India · DPDP, DPO & RBI : India obligations, delivered from India, under the same seat.
DPDP, RBI, CERT-In — the obligations are India-specific; the accountability is not. Our India branch delivers the DPO of record, the IS Audit readiness, and the RBI governance set under the same fractional leadership seat, with the same evidence discipline and the same signed monthly report.
DPDP is law. The deadline is 13 May 2027.
India’s Digital Personal Data Protection Act applies to nearly every organisation handling personal data, and the heaviest obligations fall on Significant Data Fiduciaries — which most large BFSI firms will be. Readiness runs the same way as every other review: scope, assess, close the gaps, assemble the evidence.
Every Data Fiduciary must handle
- ·Standalone notices and consent
- ·Rule 6 security safeguards — encryption, access control, one-year log retention
- ·72-hour breach notification to the Data Protection Board
- ·Data-principal rights, retention, and erasure
- ·Children’s data and processor contracts
Significant Data Fiduciaries add
- ·An India-resident Data Protection Officer
- ·An annual Data Protection Impact Assessment
- ·An annual independent data audit
- ·Algorithmic due diligence
The certifiable route — ISO 27701, standalone or integrated with your ISMS, mapped to DPDP and GDPR — is on the privacy readiness page →
What the DPO owns under the DPDP Act.
A named, India-resident Data Protection Officer must own each area below — not just advise on it. DPDP requires the DPO to be reachable by the Data Protection Board and accessible to data principals. Ours is a named individual in the India branch, not a shared offshore resource.
Data mapping & inventory
Oversees the data-flow mapping exercise — customer KYC, loan files, transactions, employee records, third-party sharing — and maintains the inventory and processing-purpose register.
Consent management oversight
Ensures purpose-specific consent notices are in plain language, consent is recorded with timestamp and purpose, and withdrawal mechanisms exist. Reviews consent audit trails for inspection.
Data-principal rights governance
Owns the grievance and request intake workflow, the response window the DPDP Rules set, and the request log for Data Protection Board inspection.
Breach notification
Leads the 72-hour notification to the Data Protection Board and prompt notice to affected data principals. Owns the breach log and post-incident review.
Data processing agreements
Reviews and signs off DPAs with every vendor who handles personal data — core banking vendors, cloud hosts, payment processors, credit bureaus.
DPDP staff training oversight
Commissions and monitors DPDP awareness training for all staff handling personal data, and maintains completion records for inspection.
Board interface
Attends board-level privacy reviews, presents DPDP compliance status, and fields Data Protection Board queries as the organisation’s named point of contact.
DPIA oversight
Conducts and reviews Data Protection Impact Assessments for new processing activities, new systems, and vendor onboarding involving personal data.
Three phases. Before, during, and after.
RBI requires banks and urban co-operative banks to undergo an annual Information Systems Audit by a CERT-In empanelled firm. Golonex does not perform the audit; we prepare you so the auditor reviews evidence that already exists.
6–8 weeks before the audit
Pre-audit gap assessment
- ·Review IT policies, ITSC/ISC charters, and the risk register against the RBI IS Audit checklist
- ·Score the BCSF controls, log-management coverage, and retention against the RBI expectations
- ·Verify BCP documentation, DR drill records, VAPT recency, and vendor-risk documentation
- ·Deliver a prioritised gap report with a remediation timeline
Weeks 4–8
Evidence pack compilation
- ·Compile policies, board and ITSC minutes, and access-review evidence into an auditor-ready folder
- ·Pull log-retention samples from each source, VAPT reports with retest evidence, and the BCP test report with MD/CEO sign-off
- ·Index the complete pack against the IS Audit checklist
Post-audit, 3 months
Remediation tracking
- ·Classify auditor findings by severity and root cause; build the action plan with owners and dates
- ·Track weekly, verify each closure with documentary evidence, and prepare the management response for board submission
- ·Update governance documents to address root causes
Ten to twelve weeks before the audit date is the right time to start. Six weeks is the minimum.
The governance set RBI examiners look for.
- Board-approved IT Policy drafted to RBI and CERT-In expectations
- IT Strategy Committee (ITSC) charter — membership, quorum, quarterly cadence, minute templates
- IT Steering Committee charter — escalation matrix, monthly cadence, decision authority
- IT risk register seeded with UCB-relevant risks — CBS availability, ransomware, CBS vendor dependency
- IT outsourcing policy and vendor-risk toolkit with India data-localisation clauses
- Quarterly board reporting pack for the ITSC
The framework-neutral governance program — policy suite, risk register, board pack, vendor risk — is on the GRC page →
Continuity and audit-trail requirements, covered.
- Secondary DR site, geographically separated from the primary data centre, to the RBI expectation
- Immutable backups with defined RPO/RTO targets, tested — not assumed
- Annual DR drill with a documented test report
- Written BCP with tabletop exercises, formatted for MD/CEO sign-off and board filing
- Log retention held to the CERT-In and RBI expectations, verified — the SOC itself is run by your vendor
Planned and tested through disaster recovery & business continuity → under security assurance →; your SOC vendor runs monitoring, overseen by the seat.
Empanelled-audit readiness and the 2022 directions.
CERT-In empanelled security audits are the mechanism RBI, SEBI, and IRDAI rely on. We prepare the scope, the environment, and the evidence so the empanelled auditor’s findings are few and closable — and we align your ISMS with the regulator’s cyber expectations so one control program satisfies RBI BCSF, ISO 27001, and DPDP together.
The CERT-In directions of April 2022 — six-hour incident reporting, 180-day log retention in India, and synchronised clocks — are written into the incident-readiness plan and verified against your monitoring vendor’s configuration. Golonex does not operate a SOC or provide incident response.
India — your questions, answered
What is the DPDP compliance deadline? +
Full compliance and penalties under India’s Digital Personal Data Protection Act land on 13 May 2027. Penalties reach up to ₹250 crore for security failures. The clock is already running.
How do I know if I am a Significant Data Fiduciary? +
The government designates SDFs based on the volume and sensitivity of personal data processed and other risk factors. Most large BFSI firms are likely to qualify. We establish your likely status in the scoping phase and plan for the SDF obligation set accordingly.
Is the DPO India-resident? +
Yes. DPDP requires the DPO to be reachable by the Data Protection Board and accessible to data principals in India. Our India branch provides a named, India-resident Data Protection Officer — not a shared offshore resource — who owns grievance intake, breach notification, the board interface, and DPDP compliance reporting.
What is the difference between IS Audit readiness and the IS Audit itself? +
The IS Audit is conducted by a CERT-In empanelled auditor appointed by your board. Golonex does not perform it. We prepare you — the gap assessment, the evidence pack, and the remediation tracking — so the audit becomes a review of documentation that already exists rather than a scramble to produce it.
Is this relevant for urban co-operative banks and NBFCs? +
Specifically. RBI requires UCBs to conduct an annual IS Audit by a CERT-In empanelled firm and to constitute an ITSC with an approved IT policy and a risk register. NBFCs carry the RBI IT framework for NBFCs and DPDP obligations of their own. The regulatory context differs; the compliance program structure is the same.
Who leads India engagements? +
The same seat. The seat holds the mandate; our India branch delivers the India-specific obligations — the DPO of record, the IS Audit readiness, the RBI governance documents — under that seat, with the same evidence discipline and the same monthly report.