Do we need a Data Protection Impact Assessment?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)
Short answer: Required only for SDFs; good practice for high-risk changes
By law, only Significant Data Fiduciaries must do a yearly impact assessment. For everyone else it is good practice for high-risk changes: new tracking, profiling, large data sharing, children's data or moving data abroad. A short assessment before the change is cheaper than fixing it later.
Why it matters
Section 10 and Rule 13 require a yearly impact assessment for Significant Data Fiduciaries.
- Section 10 · Rule 13: The government may notify organisations as Significant Data Fiduciaries based on the volume and sensitivity of data and the risk involved. They need a DPO based in India, an independent data auditor, and a yearly impact assessment and audit. None had been notified when this page was last reviewed.
- Section 9 · Rules 10, 12: For anyone under 18, get verifiable consent from a parent or lawful guardian, and do not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule exempt some classes and purposes, for example clinical establishments and healthcare professionals to the extent needed to protect the child's health.
- Section 16 · Rule 15: Personal data may go outside India unless the government restricts a country. A sector law or regulator that sets a stricter rule still applies. No country had been restricted when this page was last reviewed.
A worked example
A hospital plans to share imaging with a research partner abroad. A two-page assessment records the data, purpose, transfer and safeguards, and the DPO asks for de-identification first.
Steps
- Define what counts as a high-risk change for you.
- Use a two-page template.
- Record the data, purpose, risks and safeguards.
- Get the DPO's view before approval.
- Keep it with the project record.
Evidence to keep
- Assessment template
- Completed assessments
- DPO views
Common mistakes
- Treating it as paperwork after launch
- A 40-page template nobody completes
- No trigger list
Who does what
- Chief compliance officer: Use impact assessments for high-risk changes even if you are not an SDF.
- CTO / Engineering head: High-risk features need an assessment before build, not after launch.
- Data and analytics head: Profiling and automated decisions deserve an assessment.
- Product head: New features that profile or track people need an assessment.
- Data and analytics department: Assess profiling.
What a good answer from management sounds like
“We assess high-risk changes before approval using a short template, and the DPO signs off.” Effort and time: Light per change.