# DPDPA Compliance Resources

This directory contains downloadable resources for DPDPA compliance mapping and implementation.

## Available Resources

### 1. DPDPA to ISO 27001:2022 Mapping Matrix

**Files:**
- `dpdpa-iso-27001-mapping-matrix.md` — Comprehensive markdown documentation with full context
- `dpdpa-iso-27001-mapping-matrix.csv` — Excel/spreadsheet-compatible format for filtering and analysis

**What's Included:**
- 20 DPDPA obligations mapped to ISO 27001:2022 Annex A controls
- Coverage assessment (Full/Partial/Gap) for each obligation
- Implementation notes and technical patterns
- Evidence requirements for audit preparation
- Priority and effort estimates
- Gap analysis summary (55% coverage with ISO 27001: 3 Full + 8 Partial of 20; 45% requires new controls)

**Use Cases:**
1. **ISMS Extension** — Identify which ISO 27001 controls need DPDPA-specific enhancements
2. **Audit Preparation** — Build evidence packages for ISO 27001 surveillance audits or Data Protection Board inquiries
3. **Implementation Planning** — Prioritize control development based on coverage gaps and effort estimates
4. **Risk Assessment** — Understand where your existing ISMS provides protection and where new controls are needed

**How to Use:**

**For Excel/Google Sheets:**
1. Open `dpdpa-iso-27001-mapping-matrix.csv`
2. Apply filters to columns (e.g., filter by "Priority = High" and "Coverage = Gap")
3. Sort by "Effort" to prioritize quick wins
4. Use as a project tracker by adding "Status" and "Owner" columns
5. **Note:** The "Technical Patterns" and "Evidence for Audit" columns contain pipe-delimited bullet points (`|`) for easier parsing

**For Documentation:**
1. Read `dpdpa-iso-27001-mapping-matrix.md` for complete context
2. Reference the "Implementation Priority Summary" section for phased rollout guidance
3. Use the "Evidence for Audit" column to prepare documentation packages

## Coverage Summary

| Coverage Type | Count | Percentage |
|---|---|---|
| Full Coverage | 3 | 15% |
| Partial Coverage | 8 | 40% |
| Gap (New Controls) | 9 | 45% |

**Key Insight:** ISO 27001 provides a strong foundation, but 45% of DPDPA obligations require net-new privacy-specific controls (consent management, data principal rights, cross-border restrictions, children's data protections, grievance redressal).

## Implementation Priorities

### Immediate (Low Effort, High Priority)
- Update Data Processing Agreements with DPDPA clauses (A.5.19 extension)
- Define DPO role if Significant Data Fiduciary (A.5.2 extension)
- Add `personal_data_dpdpa` tier to data classification (A.5.12 extension)

### Phase 1 (High Priority, requires investment)
- Build consent management platform (Sections 5, 6)
- Automate data erasure triggers (Section 8(7), 12)
- Implement DSAR fulfillment API (Sections 11, 12)
- Extend breach notification for regulatory reporting (Section 8(6))

### Phase 2 (Medium Priority)
- Cross-border transfer controls (Section 16)
- Children's data protections (Section 9, if applicable)
- Grievance redressal mechanism (Section 13)
- DPIA methodology (Section 10(2)(c), if SDF)

## Related Articles

These resources are derived from StateCheck Security's DPDPA technical documentation:

- **[A1 — The DPDPA to ISO 27001 Mapping Guide](/blog/dpdpa-iso-27001-mapping)** — Full engineering guide with control-by-control analysis, code patterns, and Mermaid diagrams
- **[A2 — SOC 2 Privacy Criteria vs. DPDPA](/blog/soc-2-dpdpa-compliance)** — For SaaS companies with existing SOC 2 compliance

## Updates

This matrix will be updated as:
- Guidance is issued under the DPDP Rules 2025 (notified 13 Nov 2025, G.S.R. 846(E))
- MeitY issues new notifications or FAQs
- ISO 27001 Annex A controls are revised

Check the "Change Log" section in `dpdpa-iso-27001-mapping-matrix.md` for version history.

## Feedback

Found an error or have a suggested improvement? Contact us:
- **Email:** info@statechecksecurity.com
- **Website:** https://statechecksecurity.com

## Disclaimer

This mapping matrix is provided for educational and planning purposes. It is not legal advice. Consult qualified legal counsel for interpretation of DPDPA obligations and applicability to your specific circumstances.

---

**© 2026 StateCheck Security**