Does ISO 27001 or NIST CSF cover our DPDP duties?

Short answer: They cover security, not the whole Act

They help a great deal with the security part. ISO/IEC 27001 and NIST CSF 2.0 are good evidence of reasonable security safeguards. They do not cover notice, consent, rights, complaints or children's data. ISO/IEC 27701 adds privacy controls, but no certificate replaces the Act.

What the law says

Section 8(5) and Rule 6 ask for reasonable security safeguards. A recognised standard is strong evidence of that duty, and only of that duty.

Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

Map your current controls to Rule 6.
Add the DPDP-only items: notice, consent, rights, complaints, children, retention.
Use the same evidence for audits and for DPDP.
Include privacy in the scope of your next internal audit.
Consider ISO/IEC 27701 if clients ask for it.

Evidence to keep

Control map
Audit reports
Gap list for DPDP-only items

Common mistakes

Treating a certificate as DPDP compliance
Scope that leaves out the systems with the most personal data
No owner for the non-security duties

How it plays out by sector

Banking, financial services and insurance: RBI, SEBI and IRDAI frameworks plus ISO 27001 cover most of Rule 6.
IT, ITeS, BPO and GCC: ISO/IEC 27001 is common in the sector; ISO/IEC 27701 adds privacy controls clients ask for.
Central government: ministries and departments: NIC and CERT-In guidelines plus ISO 27001 for integrators cover much of Rule 6.
Public sector undertakings and utilities: CEA guidelines and ISO 27001 cover much of Rule 6.
Healthcare and hospitals: NABH information management standards and ISO 27001 support Rule 6.

From each seat

CISO / Security head: Use the control map below. Most of Rule 6 is already in your ISO or NIST work; the job is to collect the evidence in one place.
CIO / IT head: Keep the mapping current as systems change. A new system without logging or access control undoes the work.
Chief risk officer: Use existing certifications as evidence, but record the DPDP duties they do not cover as their own risk lines.
Procurement department: Ask for current certificates and the latest audit summary, not just a logo on a slide.

What a good answer from management sounds like

“Our security controls are mapped to the Rules, and the privacy duties outside ISO have their own owners and evidence.” Effort and time: Light if you are already certified.