We already run ISO 27001 for our clients. Is that DPDP compliance?

Not on its own. ISO 27001 evidence usually covers much of the Rule 6 security minimum, but the DPDP Act also requires a notice under Rule 3, valid consent, rights requests answered within ninety days, a published contact and a breach report to the Data Protection Board.

How do the CERT-In and DPDP breach timelines differ?

CERT-In Directions require a reportable cyber incident to be reported within six hours of being noticed. Under Rule 7 of the DPDP Rules, affected individuals and the Board are told without delay, and the detailed report to the Board is due within seventy-two hours of becoming aware.

Does Gevox replace our GRC platform?

No. Gevox covers the DPDP Act and Rules only, per client: the documents, registers, clocks and monitoring. Security frameworks and evidence collection stay in the tools you already use.

Can the deliverables carry our firm’s name?

Yes. Suite and Firm are white-label. The gap assessment and the monthly monitoring report carry your firm’s name in place of Gevox.

What does it cost per client?

Suite is Rs 14,999 a month for 40 client workspaces, which is Rs 375 per client. Firm is Rs 44,999 a month for 100 pooled client workspaces with seats for your team.

For practitioners

For GRC and information security consultancies

DPDP compliance software for GRC and information security consultancies

By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.

A GRC or information security consultancy already holds most of what the DPDP Rules ask for in security, from access control to logging; what the Act adds is the half that faces the individual: the notice, consent, rights requests within ninety days and the breach report to the Data Protection Board. Gevox gives the consultancy one workspace per client for that half, built on fixed checks that cite the provision, beside the ISO/IEC 27001 and SOC 2 work it already runs.

From the Gevox Readiness Index: Of twenty Indian firms that sell DPDP advice, sixteen run their own contact or intake forms through a third party without naming it. The technical obligations are the ones that get missed.

Where DPDP meets the work you already do

The security half of the Act will look familiar. Rule 6 sets the minimum safeguards under Section 8: encryption, masking or tokens mapped to the personal data, access control, logs and monitoring that let unauthorised access be detected and investigated, backups for continued processing, logs kept for one year, a security clause in every processor contract, and technical and organisational measures. Evidence a client holds for an ISO/IEC 27001 control set usually serves for most of it.

What is new is the half that faces the individual: a notice that meets Rule 3, consent under Section 6, the rights of access, correction, grievance and nomination in Sections 11 to 14, a published contact under Rule 9, and erasure once the purpose is served under Section 8. In a security-led programme this is usually the half with no artefacts yet, and it is the half the Board will ask about first.

Two regulators, two clocks

One incident can engage both regimes, and they do not run on the same clock.

CERT-In: under its Directions of 28 April 2022, a reportable cyber incident goes to CERT-In within six hours of being noticed, and ICT system logs are kept for a rolling 180 days in India.
DPDP: a personal data breach is intimated to each affected person and to the Board without delay, and the detailed report to the Board is due within seventy-two hours of becoming aware, under Rule 7.
Logs and associated personal data are kept for at least one year under Rule 6. A log policy set to 180 days for CERT-In is too short for the DPDP Rules.

What a DPDP engagement adds, client by client

Each client is a sealed workspace. What it holds:

A website examination in a real browser: twenty-two checks, recording the cookies, storage and third-party scripts the page actually loads, each cited to its provision.
A structured intake by link, so the client’s data map is entered once and feeds every document.
The notice, consent request, processor agreements, record of processing and retention schedule, drafted from that intake by fixed templates.
A rights and grievance register counting each request against the ninety-day ceiling in Rule 14, and a breach module running both Rule 7 standards from the moment of awareness. The generated breach response plan sets the CERT-In report beside them.
Monitoring that re-examines each client site on a schedule, with a monthly report of what moved.
A gap assessment the client can read, carrying your firm’s name on Suite and Firm.

What it does not do

It is not a GRC platform. It does not map SOC 2 or ISO/IEC 27001 controls or pull evidence from a client’s cloud accounts; keep that where it is. It does not give legal advice, and nothing it produces says a client is compliant. No language model decides a finding: the same site examined twice on an unchanged day gives the same result.

Where security evidence already covers Rule 6

The left column is the Rule 6(1) minimum. The middle column is where a security programme usually already holds evidence. The right column is what to check for DPDP.

Rule 6(1) safeguard	Usually evidenced by	What to check for DPDP
(a) Encryption, masking or tokens	Cryptography controls	That they apply to the stores holding personal data, not only to the systems.
(b) Access control	Identity and access management	Access to personal data reviewed, not only access to systems.
(c) Logs, monitoring and review	Logging and security monitoring	That access to personal data can be detected, investigated and remedied.
(d) Continued processing	Backup and business continuity	That backups cover the personal data stores.
(e) Retention of logs for one year	Log retention policy	At least one year, unless another law requires longer. Check settings made for 180 days.
(f) Processor contract clause	Supplier security clauses	A security clause in every processor contract, under Section 8(2).

Questions practitioners ask

We already run ISO 27001 for our clients. Is that DPDP compliance?: Not on its own. ISO 27001 evidence usually covers much of the Rule 6 security minimum, but the DPDP Act also requires a notice under Rule 3, valid consent, rights requests answered within ninety days, a published contact and a breach report to the Data Protection Board.
How do the CERT-In and DPDP breach timelines differ?: CERT-In Directions require a reportable cyber incident to be reported within six hours of being noticed. Under Rule 7 of the DPDP Rules, affected individuals and the Board are told without delay, and the detailed report to the Board is due within seventy-two hours of becoming aware.
Does Gevox replace our GRC platform?: No. Gevox covers the DPDP Act and Rules only, per client: the documents, registers, clocks and monitoring. Security frameworks and evidence collection stay in the tools you already use.
Can the deliverables carry our firm’s name?: Yes. Suite and Firm are white-label. The gap assessment and the monthly monitoring report carry your firm’s name in place of Gevox.
What does it cost per client?: Suite is Rs 14,999 a month for 40 client workspaces, which is Rs 375 per client. Firm is Rs 44,999 a month for 100 pooled client workspaces with seats for your team.