What Rule 13 Requires
Rule 13 of the DPDP Rules, 2025 mandates that every Significant Data Fiduciary shall undertake a Data Protection Impact Assessment (DPIA). The assessment must evaluate: the rights of Data Principals likely to be affected, the purpose and means of processing, the categories and volume of personal data involved, the risk of harm to Data Principals, and the measures to manage and mitigate identified risks. The DPIA must be conducted periodically — not as a one-time exercise.
Who Must Conduct a DPIA
DPIAs are mandatory only for Significant Data Fiduciaries designated under Section 10. However, non-SDF entities have a strong practical reason to conduct DPIAs: Section 8(4) requires every Data Fiduciary to implement "reasonable security safeguards." A DPIA is the most robust evidence that security safeguards are reasonable and proportionate. In enforcement proceedings, a company that conducted a DPIA and implemented its recommendations has a significantly stronger defence than one that did not.
DPIA Methodology: Six Phases
Phase 1: Scope Definition. Identify the specific processing activity to be assessed. A single DPIA should cover one processing activity or a closely related set. Company-wide DPIAs that attempt to cover all processing are too broad to be useful and fail to satisfy the specificity requirement.
Phase 2: Data Mapping. For the processing activity in scope, map: what personal data is collected, from whom (which categories of Data Principals), for what purpose, through what collection mechanism, where it is stored, who has access, where it is transferred, and when it is deleted. This mapping is the foundation — an inaccurate data map produces an unreliable DPIA.
Phase 3: Necessity and Proportionality Assessment. For each category of personal data collected, assess: is this data necessary for the stated purpose? Could the purpose be achieved with less data? Is the processing proportionate to the benefit achieved? Data minimisation under the DPDPA is not just a principle — it is embedded in the consent requirements of Section 6(3).
Phase 4: Risk Assessment. Identify risks to Data Principals: unauthorised access, data loss, data manipulation, identity theft, discrimination, financial harm, reputational damage. For each risk, assess: likelihood (based on current controls), impact (severity of harm to the Data Principal), and residual risk (after existing mitigations). Use a structured risk matrix — qualitative assessments without structured methodology will not withstand regulatory scrutiny.
Phase 5: Mitigation Measures. For each identified risk, specify the mitigation: technical controls (encryption, access controls, pseudonymisation), organisational measures (policies, training, incident response), contractual safeguards (Data Processor Agreements), and monitoring mechanisms. Each mitigation must be linked to a specific risk and assigned to a specific owner with a implementation timeline.
Phase 6: Documentation and Review. The DPIA report must be documented in sufficient detail for the independent data auditor (Rule 12) and the Data Protection Board to evaluate. Include: the assessment methodology, data maps, risk assessments, mitigation measures, residual risk acceptance decisions, and the review schedule. The DPIA must be reviewed periodically and updated when processing activities change.
Common Mistakes in DPIAs
1. Treating the DPIA as a compliance checkbox rather than a genuine risk assessment. 2. Using generic risk categories without mapping to specific processing activities. 3. Failing to involve technical teams in the data mapping phase. 4. Not documenting residual risk acceptance decisions. 5. Conducting the DPIA after processing has begun rather than before. 6. Not updating the DPIA when processing activities change.