The DPDP Act for certification bodies: what changes by May 2027

The dates

The personal data a certification body holds

• Client contacts. Names, roles, emails and phone numbers of the management representative and other contacts at every certified organisation.
• People at audit. Names and roles of the people interviewed, recorded in audit reports and nonconformities.
• Auditors and technical experts. CVs, qualifications, training records, identity documents, bank details for fees, and competence evaluations.
• Complaints and appeals. The people who raise them and the people they concern.
• Your own staff and website enquiries. Including sales enquiries and demo requests.

Some of this is processed on consent, some for legitimate uses the Act recognises, such as employment. Work out which applies to each category before May 2027, because it decides what notice you give.

What the Rules require of you

Notice

Where you rely on consent, give a notice that stands on its own, in plain language, listing the personal data and the purpose for each item, and how the person can withdraw consent or complain (Rule 3). Auditor application forms and client application forms are the obvious places.

Security safeguards and logs

Reasonable security safeguards, including encryption or equivalent measures, access control, and logs that let you detect and investigate unauthorised access, kept for at least one year (Rule 6). The Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards.

Breach reporting

If a personal data breach occurs, tell each affected person without delay, and tell the Data Protection Board without delay, followed by a detailed report within 72 hours (Rule 7). The Act allows penalties of up to ₹200 crore for failing to notify.

Retention and erasure

Erase personal data once the purpose is served, unless the law requires you to keep it (section 8(7)). Your accreditation and legal record-keeping obligations still apply, so write down the retention period for each record type and the reason for it.

Your software vendors

You remain responsible for personal data processed by your vendors on your behalf, and you may only engage a Data Processor under a valid contract (section 8). Ask each vendor for a data processing agreement, where the data is hosted, and how quickly they will tell you about a breach, because their clock is part of yours.

Where the data lives

The Act does not require personal data to stay in India. It allows the government to restrict transfers to countries it notifies. For a certification body, keeping client and auditor records in India is still the simplest position to explain to clients, auditors and assessors.

Certyze hosts customer data on Amazon Web Services in Mumbai, with a separate database for each certification body. Hosting, security and data protection

A short plan for the next six months

1. 1

   Map the data. Each category above: where it is held, who can see it, the basis for processing, and how long you keep it.

2. 2

   Fix the notices. Auditor and client application forms first.

3. 3

   Write the incident procedure. With both clocks: CERT-In in six hours, the Board and affected people without delay.

4. 4

   Check your vendors. Data processing agreements, hosting location, breach notice period and log retention.

5. 5

   Check your logs. Access logs for systems holding personal data, kept for at least a year.