Conducting a Data Protection Impact Assessment
A methodological framework for Significant Data Fiduciaries to conduct Data Protection Impact Assessments in compliance with Section 10(2) of DPDPA 2023 and the DPDP Rules 2025.
Statutory Foundation
Section 10(2)(b) of DPDPA 2023 mandates that every Significant Data Fiduciary shall undertake a Data Protection Impact Assessment in relation to processing activities that are likely to pose significant risk to the rights of Data Principals.
Rule 13 of DPDP Rules 2025 prescribes the methodology, scope, and documentation requirements for conducting a DPIA.
When is a DPIA Required
A DPIA must be conducted prior to commencing processing activities that involve:
Large scale processing of personal data or sensitive personal data
Systematic monitoring of publicly accessible areas
Processing involving automated decision making with legal or significant effects
Processing of personal data of children on a large scale
Use of new technologies that may pose high risks to Data Principal rights
Profiling of Data Principals for targeted communications
Cross border transfer of personal data at scale
Any processing notified by the Central Government as requiring DPIA
DPIA Methodology
Describe the Processing
Document the nature, scope, context, and purposes of the proposed processing. Identify categories of personal data, Data Principals affected, data flows, retention periods, and third party involvement.
Assess Necessity and Proportionality
Evaluate whether the processing is necessary for the stated purpose and whether the scope of data collection is proportionate. Consider whether less intrusive alternatives exist.
Identify and Assess Risks
Systematically identify risks to Data Principal rights arising from the processing. Assess each risk for likelihood and severity. Consider risks of unauthorised access, loss, destruction, or misuse.
Identify Mitigation Measures
For each identified risk, determine appropriate technical and organisational measures to eliminate or reduce the risk to acceptable levels. Document the residual risk after mitigation.
Consultation
Where processing is likely to result in high residual risk despite mitigation measures, consult with the Data Protection Board prior to commencing processing.
Sign Off and Implementation
Obtain approval from appropriate governance body. Implement identified measures before commencing processing. Establish monitoring mechanisms to verify effectiveness.
Review and Update
Review the DPIA periodically and whenever there is a material change in the nature, scope, or risks of processing. Maintain version control and audit trail of all revisions.
Risk Assessment Framework
| Likelihood / Severity | Low | Medium | High |
|---|---|---|---|
| High | Medium | High | Critical |
| Medium | Low | Medium | High |
| Low | Low | Low | Medium |
Documentation Requirements
Compliance Timeline
DPIAs must be conducted prior to commencement of any processing activity that triggers the DPIA requirement. Retrospective DPIAs are required for existing high risk processing activities by 13th May 2027.
The completed DPIA must be submitted to the Data Protection Board upon request and shall be retained for the duration of the processing activity plus six years.
Disclaimer
This guidance is provided for informational purposes and does not constitute legal advice. The methodology presented should be adapted to the specific circumstances of each processing activity. Organisations should seek qualified legal counsel for specific compliance matters.