DPDP certification: there is no official one, and the 1 thing the Rules do certify

There is no DPDP certification. The word certification appears 0 times in the DPDP Act 2023 and 0 times in the DPDP Rules 2025, the word accredited appears 0 times in both, and neither instrument names ISO 27001 or any other named standard. The 1 sentence in either text that uses the word certified is paragraph 9 of Part A of the First Schedule, and it certifies a Consent Manager's platform, not a company's compliance. Everything sold as a DPDP certification is a product built on top of the law, not a thing the law created. This page shows the text, counted and quoted, and then shows what the Rules require instead.

The counts, from the Gazette texts

The counts are over the English Gazette texts, the Act as printed by MeitY and the Rules in Gazette No. 760 as corrected by the corrigendum G.S.R. 892(E), which itself contains 0 of these words. Counted on 18 October 2026.

The 9 uses of certificate all mean the same thing, and it is not compliance. Section 7(b) lets the State process personal data

"for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed"

Section 7(b) of the DPDP Act 2023, Gazette page 6. Not in force until 18 months after 13 November 2025, computed 13 May 2027.

A certificate there is a document the State gives a person, a birth certificate or a caste certificate, and Rule 5 with the Second Schedule says how that processing works. Section 40(2)(e) is the rule making power for the same clause. That is the whole of the Act's vocabulary on certificates.

The 1 thing the Rules certify: a Consent Manager's platform

Paragraph 9 of Part A of the First Schedule is a condition an applicant must meet before the Data Protection Board registers it as a Consent Manager under Rule 4. The condition is:

"It is independently certified that — (a) the interoperable platform of the applicant to enable the Data Principal to give, manage, review and withdraw her consent is consistent with such data protection standards and assurance framework as may be published by the Board on its website from time to time"

First Schedule, Part A, paragraph 9(a), DPDP Rules 2025, Gazette page 32.

"appropriate technical and organisational measures are in place to ensure adherence to such standards and framework and effective observance of the obligations under item 11 of Part B"

First Schedule, Part A, paragraph 9(b), Gazette page 32.

Read it for what it does and does not say. 4 points follow from the text.

1. What is certified is the platform. The object of the sentence is the applicant's interoperable consent platform and the measures around it. A Data Fiduciary, which is every organisation that decides why and how personal data is processed, is not in the sentence at all.
2. The yardstick does not exist yet. The platform must be consistent with "such data protection standards and assurance framework as may be published by the Board on its website from time to time". As of 18 October 2026 this site has found no such framework published, which is consistent with the finding that no appointment to the Board has been located, tracked on Is the Data Protection Board operational?. Until the Board publishes one, there is nothing to certify against.
3. No certifier is named. The words are "independently certified". The paragraph does not say who certifies, what qualification the certifier needs, or whether the Board will approve certifiers. Compare rule 8(4) of the SPDI Rules below, which does say "duly approved by the Central Government".
4. The Board registers, it does not certify. Rule 4(2)(a) says the Board, if it is satisfied, is to "register the applicant as a Consent Manager, under intimation to the applicant, and publish on its website the particulars of such Consent Manager". The certification is 1 of the conditions the Board checks on the way to registration. The legal status a Consent Manager gets is registration.

Commencement matters here. Rule 1(3), as corrected by corrigenda G.S.R. 892(E), says "Rule 4 shall come into force one year after the date of publication in the Official Gazette", and paragraph (b) of G.S.R. 843(E) brings section 6(9) of the Act, the registration duty, into force on the same 1 year footing. The First Schedule has no commencement of its own; it operates through Rule 4. So the only certification in the framework is not in force until 1 year after 13 November 2025, computed 13 November 2026, interpretation until officially confirmed. Who needs to register at all is owned by Do you need to register as a Consent Manager?.

What the Rules require instead

For everyone other than a Consent Manager, the framework's answer to "how do I prove compliance" is not a certificate. It is responsibility, and for 1 class of organisation, an audit.

Section 8(1) of the Act makes a Data Fiduciary

"irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor."

Section 8(1) of the DPDP Act 2023, Gazette page 7. Not in force until 18 months after 13 November 2025, computed 13 May 2027.

The sentence is unconditional. It names no standard, no certificate and no audit that would discharge it, and "irrespective of any agreement to the contrary" is, on this site's reading, wide enough to cover an agreement with a certifying body. A certificate from any organisation is evidence an organisation may choose to keep; on this site's reading it is not a defence the Act recognises.

The 1 verification duty in the Rules belongs to a Significant Data Fiduciary alone. Rule 13(1) requires it, once in every period of 12 months from the date it is notified, to

"undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder"

Rule 13(1) of the DPDP Rules 2025, Gazette page 29. Not in force until 18 months after 13 November 2025 under Rule 1(4), computed 13 May 2027.

An audit is not a certification. The auditor reports significant observations to the Board under Rule 13(2); the Rules provide for no document issued to the organisation and no renewal, and the yardstick is "the provisions of this Act and the rules made thereunder", not a framework. Who must be audited and what the text does and does not prescribe about the auditor is on Data protection audit under the DPDP Act.

A registered Consent Manager's continuing duty is the same shape. Item 12 of Part B of the First Schedule says it

"shall have in place effective audit mechanisms to review, monitor, evaluate and report the outcome of such audit to the Board, periodically and on such other occasions as the Board may direct"

First Schedule, Part B, item 12, Gazette page 34.

So even the 1 actor that is certified at the door is audited afterwards, not re certified.

Stakeholders asked for certification or accreditation 4 times, and MeitY did not add it

This is not an oversight the drafters missed. MeitY's summary of the submissions received on the draft Rules, published on 14 January 2026, records the asks. In its section on the security safeguards rule, stakeholders wanted

"a mechanism for periodic third-party audits or certification to verify that organizations have properly deployed the necessary safeguards"

Summary of submissions received on the DPDP Rules 2025, MeitY, page 4.

In the section on retention and erasure, 1 ask was to

"Require issuance of a data deletion certificate to the Data Principal."

Summary of submissions, page 5.

And in the section on Significant Data Fiduciary duties, 2 more: an accreditation regime, with

"annual independent third-party audits (accredited by the Data Protection Board) for Significant Data Fiduciaries (SDFs)"

Summary of submissions, page 8.

and a self certification regime,

"Implementing periodic self-certification using a standardized checklist, with disclosures (e.g., quarterly) available to users or submitted to the Board."

Summary of submissions, page 8.

The Rules notified on 13 November 2025 contain none of the 4: no certification under Rule 6, no deletion certificate under Rule 8, no accredited auditors and no self certification under Rule 13. The summary is a record of what was asked, published by the ministry that wrote the Rules, and the gap between the asks and the Gazette text is the clearest evidence that the absence of certification is a choice.

The 1 Indian instrument that does name certification is not the DPDP Act

Search results for DPDP certification often lead to ISO 27001. The reason is a different law. Rule 8(2) of the SPDI Rules 2011, made under the Information Technology Act 2000, names IS/ISO/IEC 27001 as "one such standard referred to in sub-rule (1)", India Code page 5, and rule 8(4) says that a body corporate which has implemented that standard or an approved code of practice is deemed to have reasonable security practices

"provided that such standard or the codes of best practices have been certified or audited on a regular basis by entities through independent auditor, duly approved by the Central Government."

Rule 8(4) of the SPDI Rules 2011, India Code page 5.

That is a real certification mechanism in Indian law: a named standard, a deeming effect, and an auditor approved by the Central Government. 3 things about it matter for anyone searching for DPDP certification. It belongs to the 2011 Rules, which are still in force as at 18 October 2026, with the reason on the SPDI page, and not to the DPDP Act. It certifies an information security standard, not compliance with a data protection statute. And the DPDP Act, in section 8(1), attaches responsibility to the Data Fiduciary regardless of any such arrangement. An ISO 27001 certificate is evidence of security practice under the 2011 regime; it is not DPDP compliance, because the DPDP text has no such deeming rule.

What this means in practice

The 4 points below are this site's recommendations, not requirements of the text.

• Treat "DPDP certified" as a vendor's own construction. No body in India is authorised by the Act or the Rules to certify DPDP compliance, so the phrase describes the vendor's checklist, whatever its quality. Ask what was checked and against which provisions.
• If you are a Significant Data Fiduciary, the duty is an audit, not a certificate. Rule 13 fixes the cadence, 12 months, and the recipient, the Board. Spend on the audit the text requires before spending on a certificate it does not mention.
• If you are building a Consent Manager, watch the Board's website. Paragraph 9 only bites once the Board publishes its standards and assurance framework, and Rule 4 is not in force until 13 November 2026 on this site's computation. There is nothing to certify against today.
• Training and courses are useful and optional. The Act sets no professional qualification, certification or accreditation standard for a Data Protection Officer or for the independent data auditor of section 10(2)(b); the 1 condition on the auditor is independence. No course is a legal prerequisite for either role. A "DPDP certification course" certifies attendance at the course.

Questions this page gets asked

Is there a government DPDP certification? No. Neither the Act nor the Rules creates one, names a certifying body, or gives a compliance certificate any legal effect for a Data Fiduciary. The only certification in the framework is a condition of Consent Manager registration in First Schedule paragraph 9, and it is not in force until 13 November 2026 on this site's computation.

Does ISO 27001 make an organisation DPDP compliant? No. ISO 27001 appears 0 times in the DPDP Act and Rules. It is named in rule 8(2) of the SPDI Rules 2011, a separate instrument under the IT Act, where it supports a deeming rule about reasonable security practices. The DPDP Act has no deeming rule, and section 8(1) keeps the Data Fiduciary responsible irrespective of any agreement to the contrary.

Does a Consent Manager need to be certified? An applicant for registration must show its platform is independently certified against standards and an assurance framework the Board may publish, First Schedule paragraph 9. The Board then registers, under Rule 4. After registration the duty is audit and reporting to the Board under item 12 of Part B, not renewal of a certificate.

Verified against the Gazette texts on 18 October 2026. The counts and quotations above are from the English texts of the Act, the Rules as corrected, the commencement notification G.S.R. 843(E), MeitY's summary of submissions of 14 January 2026 and the SPDI Rules 2011 as published on India Code.