Running a DPIA, step by step

A DPIA, in the DPDP Act, is a statutory duty for one class only: the Significant Data Fiduciary. Sec. 10(2)(c)(i) requires such a Fiduciary to undertake a periodic Data Protection Impact Assessment, and Rule 13(1) fixes it at once in every twelve months. Everyone else is not required by law to do one. For them it is a sensible way to find problems before the Board or a customer does, and this page says which parts are law and which are practice.

Who must do one, and who should

A Significant Data Fiduciary is a Data Fiduciary, or class of Data Fiduciaries, that the Central Government notifies under Sec. 10(1). The Act lists the factors it may weigh: volume and sensitivity of personal data, risk to the rights of Data Principals, and potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order. Size alone does not make you one. Notification does.

If you are notified, Sec. 10(2) also requires a Data Protection Officer based in India, an independent data auditor, and periodic audit. Rule 13(1) times the DPIA and audit together, once in every twelve months from the date of notification.

If you are not notified, nothing in the Act or Rules requires a DPIA. Running one anyway is worthwhile where you start high-risk processing: new profiling, large-scale children's data, a new vendor receiving sensitive data. The reason is practical. The risks the Act penalises, security under Sec. 8(5) above all, are cheaper to find on paper first. See how to avoid DPDP penalties.

What the Act says a DPIA contains

The text is short. Sec. 10(2)(c)(i) says the DPIA is a process comprising:

• a description of the rights of Data Principals and the purpose of processing their personal data;
• assessment and management of the risk to the rights of the Data Principals; and
• such other matters as may be prescribed.

The Rules prescribe no further content. They add three duties in Rule 13: the report to the Board in Rule 13(2), due diligence that algorithmic software used for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data is not likely to pose a risk to Data Principals' rights under Rule 13(3), and a localisation restriction on data the government specifies under Rule 13(4).

Anything beyond that structure, such as scoring scales or templates, is your method, not the law's. Do not describe it as a statutory format.

Step 1 to 3: scope, purposes and rights

Pick one processing activity per assessment. For each, write down the data items, the Data Principals, recipients including Data Processors, storage locations and retention. Your records of processing are the natural input; if you have none, the DPIA will expose that.

Then list each purpose and its ground: consent under Sec. 6 or a legitimate use under Sec. 7. For each, say how a Data Principal exercises access, correction and erasure, grievance and nomination under Sec. 11 to 14, and how she withdraws under Sec. 6(4). The Act asks for this description, so it is the part an auditor will check against reality.

Step 4 and 5: risk and mitigation

Take each purpose and ask what harm reaches the individual: unauthorised access, wrong decisions made on inaccurate data (Sec. 8(3)), data kept after withdrawal (Sec. 8(7)), a processor failing to erase, a child profiled. Rate each by likelihood and severity using a scale you define and keep consistent between years.

Then record the control against each, with an owner and date. Tie security items to Rule 6 and breach readiness to Rule 7, so the DPIA and your obligations point at the same measures. The security safeguards page lists what Rule 6 requires. Record residual risk honestly. A DPIA whose residual column is all "low" will not survive questions.

Step 6: report, audit and repeat

For a Significant Data Fiduciary, Rule 13(2) requires the person doing the DPIA and audit to give the Board a report of significant observations. Plan the twelve-month cycle from your notification date, not the calendar year. The substantive Rules, 13 included, commence on 13 May 2027 under Rule 1(4); check the date against the timeline.

Outside that class, rerun the assessment when the processing changes, not on a timer. A new vendor, purpose or data field is the trigger.

MyConsent+ has a DPIA module on its roadmap, not yet released; a free questionnaire is available now on that page. The law does not require a tool; a controlled document with owners works if you keep it current.