |
| **Total Obligations Mapped** | 20 | 100% |
**Key Insight:** ISO 27001:2022 provides a foundation for approximately 55% of DPDPA obligations (11 of 20: 3 Full + 8 Partial), but 45% (9 Gap) require net-new privacy-specific controls that ISO 27001 was not designed to address.
---
## Using This Matrix for Audit Preparation
### For ISO 27001 Surveillance Audits
1. Add "DPDPA Relevance" column to your Statement of Applicability (SoA)
2. For each control marked "Full" or "Partial," reference the DPDPA section it supports
3. Include DPDPA-specific evidence (e.g., consent logs, erasure records) in your audit evidence package
### For Data Protection Board Inquiries
1. Use the "Evidence for Audit" column to prepare documentation packages
2. Demonstrate how ISO 27001 controls provide "reasonable security safeguards" (Section 8(5))
3. Separately document gap controls (consent management, DSAR, etc.) that sit outside ISO 27001 scope
### For SDF Independent Audits (Section 10(2)(b))
1. Provide auditor with this mapping matrix as the compliance framework
2. Ensure auditor reviews both ISO 27001 controls AND gap controls
3. Request audit report to explicitly assess DPDPA obligation coverage
---
## Change Log
| Version | Date | Changes |
|---|---|---|
| 1.2 | 2026-10-17 | Citations aligned with the notified DPDP Rules 2025 and verbatim Act text; rows 2, 5, 6, 7, 13 and 16-20 updated (row 19 now cites Section 6(7)-(9); rows 17 and 18 reworded to match Sections 8(4) and 6(10)). |
| 1.3 | 2026-10-17 | Coverage corrected to match the matrix rows: 3 Full / 8 Partial / 9 Gap = 55% (the 1.1 entry's 3/9/8 = 60% did not match the data). |
| 1.1 | 2026-03-29 | Reconciled gap counts between article and matrix (confirmed 60% coverage: 3 Full / 9 Partial / 8 Gap). Updated coverage percentage in Gap Analysis Summary to match breakdown. Clarified implementation priority guidance. |
| 1.0 | 2026-03-28 | Initial release based on A1 article analysis |
---
## Disclaimer
This mapping matrix is provided for educational and planning purposes. It is not legal advice. Consult qualified legal counsel for interpretation of DPDPA obligations and applicability to your specific circumstances. ISO 27001 control descriptions are summarized from the ISO/IEC 27001:2022 standard.
---
**© 2026 StateCheck Security**
**Website:** https://statechecksecurity.com
**Contact:** info@statechecksecurity.com
**Download Latest Version:** https://statechecksecurity.com/resources/dpdpa-iso-27001-mapping-matrix