SOC 2 by region
SOC 2 in India: readiness for the report your US clients ask for, with DPDP Act and CERT-In duties built in
What is different about SOC 2 in India: why US clients ask Indian service organisations for the report, who can issue it, how GCC and offshore delivery shape the scope, and how DPDP Act safeguards and CERT-In directions fit the controls.
Key points
- SOC 2 in India is usually a requirement from abroad: US buyers of Indian IT services, SaaS and BPO delivery ask for the report in vendor security reviews.
- No Indian body issues or registers SOC 2 reports. A licensed CPA firm examines and reports under the AICPA attestation standards, or an equivalent practitioner reports under ISAE 3000; check who will sign before you sign.
- The DPDP Act, 2023 keeps reasonable security safeguards in force even for much offshore processing; build them into the controls the CPA firm samples.
- The CERT-In directions of 28 April 2022 add 6-hour incident reporting and 180-day log retention within India, which your system description should reflect.
Why Indian companies pursue SOC 2
The request rarely starts in India. A Bengaluru product company closing its first US enterprise deal or a Mumbai back office onboarding an American client meets the same line in the vendor security review: send your latest SOC 2 report. SOC 2 is better known in North America than in most other markets, so US security and procurement teams treat it as the default evidence, and an ISO/IEC 27001 certificate alone may not close the questionnaire.
Global capability centres feel it differently. The parent often holds its own report and expects the Indian centre to sit inside it, or to produce evidence the parent's CPA firm can sample. For how SOC 2 and ISO/IEC 27001 divide the work, see SOC 2 vs ISO/IEC 27001.
Who issues a SOC 2 report for an Indian company
SOC 2 has no accreditation body, certificate register or Global ACI route, in India or anywhere else. The report is an attestation: a licensed CPA firm examines your controls against the AICPA Trust Services Criteria and gives its opinion. Outside the United States, an equivalent practitioner may report on the same criteria under ISAE 3000, and some clients accept that report while others name a CPA firm in the contract.
So read what your largest clients require first, then ask each proposed firm for its licence details, its peer review status, the categories and system it will examine and the period it proposes, and confirm them with the firm directly. Sterling does not issue SOC 2 reports; we prepare you for the firm you choose. The questions to put to a firm are in choosing a SOC 2 service auditor.
Local practice that changes the project
Offshore delivery and the DPDP Act
Many Indian service organisations process personal data of people outside India under contracts with foreign clients. Section 17(1)(d) of the DPDP Act disapplies much of Chapter II and Chapter III for that processing, but not section 8(1) or the reasonable security safeguards in section 8(5). Where you process data of people in India, as a Data Processor for an Indian client or as a Data Fiduciary, the fuller duties apply as the main provisions commence in May 2027, including breach details to the Data Protection Board of India within 72 hours under Rule 7. Map these to your incident, logging and vendor controls once, so one set of evidence serves both. Where privacy is a category in scope, the DPDP Act compliance for companies in India guide covers the programme itself.
CERT-In directions
The 2022 directions under section 70B(6) of the Information Technology Act, 2000 apply to service providers, intermediaries, data centres, body corporates and government organisations. Incident response must allow for reporting the listed incident types to CERT-In within 6 hours of noticing them, and ICT logs must be kept for a rolling 180 days within Indian jurisdiction, with clocks synchronised to NIC or NPL time sources or sources traceable to them. Your system description must match what these directions already require.
GCCs, client networks and carve-outs
Indian teams often work on client networks and tools, or under a parent's group policies. The system description must say which controls the Indian entity operates, which belong to the parent or the client, and which sit with cloud providers treated as subservice organisations. Without that, an access review or joiner-leaver sample stalls on who owns the control.
Working to a US examination calendar
Evidence requests arrive on US time. Name control owners in each Indian location and agree response times with the firm.
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Who signs the report | A licensed CPA firm, or an ISAE 3000 practitioner if your clients accept one | Your client contracts and security requirements, and the firm's own licence and peer review details |
| DPDP Act section 8(5) safeguards | Security safeguards apply even to much offshore processing under section 17(1)(d) | The Act text published by the Ministry of Electronics and Information Technology |
| DPDP Rules 6 and 7 | Logs kept at least one year; breach details to the Board within 72 hours | The DPDP Rules, 2025 published by the Ministry of Electronics and Information Technology |
| CERT-In directions of 2022 | 6-hour incident reporting, 180-day logs held in India, approved time sources | The directions published by CERT-In |
| Parent or client controls | Carve-outs and complementary controls must be written into the system description | The group policy set, the master services agreement and the parent's own SOC report |
How Sterling works in India
Sterling runs Indian engagements from its Navi Mumbai office, with consultants on site in Mumbai and other cities and working remotely where that suits the client. The team draws on an international practice of 8,100+ client engagements in 60+ countries since 2003. Sterling does not issue the report: an independent CPA firm examines your controls and gives the opinion.
How Sterling supports Indian service organisations
Controls your US clients, the DPDP Act and your CPA firm can all rely on
We scope the system with your delivery and engineering teams, run the gap analysis against the criteria and your Indian obligations, build the evidence calendar in Effivity, train control owners and test readiness before the period, then stay with you through fieldwork. We ensure a successful SOC 2 examination for our clients.
Book a free discovery callSOC 2 in India: questions buyers ask
Will US clients accept an ISAE 3000 report instead of SOC 2?
Some will and some will not. Check each major client's contract before you appoint a firm; a report the client rejects does not close the review.
Does a SOC 2 report make us compliant with the DPDP Act?
No. A SOC 2 report is an opinion on your controls, not a finding of legal compliance, but the same safeguards, logs and breach procedure can serve both if you design them that way.
Does the DPDP Act apply if we only process foreign clients' data?
Partly. Under section 17(1)(d), much of the Act does not apply to data of people outside India processed under a contract with a foreign party, but section 8(1) and the reasonable security safeguards in section 8(5) still do.
Can our GCC in India be covered by the parent's SOC 2 report?
Yes, if the parent's CPA firm includes the Indian centre in the system and period it examines. Otherwise the centre needs its own scope, with the parent's controls described as carve-outs or complementary controls.
SOC 2 by region
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 readiness in Australia
- SOC 2 for healthcare IT and health BPO
- SOC 2 for payroll companies, HR platforms and staffing firms
- SOC 2 implementation plan
- SOC 2 readiness in India
- SOC 2 for managed service providers and data centres
- SOC 2 readiness in the Netherlands and Europe
- SOC 2 policies and evidence
- SOC 2 readiness in Singapore and South East Asia
- SOC 2 readiness in the Philippines
- SOC 2 readiness in the United Kingdom
- SOC 2 readiness in the UAE and GCC
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 readiness in India with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice