Srida IT Consulting & Services · Live Online · Admissions open

ISO/IEC 27701 & Core DPDPA — Live Implementation Program

In 45 live mornings, build an ISO/IEC 27701 Privacy Information Management System and operationalise India’s DPDPA — as one programme. Law, build, implement, audit.

THE LAW → BUILD THE PIMS → IMPLEMENT → AUDIT

45 live sessions · ~45 hoursMon–Fri · 7:30–8:30 AM IST100% Remote · live on ZoomLaw → PIMS → Implement → AuditVerifiable certificateStarts 16 Nov 2026

Enrol & Pay — ₹25,000 →WhatsApp us for the brochure

₹25,000, all-inclusive — all 45 live sessions + certificate. The batch begins 16 November 2026, Mon–Fri, 7:30–8:30 AM IST.

Why this program

One privacy programme — the standard and the law, together

Most teams run ISO 27701 and DPDPA as two disconnected efforts. They are the same programme: the DPDPA sets the legal duty, and ISO/IEC 27701 gives you the management system and the controls to meet it and evidence it. This program builds that single system — understand the law, stand up the PIMS, implement the controls, and audit the evidence. What you build carries straight across to ISO 27001 and the rest of your compliance.

Understand the law

The DPDPA and the DPDP Rules — the duties you must actually meet.

Build the PIMS

An ISO/IEC 27701 management system on your ISO 27001 base.

Implement the controls

Notice, consent, rights, retention, encryption, logging, vendors.

Audit the evidence

RoPA, DPIA, SoA, control tests — and a readiness assessment.

The 45-day journey

From the law to an audited privacy programme

Part 1 · Foundations & the Crosswalk (Days 1–6)

Day 1	The privacy landscape & why a PIMS	DPDPA and ISO/IEC 27701 as one operating system for privacy, not two projects.
Day 2	ISMS in one hour — the ISO 27001 base	The information security management system that a 27701 PIMS extends.
Day 3	DPDPA at a glance	The Act, the DPDP Rules, and exactly who they bind.
Day 4	ISO/IEC 27701 structure	PIMS requirements plus the PII controller and processor control sets.
Day 5	Mapping the two together	Where each DPDPA duty lands on a 27701 control — your single crosswalk.
Day 6	Scope, context & roles	Data Fiduciary / Processor, controller / processor, and the PII principal.

Part 2 · Core DPDPA — the Law & its Duties (Days 7–16)

Day 7	Principles & lawful grounds	The processing principles and the grounds the DPDPA actually allows.
Day 8	Notice, consent & withdrawal	What a valid notice and consent must do — and how withdrawal works.
Day 9	The Consent Manager model	How consent is captured, managed and evidenced under the Rules.
Day 10	Data Principal rights	Access, correction, erasure, grievance and nomination — operationally.
Day 11	Duties & grievance redressal	The duties that bind everyone, and the grievance mechanism you must run.
Day 12	Significant Data Fiduciary & the DPO	SDF obligations, the DPO role, and when they are triggered.
Day 13	Children's & special-category data	Verifiable parental consent and the heightened duties that apply.
Day 14	Breach notification under DPDPA	What counts, who you tell, and in what form and time.
Day 15	Cross-border transfer & localisation	The transfer checks and restrictions you have to clear.
Day 16	Penalties, the Board & enforcement	The Data Protection Board, the penalty regime and what drives exposure.

Part 3 · ISO/IEC 27701 — Build the PIMS (Days 17–28)

Day 17	PIMS leadership, policy & objectives	Set the privacy policy, objectives and governance the PIMS runs on.
Day 18	Privacy risk assessment & treatment	Assess privacy risk to PII and build the treatment plan.
Day 19	RoPA — records of processing	Build the processing inventory the whole programme reads from.
Day 20–21	PII controller controls (Annex A)	Work through the controller control set and how to evidence each one.
Day 22	PII processor controls (Annex B)	The processor control set — for when you handle data on others' behalf.
Day 23	Privacy by design & by default	Bake protection into systems and processes from the start.
Day 24	DPIA — impact assessment	Run a Data Protection Impact Assessment end to end.
Day 25	Consent & choice controls in practice	Turn the consent model into working controls and records.
Day 26	Purpose, retention & minimisation	Collect only what you need, for a purpose, for a defined time.
Day 27	Third-party & processor assurance	How the PIMS governs the vendors and processors you depend on.
Day 28	Statement of Applicability for privacy	Produce the SoA that ties your controls back to the requirements.

Part 4 · Implementation & Operations (Days 29–39)

Day 29	Build the notice & consent mechanics	Stand up real notices, consent capture and withdrawal flows.
Day 30	Data mapping & discovery	Find the PII, map the flows, and keep the map current.
Day 31	Retention schedules & deletion	Operational retention and defensible, evidenced deletion.
Day 32	Access control & identity for PII	Least privilege, reviews and privileged access over personal data.
Day 33	Encryption, masking & pseudonymisation	Protect PII in transit and at rest; reduce exposure by design.
Day 34	Logging, monitoring & privacy metrics	What to log, how to protect it, and the metrics leadership needs.
Day 35	Processor & vendor contracts	Binding processors by contract and flowing obligations down.
Day 36	Rights / DSAR handling workflow	A workflow that answers data-principal requests within time.
Day 37	Breach response & notification ops	Detect, contain, assess, notify the Board and people, and learn.
Day 38	Awareness & privacy culture	Make privacy stick across the teams that touch personal data.
Day 39	Privacy in change & projects	Embed DPIA and privacy gates into change and delivery.

Part 5 · Audit, Evidence & Certification Readiness (Days 40–45)

Day 40	Internal audit of the PIMS	Plan and run an internal audit against 27701 and the DPDPA.
Day 41	Evidence packs & control testing	Assemble the evidence an auditor will actually ask for.
Day 42	Mock DPDPA readiness audit	A full readiness assessment against the Act and the Rules.
Day 43	ISO 27701 Stage 1 / Stage 2 readiness	What the certification body checks, and how to be ready.
Day 44	Gap closure & management review	Close findings and run the management review that signs it off.
Day 45	Capstone + certificate	Present your PIMS + DPDPA programme — then your certificate.

~9 weeks · one hour each morning · Mon–Fri from 16 November 2026. (Order may adjust for public holidays.)

Who it’s for

Anyone building real privacy capability

✓Privacy, DPO and data-protection leads building a real programme
✓IT, security & GRC professionals implementing 27701 / DPDPA controls
✓Compliance, risk & internal audit teams who must evidence privacy
✓ISO 27001 practitioners extending their ISMS to a PIMS
✓Founders / SME owners who hold customer personal data

What you’ll be able to do

Outcomes by the end

✓Build an ISO/IEC 27701 Privacy Information Management System (PIMS) on an ISO 27001 base
✓Operationalise the DPDPA — notice, consent, rights, grievance, breach and SDF duties
✓Map every DPDPA obligation to a concrete 27701 control, with one crosswalk
✓Produce RoPA, run a DPIA, and write the privacy Statement of Applicability
✓Implement access, encryption, retention, logging and vendor safeguards over PII
✓Run a data-principal rights / DSAR workflow and a breach-notification process
✓Audit the PIMS — gather evidence, test controls and reach a conclusion
✓Be ready for a DPDPA readiness assessment and an ISO 27701 Stage 1 / Stage 2

Admissions open

Join the November batch

₹25,000, all-inclusive — all 45 live sessions and your certificate. The batch begins 16 November 2026. Enrol and pay online; we confirm your seat by email once the payment is verified.

Enrol & Pay — ₹25,000 WhatsApp us

Mon–Fri · 7:30–8:30 AM IST · Live on Zoom · from 16 November 2026

Good to know

Questions

What's the fee and how do I enrol?

The program is ₹25,000, all-inclusive — all 45 live sessions and a verifiable certificate. Enrol and pay online from the Enrol page; our team confirms your seat by email once the payment is verified. You can also WhatsApp us for the brochure first.

Do I need ISO 27001 or privacy experience?

No. We build the ISO 27001 base and the privacy context as we go. Some IT, security or compliance familiarity helps, but it isn't required.

Is this theory or hands-on implementation?

It's an implementation program. You build the PIMS artefacts — RoPA, DPIA, SoA, control evidence — and operationalise the DPDPA, not just study the clauses.

Does this certify me in ISO 27701?

You receive a verifiable Certificate of Achievement from Srida IT Consulting and Services Pvt. Ltd. It recognises practical capability and prepares you for a 27701 certification audit; it is not itself an accredited ISO certification, and it is not legal advice.

What if I miss a session?

Every session is recorded and shared, so you can catch up and revise anytime.

Program content is educational and does not constitute legal advice. The DPDP Act and DPDP Rules, and ISO/IEC 27701, are referenced for teaching; confirm the current text and your specific applicability before relying on anything for compliance or certification. Certificate of Achievement issued by Srida IT Consulting and Services Pvt. Ltd.