Secure · Governance, risk and compliance
ISO/IEC 27701:2025 privacy information management for Indian organisations that hold personal data and must show how they govern it. NetScale maps the personal data, sets purpose and retention, builds the controls for processors and breaches, and prepares the certification audit. Evidence stays current between audits, and NetScale holds the certificate for its own operations.
ISO 27701
ISO/IEC 27701:2025 is the international standard for a privacy information management system (PIMS): how an organisation decides what personal data it holds, why, for how long and who else handles it.
Since the 2025 edition it can be certified on its own or alongside ISO/IEC 27001. Its controls cover organisations that decide how personal data is used, and those that process it on someone else’s behalf.
It is the closest recognised standard to the duties in India’s DPDP Act. A certificate shows the management system meets the standard, which is not the same as a finding that you meet the law.
The DPDP Act’s technical duties, standard or not, sit under DPDP readiness.
The information security standard it is often certified alongside sits under ISO 27001:2022.
Vendors and processors rated on one risk register sit under Enterprise risk management (ERM).
Personal data was collected to serve customers. Years later it is still there. Who decided when it gets deleted?
Our answer: Purpose and retention
Customer data moved to a new cloud region last year. Where is that transfer recorded?
Our answer: Data residency
A customer asks what personal data you hold about them. How long would the answer take?
Our answer: Personal data mapping
Enterprise clients ask for a privacy certificate before they sign. What do you send them?
Our answer: Audit preparation
Privacy information management system implementation and audit, aligned to DPDP and data protection requirements.
Where personal data enters, is stored, is used and leaves, system by system and process by process, recorded in one data map.
A purpose and a retention period for each kind of personal data, with deletion owned by a named person and recorded when it happens.
Processors identified, contracts checked for privacy terms, and their access to personal data reviewed and recorded.
Storage and processing locations, cloud regions and transfers outside India recorded in the data map and checked against contracts and sector rules.
Personal data breaches logged, assessed and notified under one procedure, with the DPDP and CERT-In duties written into it.
An internal audit of the privacy management system and support through the certification audit, with the evidence ready to show.
One management system, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
The Rules were notified on 13 November 2025, and the substantive duties apply from 13 May 2027. They include breach intimation to the Data Protection Board and the people affected without delay, with a detailed report to the Board within 72 hours, which the breach procedure is written to meet.
The DPDP Act lets the government restrict transfers to notified countries. Sector rules, such as the RBI’s on payment data, can require storage in India. The data map records every location and transfer.
We build the privacy controls and keep the evidence. Legal interpretation of the Act and the Rules stays with your counsel.
Personal data in scope: the processes, systems and records that hold it, and how much has been mapped.
Role: whether you decide how personal data is used, process it for others, or both, which changes the controls that apply.
Starting point: whether an ISO 27001 system already exists to build on.
Certification: whether you certify at all, and the certification body’s fees, which are separate from implementation.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Co-working · Two Indian cities
How a co-working space operator measured its readiness under India’s Digital Personal Data Protection Act and scoped the work to close the gaps.
Cloud platform and identity
Email security and awareness
Privileged access managementOur own: ISO/IEC 27701:2025
ISO/IEC 27001 covers how you protect information; ISO/IEC 27701:2025 covers how you govern personal data. 27701 adds its own requirements for mapping, purpose, retention, processors and breach handling. Since the 2025 edition it can be certified on its own or alongside 27001. We run the two as one system ourselves.
Yes, since the 2025 edition. ISO/IEC 27701:2025 is a management system standard in its own right, so it can be certified on its own or alongside ISO/IEC 27001. Running both together often saves work, because personal data needs the same security controls 27001 asks for. The gap assessment shows which route suits you.
It depends on scope and starting point: which personal data, systems and processes the certificate covers, and how much of an ISO 27001 system or privacy evidence already exists. The gap assessment gives you a written timeline by phase before you commit. Each phase is fixed-scope and signed off separately.
No. A certificate shows your privacy management system meets the standard; DPDP compliance is a legal question under the Act. ISO/IEC 27701:2025 covers much of the same ground: mapping, purpose, retention, processors and breach handling. Where the Rules go further, such as telling the Data Protection Board and the people affected about a breach without delay and sending the Board a detailed report within 72 hours, the programme adds it.
It depends on what your clients’ contracts ask for. ISO/IEC 27701:2025 has controls for organisations that process personal data on someone else’s behalf, as well as for those that decide how it is used. A GCC or a service provider can use it to show a parent or client how its data is handled.
Where personal data enters, lives and leaves, why it is held, for how long, which vendors process it and how a breach would be handled. Each area is compared against ISO/IEC 27701:2025 and written up with what is missing. The assessment is free, and the findings are yours whether we work together or not.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
