Compliance
Indian regulations, mapped to identity controls
Global vendors write compliance pages for GDPR and SOX. Your auditors ask about DPDP, RBI, SEBI CSCRF and IRDAI. Each hub below maps the regulation's actual identity requirements to specific IamLogic controls.
DPDP Act 2023
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 turn access control from good practice into statutory obligation. Rule 6 names the minimum safeguards every …
View the control mappingRBI Cybersecurity Framework
RBI supervision treats access control as a board-level concern: the Cybersecurity Framework for banks, the Master Directions on IT Governance and scale-based regulation for NBFCs a…
View the control mappingSEBI CSCRF
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF, 2024) consolidates cyber obligations for regulated entities — brokers, depositories, AMCs, exchanges and intermediaries …
View the control mappingIRDAI Guidelines
IRDAI's Information and Cyber Security Guidelines (2023) make insurers accountable — at board level — for controlling access to policyholder data across employees, agents and third…
View the control mappingISO 27001
ISO/IEC 27001:2022's Annex A dedicates a cluster of controls to identity: access control policy (5.15), identity management (5.16), authentication information (5.17), access rights…
View the control mappingHow it fits together
How identity controls support compliance
Most Indian regulations that touch cybersecurity ask the same identity questions in different words: who can access which systems, how they prove who they are, whether that access is still justified, and what record exists of each change.
IamLogic answers those questions with two products. Access Manager covers sign-in: single sign-on, multi-factor and passwordless authentication, and context-based policies. IamLogic IGA covers governance: joiner–mover–leaver automation, access certification, role management and segregation of duties.
Together they support your compliance programme with working controls and audit trails. They don't replace legal advice, and no product on its own makes an organisation compliant.
Who each one applies to
The regulations at a glance
DPDP Act 2023 and DPDP Rules 2025
Applies to organisations that process digital personal data in India. The identity areas it covers: access control for systems that hold personal data, logs of who accessed that data with monitoring and review, access logs kept for at least one year, and breach detection and reporting. IamLogic supports the access-control, logging and review parts with access policies, periodic access reviews and audit trails.
RBI Cybersecurity Framework
Applies to banks and NBFCs supervised by RBI, through the Cybersecurity Framework for banks, the Master Directions on IT Governance and scale-based regulation for NBFCs. The identity areas it covers: least privilege, multi-factor and context-aware authentication for sensitive access, periodic review of user access, segregation of duties and audit trails.
SEBI CSCRF
Applies to SEBI-regulated entities, including brokers, depositories, asset management companies, exchanges and other intermediaries. Its 'Protect' expectations cover role-based access control, MFA for critical systems and remote access, periodic review of access rights including privileged accounts, segregation of duties, and log retention.
IRDAI Guidelines
Applies to insurers, for access by employees, agents and third parties to policyholder data. The identity areas it covers: identity and access management across employees and intermediaries, MFA for critical applications and remote access, periodic access review with documented outcomes, prompt removal of access on exit or role change, and logging of access to sensitive data.
ISO/IEC 27001
Applies to organisations that are certified, or working towards certification. Annex A of ISO/IEC 27001:2022 groups its identity controls under access control (5.15), identity management (5.16), authentication information (5.17), access rights (5.18), and privileged access, information access restriction and secure authentication (8.2–8.5). IamLogic is itself ISO/IEC 27001 certified.
FAQ
Common questions
Does IamLogic make us compliant with DPDP, RBI, SEBI CSCRF or IRDAI?
No product can do that on its own: compliance depends on your policies, processes and people as well as your tools. IamLogic supports the identity and access parts of each regulation — sign-in controls, access reviews, lifecycle automation and audit trails — and each page linked above shows which control supports which requirement.
We answer to more than one regulator. Do we need separate controls for each?
Usually not. These regulations ask for many of the same identity controls: multi-factor authentication, periodic access review, timely removal of access and audit trails. One set of controls in IamLogic can support several frameworks, while your compliance team decides how each one is reported.
Can our identity data stay in our own data centre?
Yes. IamLogic can be deployed on-premises, keeping identity data, credentials and logs within your own infrastructure. Cloud deployment is also available.
Facing an inspection or a deadline?
Tell us the framework and the date. We'll show you which controls close which findings — and what a realistic deployment timeline looks like.