Data Privacy and Compliance Laws Compared: DPDP, GDPR, HIPAA, PCI DSS, ISO and the India Stack

Most businesses meet this question in the same messy way: a customer’s procurement form asks for a SOC 2 report, a payment provider mentions PCI DSS, a European client sends a GDPR questionnaire, and somewhere underneath it all sits India’s DPDP Act with a 2027 deadline. It is genuinely hard to tell which of these you are legally required to follow, which are contractual, and which are simply things good vendors buy to win deals. This guide sorts them out: what each one is, who it actually binds, what it costs you in practice, and how they overlap.

All commencement dates, framework versions and compliance deadlines on this page are stated as of September 2026. Several of these frameworks are amended frequently; verify against the official texts linked at the bottom before relying on any date.

The Short Version

If you read nothing else, read this.

Think of it like the paperwork for a shop. Some of it is the law — the licence you must have, whether you like it or not. Some of it is a condition of doing business with someone — the mall won't give you a unit unless you follow their rules. And some of it is a certificate you put on the wall because customers trust it. All three are worth having. Only the first one gets you prosecuted.

Not sure which of those apply to you? The free DPDP checker asks a few questions about your business and tells you in about two minutes — no signup, no sales call.

Most small Indian businesses need the first three and nothing else. The rest arrive only when a particular customer, a card network, or a regulator brings them to your door. And here is the part that surprises people most: none of the certificates on that list make you DPDP compliant. You can hold every one of them and still be breaking Indian law, because not one of those audits ever looks at your signup form.

First, the Distinction That Explains Everything

Before comparing anything, separate the frameworks into three kinds. Almost every confusion in this area comes from treating them as interchangeable when they are not.

• Law. It binds you because a legislature said so. You cannot decline it, negotiate it, or satisfy it with a certificate. A regulator enforces it and the penalty is a statutory one. The DPDP Act is law. So is the IT Act.
• Contract. It binds you because you signed something, or because you joined a network whose rules you accepted. PCI DSS is the clearest example: no Indian statute mentions it, but every card network requires it, and your acquiring bank passes that requirement to you. A HIPAA Business Associate Agreement works the same way.
• Certification. Nobody makes you do it. You do it because customers ask, or because it shortens enterprise sales cycles. ISO 27001 and SOC 2 are here. They are evidence of good practice, not compliance with a privacy law.

The practical consequence: a certification can never discharge a legal obligation. An ISO 27001 certificate is a real asset in a procurement conversation and worth nothing as a defence before the Data Protection Board, because the Board will ask whether your consent notice met Section 5, and no ISO auditor ever looked at it.

The Master Comparison

Every framework in this guide, side by side. Detail on each follows below.

The India Stack: What Is Actually Law Here

Start here, because this is the part that binds an Indian business whether or not it ever sells abroad.

The DPDP Act 2023 and the DPDP Rules 2025

India’s general personal data law. It applies to processing of digital personal data within India, and, under Section 3(b), to processing outside India connected with offering goods or services to people in India. There is no revenue floor, no user-count threshold, and no requirement that anyone pay you: a free signup form counts.

The obligations that matter for most businesses are notice before collection, consent that is free, specific, informed and unconditional, the ability to honour access and erasure requests, reasonable security safeguards, and breach intimation. The DPDP Rules 2025 (G.S.R. 846(E), notified 13 November 2025) supply the procedure, and the core obligations commence on 13 May 2027. Penalties run to ₹250 crore for the most serious category; see the penalties guide for how the categories divide.

If you are unsure whether it reaches you at all, the short answer is that it almost certainly does; our guide on whether DPDP applies to your business works through the edge cases.

If that describes you, the 14-step DPDP compliance checklist is the practical version of this — what to do, in order, with a free one-page PDF you can work through.

The IT Act 2000 and the SPDI Rules 2011

This is the framework that governs Indian businesses today, and it is the one most often assumed to be already dead. It is not. Section 43A of the Information Technology Act 2000, together with the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules 2011, requires a body corporate handling sensitive personal data (passwords, financial information, health data, biometrics, sexual orientation) to maintain reasonable security practices, and makes it liable to pay compensation for negligence that causes wrongful loss.

Section 44(2) of the DPDP Act omits Section 43A and the SPDI Rules, and that omission takes effect on 13 May 2027, the same day the core DPDP obligations commence. Until then both frameworks coexist, and the SPDI Rules remain enforceable. One practical difference worth noting: the SPDI Rules do define a category of “sensitive” personal data with stricter handling. The DPDP Act does not. It treats all personal data under one standard, with the government empowered to notify stricter treatment later.

The CERT-In Directions, April 2022

Widely under-observed, and the shortest deadline in Indian compliance. Issued on 28 April 2022 under Section 70B(6) of the IT Act, these directions require every service provider, intermediary, data centre and body corporate to:

• report listed cyber incidents to CERT-In within six hours of noticing them;
• retain ICT system logs for 180 days, stored within India;
• synchronise system clocks to the NIC or NPL network time servers;
• maintain designated points of contact for CERT-In.

Note how this interacts with DPDP. The statutory duty to report a personal data breach sits in Section 8(6) of the Act; Rule 7 of the DPDP Rules 2025 supplies the procedure — tell affected individuals without delay, give the Board an initial intimation without delay, then detailed particulars within 72 hours. A breach at an Indian company can therefore trigger both a six-hour CERT-In report and, from May 2027, the Section 8(6) and Rule 7 obligations. They are separate filings to separate authorities on separate clocks. Our breach notification guide covers the DPDP side in detail.

Sector regulators: RBI, SEBI, IRDAI

If you are regulated, your regulator’s rules sit on top of everything above and are usually stricter.

RBI. The April 2018 circular on Storage of Payment System Data requires payment system operators to store end-to-end transaction data only in India. This is unaffected by the DPDP Act’s comparatively permissive approach to cross-border transfers, because Section 16(2) expressly preserves stricter sectoral requirements. RBI also runs separate directions on IT governance, outsourcing of IT services, and digital lending.

SEBI. The Cybersecurity and Cyber Resilience Framework (CSCRF) consolidated SEBI’s earlier cyber circulars into one graded framework for regulated entities, with compliance dates through 2025 that were extended more than once by category of entity. It brings structured audit reporting and mandatory security operations arrangements.

IRDAI. Insurers and intermediaries follow IRDAI’s information and cyber security guidelines, including audit and reporting obligations.

The Global Privacy Laws

GDPR — the European baseline

The most influential privacy law in the world, and the one the DPDP Act is most often measured against. It applies if you are established in the EEA, or if you offer goods or services to people there, or if you monitor their behaviour.

Two differences matter most to an Indian business. First, lawful basis: the GDPR offers six, and legitimate interests carries a great deal of ordinary marketing and analytics. The DPDP Act offers consent plus a narrow list of legitimate uses in Section 7, with no general legitimate-interests basis, so a European programme does not port over unchanged. Second, penalty structure: GDPR fines scale to 4% of global turnover, while DPDP penalties are fixed rupee ceilings that fall much harder on a small company in relative terms. The full DPDP vs GDPR comparison works through all eight material differences.

HIPAA — United States health data

HIPAA is narrow and frequently misunderstood in India. It is US federal law covering protected health information held by covered entities (US health plans, health care clearinghouses, and providers who transmit health information electronically for billing) and by the business associates who process that information for them.

An Indian hospital treating Indian patients is not a HIPAA covered entity. What brings HIPAA to India is service work for US healthcare: medical transcription, revenue-cycle management, coding, teleradiology, clinical SaaS. In those cases the obligation reaches you through a Business Associate Agreement, which is a contract. Since the HITECH Act, business associates also face direct statutory liability. Its Security Rule requires administrative, physical and technical safeguards; its Breach Notification Rule sets a 60-day outer limit for notifying affected individuals, which is a far longer clock than either CERT-In or DPDP.

Indian healthcare providers are instead governed by the DPDP Act, the IT Act and SPDI Rules, and clinical record-keeping requirements under National Medical Commission regulations. Our healthcare DPDP guide covers what an Indian clinic or hospital actually needs.

CCPA and CPRA — California

California’s consumer privacy law, amended by the CPRA, applies to for-profit businesses that serve California residents and cross one of its thresholds: broadly, large annual revenue, large-scale handling of consumer personal information, or deriving substantial revenue from selling or sharing it. Its distinctive feature is the right to opt out of the sale or sharing of personal information, which is why “Do Not Sell or Share My Personal Information” links appear on US sites. It is an opt-out regime by default, where the DPDP Act and the GDPR are opt-in. Several other US states now run comparable laws.

COPPA — American children's data

Worth knowing if you build anything used by children. COPPA is US federal law regulating online services directed at children under 13, or general services that knowingly collect data from them. It requires verifiable parental consent before collection, enforced by the Federal Trade Commission.

Note the mismatch with India: the DPDP Act treats everyone under 18 as a child, and prohibits behavioural tracking and targeted advertising at them outright. So an Indian ed-tech company serving both markets is running two different age lines at once — 13 for its American users, 18 for its Indian ones — and the Indian rule is the stricter of the two.

The Security Frameworks

PCI DSS — payment cards

PCI DSS is not a law anywhere. It is the Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council on behalf of the card networks, and it reaches you through your acquiring bank or payment provider. If you store, process or transmit cardholder data, it applies in India exactly as it does in the United States.

The current version is 4.0.1, published June 2024; the future-dated requirements introduced in v4.0 became mandatory on 31 March 2025. Its twelve requirement areas are concrete and technical: network segmentation, no vendor-default passwords, encryption of cardholder data in transit and at rest, vulnerability management, access control, logging, testing, and a security policy.

Scope is the whole game here. If your checkout hands the customer to a gateway’s hosted page or iframe and card numbers never touch your systems, your obligations shrink to the lightest self-assessment questionnaire, mostly confirming that your provider is compliant and that card numbers never leak into your logs, emails or support tickets. If your own page collects the card number first, you are in scope properly. Note also that PCI DSS says nothing about consent, notice or erasure. It secures card data; it does not make you DPDP compliant.

ISO/IEC 27001 and ISO/IEC 27701

ISO/IEC 27001 is the international standard for an information security management system. You are certified by an accredited body after an audit, in a three-year cycle with annual surveillance. It is a management-system standard rather than a control checklist: it asks whether you have identified your risks, chosen controls deliberately, assigned ownership, and review the whole thing on a schedule.

ISO/IEC 27701 is the privacy counterpart. This one has changed materially and it is worth being current: the 2019 edition was an extension you could only apply on top of ISO 27001, and it has been withdrawn. The 2025 edition is a standalone standard. You can now certify a privacy information management system without holding ISO 27001 first, and it adds modern guidance on cloud, AI-related processing, biometrics and health data.

For an Indian business preparing for DPDP, ISO 27701 is the closest available certification to the Act’s subject matter, and its control set maps well onto DPDP’s security and governance obligations. It still does not certify DPDP compliance, and nothing does, because the Act creates no certification scheme.

SOC 2

Not a certification and not a law: a SOC 2 report is an attestation written by a CPA firm under AICPA standards, describing your controls against the trust services criteria: security, and optionally availability, processing integrity, confidentiality and privacy. A Type I report tests design at a point in time; a Type II tests operating effectiveness across a period, typically three to twelve months, and is the one enterprise buyers actually want.

SOC 2 is prevalent in Indian SaaS because US buyers ask for it. It is the fastest way to satisfy enterprise procurement and, unlike ISO, produces a detailed report rather than a certificate, which is why it is shared under NDA rather than displayed on a website.

Where They Overlap, and Where They Do Not

The good news for anyone facing several of these at once: the operational core is shared. Build it once and it serves nearly everything.

That middle row — notice in the individual's chosen language — is the one businesses most often discover late. Section 5(3) gives every customer the option of English or any of the 22 Eighth Schedule languages, and no ISO or SOC 2 audit will ever mention it. Our free consent notice generator writes one for your business in 23 languages; it runs entirely in your browser, so nothing you type is sent to us.

Read the bottom three rows carefully, because they are the reason a security certificate does not carry you. Consent before collection, notice in the individual’s chosen language, and erasure on withdrawal are the heart of the DPDP Act, and no security framework on this page asks for any of them. A company with ISO 27001, SOC 2 Type II and PCI DSS in hand can still be squarely non-compliant with the DPDP Act on 13 May 2027, because none of those audits ever looked at its signup form.

The breach row deserves the same attention, because the clocks do not agree with each other. One incident can start several at once, and they run at different speeds.

So Which Ones Apply to You?

Work down this list. Each answer is independent of the others.

For most Indian SMBs the honest answer is short: the DPDP Act, the SPDI Rules until 2027, and the CERT-In directions. Everything else arrives only if a customer, a card network or a regulator brings it.

If you sell software across borders and the question is the other way round — which of the world's privacy regimes your product triggers — our companion guide comparing global data privacy laws: GDPR, DPDP, CCPA, LGPD, PIPL and the rest puts twelve of them side by side, with the consent defaults, breach clocks and transfer rules that differ between them.

A Sensible Order of Work

If several of these apply, do not run them as separate projects. They share too much.

1. Know what you hold. One inventory of personal data: what you collect, why, where it lives, who you share it with, how long you keep it. Every framework here starts from this, and doing it once serves all of them.
2. Satisfy Indian law first. It is the one you cannot decline. Notice and consent for DPDP — the consent notice generator gives you the notice itself — security practices for the SPDI Rules, and a CERT-In reporting process with someone named to run it.
3. Add contractual obligations as they arrive. PCI DSS when card data enters your systems; a BAA when a US healthcare client signs; GDPR work when European customers do.
4. Buy certification when it is being asked for. SOC 2 or ISO 27001 when procurement forms start blocking deals. Not before, and never as a substitute for step two.

Three Free Tools to Start With

All three are free, need no signup, and are built for the step they name.