It is estimated that there are around 5000 active professionals in India who are certified as Lead auditors for conducting ISO 27001 audits. The actual number may be higher and there are a number of persons who are not active as auditors but have gone through the certification process.
With the release of ISO 27701:2025 as a certifiable audit, many of them are now equipping themselves to take up the ISO 27701 audit and there will be many clients in EU who would ask their data processors in India whether they are certified under ISO 27701.
It is therefore time to discuss how companies in India should respond to these queries particularly when the Indian DPDPA 2023 is getting ready for implementation and professionals need to be ready to be DPOs in India and Data Auditors for Indian Significant Data Fiduciaries.
With the increased use of AI in business, AI related risks for Data Fiduciaries is a reality and the risk is considered unpredictable and therefore significant. Hence the number of Significant Data Fiduciaries in India is likely to be very large and we need thousands of DPOs and hundreds of Data Auditors.
I therefore urge professionals to think whether they should no prioritize for Indian DPO training or ISO 27701 training.
At FDPPI, we are interested in making existing ISO 27001 auditors in India to upgrade themselves to be DPDPA auditors first before anything else. It is our desire that during 2026-27, at least 1000 ISO 27001 auditors should be certified as C.DPO.DA. professionals (Certified Data Protection Officer and Data Auditor).
Kindly remember that the foreign vendors who ask us about ISO 27701 audits need to be informed that
- If I am an Indian Data Processor for a EU Data Controller and am processing the personal data with a GDPR stake, I will take such steps as are necessary to mitigate the risk of GDPR non compliance to levels which are significantly low
- We shall initiate measures of security which are recommended under DPDPA to ensure that the risks are reduced substantially which will be suitably insured.
In the meantime train atleast one of your designated DPOs under FDPPI to be a C.DPO.DA. so that you can understand and implement measures to be compliant with the laws of India.
Since getting a ISO 27701 certificate is not an insurance against data risks, the measures to be initiated by us under DPDPA 2023 shall be enough assurance against the risks envisaged for which the vendor is suggesting ISO 27701.
Naavi
