SOC 2 vs ISO 27001 vs DPDP: which one do you need first?

Every week someone asks me whether they need SOC 2 or ISO 27001, and every week the question is missing the framework that isn't optional. If your company processes personal data of people in India, the Digital Personal Data Protection Act applies to you, and Section 3 extends it to companies outside India that offer goods or services to people here.

My answer, without the usual hedging: comply with the law first, then pick the framework your largest revenue opportunity names, then build the second on the same foundation. I've run ISO 27001 and SOC 2 programs side by side, and the companies that suffer most are the ones that treated them as separate projects.

What each one actually is

SOC 2 is an attestation, not a certificate. A licensed CPA firm examines your controls against the AICPA Trust Services Criteria. Security is mandatory; availability, confidentiality, processing integrity and privacy are optional. A Type I report says your controls were designed properly on one date. A Type II report says they operated effectively over a period, usually three to twelve months. Enterprise buyers want Type II.

ISO 27001 is a certification. An accredited certification body audits your information security management system in two stages, and if you pass you hold a certificate for three years, with surveillance audits every year. The 2022 version has 93 Annex A controls in four themes: organisational, people, physical and technological. You select the ones your risk assessment calls for and justify the rest in a Statement of Applicability.

DPDP is a statute. It gives you obligations on notice, consent, security safeguards, breach reporting, children's data and the rights of the people whose data you hold. Most of the operational rules apply from 13 May 2027.

Who is asking for which

US enterprise buyers ask for SOC 2. If you sell SaaS into the US, not having it usually means not making the shortlist.

Buyers in Europe, India, the Middle East and most multinationals ask for ISO 27001. Indian banks and insurers increasingly expect it of their technology vendors.

Regulators don't ask for either. RBI, SEBI and IRDAI have their own requirements, and they sit on top of everything else if you're regulated.

If your team has ever told a prospect "we're getting SOC 2" when the prospect was a German manufacturer that wanted ISO 27001, you've seen how expensive the wrong first choice can be.

The order I recommend

If you process Indian personal data, start the DPDP work now: data map, notice, consent, breach process, rights handling. It is the law, and it is the smallest of the three for most companies.

Then look at your pipeline. Whichever framework your biggest pending deal names goes next. If you have a deal on a 60 day clock that needs SOC 2, a Type I gets you a report while the Type II observation period runs.

If nobody is asking yet, I'd start with ISO 27001. Its management system, risk assessment and internal audit make every later framework easier to add.

Build once, report many times

Access reviews, change management, incident response, vendor risk, encryption, logging and risk assessment appear in all of these, phrased differently. The compliance industry has historically billed each framework as its own project. It has never had a reason to tell you how much of the work overlaps.

Design your controls once, collect evidence once, and map it to each framework. That is what Steppe does on a single control set, and it's the first thing I'd test in any platform you're considering.

Pick your frameworks by who is asking and what the law requires, and refuse to pay for the same control twice.