What Is This Module For?
The DPIA module helps you conduct Data Protection Impact Assessments — mandatory for high-risk processing activities under the DPDP Act 2023.
Which Law Requires This?
- DPDP Act 2023, Section 10(2)(d) — Significant Data Fiduciaries must conduct a DPIA annually or before undertaking high-risk processing.
- DPDP Rules 2025, Rule 12 — Specifies the content requirements for a DPIA including risk identification, mitigation measures, and DPO consultation.
Note: Even if you are not yet designated a Significant Data Fiduciary, conducting DPIAs for high-risk processing is best practice and demonstrates accountability.
Step-by-Step Guide
- Go to DPIA in the sidebar under DPDP Compliance.
- Click "New DPIA" — link it to a specific processing activity from your ROPA.
- Describe the processing — purpose, data categories, data subjects, retention period.
- Assess necessity and proportionality — is the processing limited to what is necessary?
- Identify risks — dcomply provides a checklist of common DPDP-specific risks.
- Record mitigation measures for each identified risk.
- Consult the DPO — record the DPO's name, date of consultation, and their opinion.
- Mark as complete — the DPIA is locked and timestamped for audit purposes.
Common Mistakes to Avoid
- Conducting the DPIA after the fact — DPIAs must be done before the processing activity begins.
- Not consulting the DPO — DPO consultation is mandatory under Rule 12 for Significant Data Fiduciaries.
- Treating DPIA as a one-time exercise — Review the DPIA whenever the processing activity changes significantly.
Frequently Asked Questions
Q: Does every processing activity need a DPIA?
A: No. DPIAs are required for high-risk processing — large-scale processing of sensitive data, automated decision-making, and processing involving vulnerable groups.
Q: Who conducts the DPIA?
A: The data controller (your organisation) conducts it, with the DPO providing consultation and oversight.