Compliance Frameworks › DPDPA
DPDPA — India's data protection law, implemented properly the first time
SIRI Security and SIRI Law LLP run DPDPA compliance programmes end to end — consent architecture, Data Protection Officer setup, and breach notification readiness — for organisations processing Indian personal data.
62%Of cloud detections
6 HRCERT-In notification window
29.44LIncidents CERT-In handled
Why framework compliance is now board business
Live tracking · scroll to see every relevant change
Effective
31 JUL 2026
RBI's 2026 Framework sets a named compliance bar for commercial banks, raising the floor for every framework an organisation might already be certifying against.
Named requirement
SEBI CSCRF
SEBI's Cybersecurity and Cyber Resilience Framework applies its own certification and reporting obligations to regulated intermediaries, layered on top of ISO or SOC 2 work already underway.
Named requirement
DPDPA
India's Digital Personal Data Protection Act adds data-specific obligations that sit alongside, not inside, frameworks like ISO 27001 or SOC 2.
Baseline
6 HR WINDOW
CERT-In's breach-notification requirement applies regardless of which framework certification an organisation holds.
Global reach
MULTI-JURISDICTION
PDPL, PIPEDA, FADP, and CPRA extend similar obligations across the Gulf, Canada, Switzerland, and California — relevant wherever an organisation's customers or data actually sit.
The framework, mapped to what you actually run
What does DPDPA readiness involve?
The Digital Personal Data Protection Act, 2023 governs how Indian personal data must be collected, processed, and protected, with obligations around consent, purpose limitation, data fiduciary duties, and mandatory breach notification.
Because this is a legal obligation with technical implementation requirements, the programme runs jointly with SIRI Law LLP from day one — legal and technical work happening in parallel rather than sequentially, which is typically what compresses the timeline.
A certificate is not the same as a defensible control
Framework compliance is increasingly tested against real incidents and regulator review, not just an annual paperwork cycle — the gap between certified and defensible is where exposure lives.
SIRI Security delivers DPDPA to this standard directly — practitioner-led, documented, and connected to SIRI Law LLP's legal and regulatory response if a finding ever needs to go further.
What organisations get wrong
Four assumptions that undermine framework compliance
Most compliance gaps aren't about missing intent — they're about mapping a framework to controls that were never actually tested.
01 — SCOPE
“One certification covers all our obligations”
ISO 27001, SOC 2, and sector-specific frameworks like SEBI CSCRF or IRDAI overlap but rarely substitute for one another — each names its own evidence requirements.
02 — EVIDENCE
“Our policies are written, so we're compliant”
Auditors increasingly test whether documented controls are actually operating, not just whether the policy document exists.
03 — TIMELINE
“We can start the certification process closer to the deadline”
Gap remediation, evidence collection, and audit scheduling routinely take longer than expected — starting late is the most common cause of a missed certification cycle.
04 — SCOPE
“Our home jurisdiction's framework is all that matters”
Global customers or data flows can bring PDPL, PIPEDA, FADP, or CPRA obligations into scope even for an India-headquartered organisation.
What DPDPA covers
What's included, start to finish
Certification and re-certification support mapped to the framework's actual current requirements.
01
Consent architecture design
Consent capture, granularity, and withdrawal mechanisms that meet DPDPA's specific requirements.
02
Data Protection Officer setup
Establishing the DPO function and reporting structure where required.
03
Significant Data Fiduciary assessment
Whether your organisation meets the higher-obligation threshold, and what that means practically.
04
Breach notification readiness
A tested process for the notification timelines DPDPA and CERT-In both require.
05
Data Protection Board readiness
Documentation and processes positioned for scrutiny if a complaint or breach draws Board attention.
Evidence, not guesswork
No formal compliance vs. self-managed effort vs. a SIRI-supported programme
The difference shows up at audit time — and at renewal.
| Approach | No formal programme | Self-managed | SIRI DPDPA |
|---|---|---|---|
| Gap assessment before committing | No | Sometimes | Standard |
| Evidence collection support | None | Internal only | Structured, audit-ready |
| Multi-jurisdiction coverage | No | Rare | Assessed directly |
| Renewal/surveillance support | N/A | Ad hoc | Ongoing |
| Board-level reporting | No | Inconsistent | Included |
Sources: RBI (Commercial Banks — Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026; SEBI Cybersecurity and Cyber Resilience Framework (CSCRF); Digital Personal Data Protection Act, 2023; CERT-In 2022 Directions. Summarised for comparison; confirm current requirements applicable to your entity category and jurisdictions.
Numbers every board should know
What framework compliance is actually protecting against
62%
Of cloud detections
Trace to misconfiguration and IAM exploitation (DSCI) — exactly what framework controls are designed to close.
6 HR
CERT-In notification window
Applies regardless of which certification an organisation holds.
29.44L
Incidents CERT-In handled
In the latest reporting year — the backdrop every framework's controls are tested against.
70%
Of malware detections
Are trojans and file infectors (Seqrite 2026).
Why SIRI for DPDPA specifically
Compliance built by the team that also defends it
The evidence built for certification is the same evidence that holds up if a regulator or auditor ever tests it directly.
01
Programmes built by the team that files DPDPA and CERT-In notices
Sneha Iyer, Associate Partner and Head of GRC and Compliance, has delivered ISO 27001, SOC 2, and SEBI CSCRF programmes across the client base this catalogue serves.
02
Financial-sector frameworks covered directly
Deepa Menon, Senior Associate, advises banks, NBFCs, and payment aggregators directly on RBI licensing, SEBI CSCRF, and financial-sector cyber resilience.
03
Findings connected directly to legal exposure
SIRI Security runs under the same roof as SIRI Law LLP — when a finding carries real legal exposure, the engagement can be brought under attorney-client privilege from day one, not bolted on after the fact.
04
Technical controls verified, not just documented
Vikram Rao, SIRI's Head of Cybersecurity, directs offensive security and incident response and leads CERT-In breach containment for enterprise clients.
Who this is built for
Organisations this compliance service is built for
Banks, NBFCs & insurers
SEBI-regulated intermediaries
SaaS companies pursuing SOC 2
Organisations with multi-jurisdiction data flows
Enterprises facing a renewal or surveillance audit
How we work
From scoping to ongoing delivery
01
Gap Assessment
We assess your current state against every DPDPA control and score exactly where you stand today.
Week 102
Remediation & Implementation
We help you close the gaps — policy, technical control, and evidence — prioritised by audit risk and effort.
Weeks 2–303
Documentation & Evidence Package
Every control gets the documentation and evidence an external auditor or assessor will actually ask for.
Week 4+04
Audit Support & Certification
We support you through the external audit or assessment itself, and stay engaged through surveillance/renewal cycles.
OngoingFrequently asked
DPDPA, answered directly
How long does DPDPA implementation take?
For most mid-market organisations, 6 to 12 weeks from gap assessment to implementation, faster when legal and technical work run in parallel.
Are we a Significant Data Fiduciary?
This depends on volume and sensitivity of data processed, and criteria the government notifies separately — we assess this specifically for your organisation.
How long does certification typically take?
Most first-time certification programmes run 3 to 6 months depending on your current maturity and the framework; renewal/surveillance cycles are faster.
Do you do the audit, or prepare us for it?
We prepare you and support you through it — certification/audit itself is performed by an accredited independent body, which is what makes the certification credible.
Get certification-ready
Scope DPDPA.
Most engagements start with a gap assessment to confirm current posture against the framework's actual requirements.
Talk to SIRI Security: +91 79819 12046
Related