DPIA Under DPDPA: A Practical Guide to Data Protection Impact Assessments

A Data Protection Impact Assessment is a structured pre-mortem: before you process personal data in a new or riskier way, you assess what could harm the people behind the data and fix it while it is still cheap.

Who must, and who should

For Significant Data Fiduciaries, periodic DPIAs are a statutory duty under Section 10(2)(c), with cadence set by the DPDP Rules 2025 — and the results feed the annual audit. For everyone else the Act does not mandate DPIAs, but they are the standard mechanism to demonstrate the reasonable-safeguards duty of Section 8(5), and enterprise procurement teams increasingly ask for them.

When to trigger one

Run a DPIA when a processing change materially alters your risk surface:

• Launching a product/feature that collects new categories of personal data
• Processing children's data or data at high scale
• Deploying profiling, scoring or algorithmic decision-making on individuals
• Introducing new tracking or monitoring (including workplace monitoring)
• A significant new vendor, region or infrastructure for personal data
• Merging datasets originally collected for different purposes

A five-part DPIA that fits on eight pages

1. Describe — data categories, Data Principals, flows, retention, processors, purpose.
2. Necessity & proportionality — is each element needed for the purpose? What was the less-intrusive option and why was it rejected?
3. Risk identification — harms to Data Principals: breach exposure, misuse, exclusion, discrimination, detriment to children; likelihood × severity.
4. Mitigations — controls mapped to each risk: minimisation, encryption, access limits, retention cuts, consent design, vendor terms.
5. Decision & residual risk — sign-off by the DPO/owner, action list with owners and dates, review date.

Keep it proportionate: a two-page screening record for low-risk changes, a full assessment only where screening shows real exposure. A DPIA programme that takes six weeks per feature will be bypassed by your own product teams — the failure mode that matters most.

Making it continuous

Point-in-time DPIAs rot as products evolve. Vivek, Data Adhikaar's DPIA agent, screens every new and changed processing activity automatically — auto-filing the low-risk cases and preparing full assessments with mitigation tasks for the rest, all evidenced in the Vault for your auditor. Pair it with the compliance checklist and the readiness assessment.