Quick answer: ISO 27001 is the international standard for an information security management system. A certified provider has been audited on how it identifies, controls and reviews risks to the data it holds. For an EOR in India, that data includes Aadhaar and PAN details, bank accounts and payroll records, which the DPDP Act requires it to protect with reasonable safeguards.
- The current version, ISO/IEC 27001:2022, was published on 25 October 2022.
- Every certificate issued against the 2013 version expired on 31 October 2025.
- Annex A of the 2022 version lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological.
- Most security and breach-reporting duties under the DPDP Rules apply from 13 May 2027.
What does ISO 27001 actually certify?
A management system, not a product. The auditor checks that the provider has a working process to find risks, choose controls, monitor them and improve.
Annex A is the menu of controls. It covers access rights, encryption, supplier management, secure deletion, incident response and staff training, among others. The provider must justify each control it leaves out.
The ISO page for ISO/IEC 27001:2022 gives the standard’s scope. Certificates are issued by accredited certification bodies after an external audit.
So check the scope line. A certificate covering only a sales office abroad tells you nothing about the Indian team running your payroll.
How is ISO 27001 different from SOC 2?
ISO 27001 is a certification. SOC 2 is an attestation report.
| ISO/IEC 27001:2022 | SOC 2 | |
|---|---|---|
| Issued by | Accredited certification body | Licensed CPA firm (AICPA framework) |
| Output | Certificate | Report: Type 1 (design) or Type 2 (operation over a period) |
| Common in | India, Europe, Asia | United States |
| What you read | Certificate, scope and Statement of Applicability | The auditor’s report and any exceptions |
US buyers often ask for SOC 2 by default. Fair enough. An Indian EOR with ISO 27001 can usually answer the same security questionnaire if you read the scope and the Statement of Applicability alongside the certificate.
How does ISO 27001 support DPDP compliance?
It gives you evidence of reasonable safeguards. Section 8(5) of the DPDP Act requires a data fiduciary to protect personal data, including data a processor handles for it.
When you hire through an EOR, the EOR holds your team’s Aadhaar numbers, bank details, salary history and tax declarations, often for years after each person leaves. Under the MeitY text of the DPDP Act, penalties for failing to take reasonable security safeguards go up to ₹250 crore. Breaches need a detailed report to the Board within 72 hours.
ISO 27001 does not guarantee DPDP compliance. But it shows the provider runs the controls the Act expects. Laptops matter here too, which is why IT equipment provisioning and your HRIS belong in the audit scope.
How does Remunance protect your employee data?
Remunance is ISO/IEC 27001:2022 certified, so employee identity, bank and payroll data sit inside an audited security management system. We also provision and recover laptops for EOR staff, which keeps device controls under the same system. You can see our ISO certifications and read why certifications matter when choosing an EOR. For a copy of our certificate scope, request our security documentation.
What else do people ask about ISO 27001?
Is ISO 27001 mandatory in India?
No. It is voluntary. Clients often ask for it anyway.
How long is an ISO 27001 certificate valid?
Usually three years, with surveillance audits in between. Ask for the latest audit date as well as the certificate.
Is an ISO 27001:2013 certificate still valid?
No. They all expired on 31 October 2025.