ISO 27001, SOC 2, GDPR: Certifications Indian Startups Need

Which certification for which buyer

Overseas enterprise buyers use certifications as a shortcut in vendor reviews. The ones Indian startups meet most often:

Security: ISO 27001 and SOC 2

ISO/IEC 27001 certifies an information security management system. The 2022 edition is now the only valid one: certificates to the 2013 version had to transition by 31 October 2025 or lapse ¹².

SOC 2 is not a certification but an auditor's report against the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy ⁵. A Type 1 report describes controls at a point in time; a Type 2 report tests how they operated over a period, in practice usually three to twelve months ⁶. US buyers generally want Type 2, so start the observation period early.

Payments and health data

Startups that touch card data need PCI DSS. Version 4.0.1, published in June 2024, made no new requirements, and the requirements that had been future-dated took effect on 31 March 2025 ⁷.

For US health data, HIPAA requires covered entities and their business associates to sign contracts that ensure protected health information is safeguarded ⁸. Medical device makers need FDA clearance, usually a 510(k), submitted at least 90 days before selling ¹⁴. In the EU, devices certified under the old rules have until the end of 2027 or 2028 to move to the Medical Device Regulation, depending on class ¹⁵.

Privacy and AI law

The GDPR applies to companies outside the EU that offer goods or services to people in the EU or monitor their behaviour ⁹. The maximum fine is €20 million or 4% of worldwide annual turnover, whichever is higher ¹⁰.

The EU AI Act entered into force on 1 August 2024; its prohibitions applied from 2 February 2025 and its rules for general-purpose AI models from 2 August 2025 ¹³. An amending regulation that entered into force on 27 July 2026 moved the deadline for stand-alone high-risk AI systems to 2 December 2027, and for AI in regulated products to 2 August 2028 ¹¹. It also extended some small-business relief to companies with fewer than 750 staff and turnover of up to €150 million ²³. The heaviest fines reach €35 million or 7% of global turnover ¹².

India's own rules

• Digital Personal Data Protection: the DPDP Rules were notified on 14 November 2025 with an 18-month phased timeline ¹⁷. Most obligations, including notice and consent, security safeguards and breach reporting, apply from May 2027 ¹⁸. A proposal to shorten the timeline had not been notified as of September 2026 ¹⁹. The highest penalty is up to ₹250 crore ¹⁷.
• CERT-In: specified cyber incidents must be reported within six hours of being noticed, and logs kept for a rolling 180 days, under directions issued in April 2022 ²⁰.
• STQC, under MeitY, provides testing and third-party certification for software quality and information security ²¹.
• MSMEs can get 50% to 80% of the fees for the government's ZED quality certification subsidised, depending on size ²².

Other credentials

B Corp certification, for companies that want to show social and environmental performance, moved to new standards in 2026 and is valid for five years ¹⁶.

Getting it done: what we see work

Our observations from hiring for startups going through their first certifications:

• Pick the one certification your largest prospects ask for and do that first; most controls carry over to the next.
• Name an owner. A security or compliance lead, even part-time, gets a first audit done far faster than a shared responsibility.
• Budget for the people as well as the audit: certifications usually create ongoing work in security, IT and HR.