Data Protection Impact Assessment (DPIA)
A structured review of the privacy risks of a processing activity, and the steps to reduce them.
A data protection impact assessment is a written review you do before or during a risky use of personal data. It asks what could go wrong for the people involved and what you will do to prevent it.
Meaning of Data Protection Impact Assessment (DPIA)
Significant Data Fiduciaries must carry out a DPIA, and an audit, at least once every twelve months under Rule 13. Many other organisations run DPIAs voluntarily before launching new products or tools, because they show that risks were considered.
A Data Protection Impact Assessment (DPIA) is a structured exercise for understanding and managing the risk that a processing activity creates for individuals. It describes what personal data is used, why, by whom and for how long, identifies the ways the activity could harm people, such as discrimination, financial loss, loss of control or exclusion, evaluates how likely and severe each harm is, and records the measures chosen to reduce it. The focus is on risk to people, not risk to the company, though the two often overlap.
The Act uses the idea for one group. Section 10(2)(c) requires a notified Significant Data Fiduciary to undertake periodic Data Protection Impact Assessments, which it describes as a process comprising a description of the rights of Data Principals and the purpose of processing, assessment and management of the risk to those rights, and any other prescribed matters. Rule 13 sets the rhythm: a DPIA and an audit at least once every twelve months, with a report of significant observations furnished to the Board, plus due diligence on algorithmic software.
For other Data Fiduciaries, the Act does not make a DPIA mandatory. Still, Section 8(4) requires appropriate technical and organisational measures to ensure effective observance of the Act, and Section 8(5) requires reasonable security safeguards. A DPIA is a recognised way of choosing and documenting those measures, particularly for new technologies such as facial recognition, behavioural profiling, large-scale processing of children's data under Section 9, or sharing data with many processors. Many companies adopt the practice voluntarily and run it as a gate before launch.
A DPIA is easy to confuse with neighbouring tools. A security risk assessment looks at threats to systems. A data audit tests whether you are following rules in practice. A privacy-by-design review is a continuous habit, of which the DPIA is one checkpoint. The GDPR has a similar "DPIA" with defined triggers, but the DPDP Act has no equivalent list for ordinary fiduciaries, so each organisation must decide for itself when an assessment is warranted.
Examples of Data Protection Impact Assessment (DPIA)
Before launching a face-recognition attendance system, a company assesses the risks, alternatives and safeguards, and records the outcome.
A school plans a face-recognition attendance system. The DPIA records that children's [biometric data](term/biometric-data) raises serious risks under Section 9, finds that a card-based system meets the purpose with far less intrusion, and the school adopts the alternative.
A lending app wants to use phone-usage signals in credit scoring. The assessment notes risks of unfair exclusion and opaque decisions, so the company limits the signals used, adds human review of rejections and a clear route to question the outcome.
A large platform notified as a Significant Data Fiduciary runs its annual DPIA and audit, reviews its recommendation algorithm for risks to users' rights, and files a report of significant observations with the Board as Rule 13 requires.
Why Data Protection Impact Assessment (DPIA) matters
For a Significant Data Fiduciary, skipping the annual DPIA and audit breaches Section 10 and Rule 13, and the Schedule provides penalties of up to ₹150 crore for non-compliance with the additional obligations of a Significant Data Fiduciary. For every organisation, a poor decision in a new product, such as collecting data you cannot protect, can later surface as a security failure with a penalty ceiling of ₹250 crore.
The practical benefit is cheaper correction. Finding that an app would track children, or that a vendor cannot delete data, is far less costly at the design stage than after launch. The written record also gives the Board, auditors and enterprise clients evidence that the organisation thought about risks to people before acting.
How it works in practice
- 1Decide your triggers. Write a short rule, for example: new technology, large-scale data, children's data, automated decisions with significant effect, new sharing with third parties, or any activity a Significant Data Fiduciary notification covers. Any matching project must pass through assessment.
- 2Describe the processing. Document purposes, data items, sources, recipients, systems, locations, retention period and the legal ground, whether consent or a Section 7 legitimate use. Involve the product owner, engineers, security, legal and the Data Protection Officer or privacy lead.
- 3Identify and rate risks to individuals. List realistic harms, rate likelihood and severity, and consider the rights in Sections 11 to 14, such as how a person will access, correct or erase data and withdraw consent.
- 4Choose mitigations and record decisions. Options include collecting less data, shorter retention, encryption, pseudonymisation, human review of automated outcomes, clearer notices or dropping the feature. Note residual risk and who accepted it.
- 5Review and repeat. Track actions to completion, re-run the DPIA when the purpose, technology or scale changes, and, for a Significant Data Fiduciary, complete the annual cycle with the independent auditor and share significant observations with the Board.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the DPIA as a form filled after launch. It only works if it can still change the design, so schedule it before major build decisions are locked.
Writing generic risks copied from a template. Name the specific harms for this data and these people, with realistic likelihood and severity.
Assessing business risk only. A DPIA centres on risks to the Data Principal, even where those risks do not threaten revenue.
Filing the assessment and forgetting it. Revisit it when the purpose, vendor, data or scale changes.
Compliance tips
Keep a one-page DPIA template with fixed questions, so teams complete it quickly and results are comparable.
Give the Data Protection Officer or privacy lead the power to pause a launch until high risks have an agreed mitigation.
Keep a register of completed DPIAs and review dates. It doubles as evidence for the Board and for clients' due diligence.
Common questions about Data Protection Impact Assessment (DPIA)
Is a DPIA mandatory under the DPDP Act?
It is mandatory for notified Significant Data Fiduciaries under Section 10(2)(c), with an annual cycle under Rule 13. For other Data Fiduciaries the Act does not require it, but it is a sound way of documenting appropriate measures under Section 8(4).
What is the difference between a DPIA and a data audit?
A DPIA assesses the risks of a particular processing activity to individuals and plans mitigation, usually before launch. A data audit examines whether the organisation is actually complying with the Act and its policies. Significant Data Fiduciaries must carry out both at least yearly.
Who should carry out a DPIA?
Usually a cross-functional team led by the privacy lead or Data Protection Officer, with product, engineering, security and legal input. For Significant Data Fiduciaries, Rule 13 expects the assessor to report significant observations to the Board.