DPO-led · DPDP & ISO 27701 : DPDP is law. The deadline is May 2027. The clock is already running.
India’s Digital Personal Data Protection Act applies to nearly every organization handling personal data — and the heaviest obligations fall on Significant Data Fiduciaries (which most large BFSI firms will be). Full compliance and penalties — up to ₹250 crore for security failures — land on 13 May 2027.
Every Data Fiduciary must handle
- ·Standalone notices and consent
- ·Rule 6 security safeguards (encryption, access control, one-year log retention)
- ·72-hour breach notification
- ·Data-principal rights, retention and erasure
- ·Children’s data and processor contracts
Significant Data Fiduciaries add
- ·An India-resident Data Protection Officer
- ·An annual DPIA (Data Protection Impact Assessment)
- ·An annual independent data audit
- ·Algorithmic due diligence
From scoping to Maintained
- Scoping & SDF classification — are you in scope, and are you an SDF?
- Gap assessment & remediation across all baseline and SDF obligations
- DPO — India-resident coverage of the role
- Independent Data Audit readiness — Golonex prepares; the independent auditor audits
- Maintained status so you stay audit-ready year-round
Regulations tell you what; ISO 27701 lets you prove it.
We build a certifiable Privacy Information Management System — standalone, or integrated with your ISMS — the bridge between your security and privacy programs.
One management system, certifiable, satisfying GDPR, DPDP, and your customers’ due-diligence questionnaires at once.
Frequently asked questions
What is the DPDP compliance deadline? +
Full compliance and penalties under India’s Digital Personal Data Protection Act land on 13 May 2027. Penalties reach up to ₹250 crore for security failures. The clock is already running.
Do I need a Data Protection Officer under DPDP? +
If you are a Significant Data Fiduciary, yes — you must appoint an India-resident DPO. Other Data Fiduciaries must still provide a contactable grievance channel. Our DPO-as-a-Service provides India-resident coverage of the role.
How do I know if I’m a Significant Data Fiduciary? +
The government designates SDFs based on the volume and sensitivity of personal data you process and other risk factors. Most large BFSI firms are likely to qualify. We establish your scope and SDF status as the first step of a privacy readiness review.
Does ISO 27701 cover both GDPR and DPDP? +
ISO 27701 is a certifiable privacy management system — standalone since the 2025 edition, or integrated with your ISO 27001 ISMS and maps to both GDPR and DPDP. One management system can satisfy GDPR, DPDP, and customer due-diligence questionnaires at once.
DPDP delivery — the DPO of record, SDF scoping, RBI IS Audit readiness — runs from our India branch. India — DPDP, DPO & RBI →
Privacy obligations, owned by a name.
DPDP, ISO 27701, or GDPR — thirty minutes tells you what applies and who holds it.