State of Compliance in India and the GCC: Research Plan

Security and compliance leaders in India and the Gulf Cooperation Council (GCC) member states face new and changing rules. They include the Digital Personal Data Protection (DPDP) Act 2023 and the DPDP Rules 2025 in India, the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) and the Saudi Central Bank (SAMA) Cyber Security Framework in Saudi Arabia, and federal and free-zone data protection laws in the UAE, alongside voluntary standards such as ISO/IEC 27001 and ISO/IEC 42001.

Purplecop Security plans to collect evidence on how organisations are responding, once, openly and with the method disclosed. The aim is a reference that can be quoted with its sample size, dates and limits attached. The report will not be a sales document.

1. How far along are organisations in India on DPDP Act 2023 readiness, ahead of the date the main obligations commence?
2. Could organisations meet the breach and incident-reporting clocks that apply to them, and do they know which clocks apply?
3. In Saudi Arabia, how do organisations in scope of the NCA ECC assess and evidence compliance?
4. In the SAMA-regulated financial sector, what maturity level do organisations say they have reached, and which domains are hardest?
5. In the UAE and the wider GCC, which data protection and cyber regimes do organisations believe apply to them, and how clear are their obligations?
6. How widely is ISO/IEC 27001 adopted, and how many certified organisations are on the 2022 edition?
7. How far have organisations got with AI governance, and are they considering ISO/IEC 42001?
8. Do organisations know where their logs and compliance records must be held, and where they are held?
9. How do teams manage evidence across several frameworks today, and what does the effort look like?
10. What are the biggest obstacles to compliance for security and compliance leaders in India and the GCC?

Three sources are being considered. Which of them will be used has not been decided.

• A survey of security and compliance leaders in India and the GCC.
• Optional aggregated benchmarks from the Purplecop One platform, used only where customers have given their consent.
• A dated analysis of public regulator publications.

• The list of tables and charts is fixed before fieldwork starts, so results are not picked afterwards.
• Every published number will state its denominator, method and date.
• The survey sample will not be random, so we will not describe the results as representative of India, the GCC or any sector, and we will not quote a margin of error.
• Platform benchmarks will describe only the customers who consented, not the market.
• Every table in the analysis plan will be published, including the unflattering ones.
• No figure will be shown for a group smaller than a published minimum size.
• Answers will be reported only in aggregate, and no free-text quote that could identify a person or organisation will be used.
• No regulator, standards body or partner will be presented as endorsing or contributing to the report unless that is true and agreed.

Fieldwork dates, the final list of countries, the survey languages and the publication date have not been set. We will update this page when they are.

Terms such as data fiduciary, DPDP Act 2023, NCA ECC, SAMA Cyber Security Framework and ISO/IEC 42001 are defined, with their sources, in our Compliance and security standards glossary.