A privacy impact assessment, also called a data protection impact assessment (DPIA), is a written review of how a project will use personal data, what could go wrong for the people involved, and what you will do about it. Under India's DPDP Rules, an annual impact assessment is a stated duty for a particular class of company, the significant data fiduciary; for others it is good practice that also builds the evidence you will want if asked how you protect data.
Last reviewed: 17 October 2026. Facts checked. We searched PIB-hosted material and news summaries on the Digital Personal Data Protection Rules, 2025. PIB material says the Rules were notified on 14 November 2025 with an eighteen-month period for phased compliance; some other PIB releases give 13 November, so sources differ by a day. We could not open the PIB pages, the Gazette text or the meity.gov.in page from our tools, so the details below come from search summaries and secondary commentary, which we mark as such. We opened the UK ICO's DPIA guidance for the method. The ICO is a UK regulator and its guidance is not Indian law.
What the dates mean
The Rules were notified on 14 November 2025, and the phase-in runs for eighteen months. One government memorandum reported in search results says the first group of rules took effect on notification, one rule on 14 November 2026, and most of the working duties on 14 May 2027. We have not confirmed that schedule from the Gazette. Check the notified text for the rule that applies to you.
Our own readiness guide, DPDP Act audit readiness checklist for companies, covers the wider checklist. This article goes deep on one tool, the impact assessment.
Does the DPDP framework require a DPIA?
Be careful here, because many articles copy the European GDPR rule, which is different.
According to secondary commentary, Rule 13 of the DPDP Rules requires a significant data fiduciary to carry out a data protection impact assessment and an audit once in every twelve months from the date it is notified as one. The person doing the work must send a report to the Data Protection Board with significant observations. A significant data fiduciary is a company the government notifies as such, based on factors in the Act, so most companies will not be one. We have not read that rule in the Gazette, so confirm it before you rely on it.
We found nothing in our search to say that every company must run a DPIA for every project. We have therefore not stated one. If you are not notified, a DPIA is a voluntary control, though a useful one.
Why do one anyway
- It forces you to find personal data you did not know you held.
- It records why you collect each item, which helps answer a customer or the Board.
- It catches problems before launch, when fixing them is cheap.
- It gives audit evidence of due care.
When to run one
Start before you build or buy. The ICO advises beginning before processing starts and running alongside the project plan. Typical triggers in an Indian company:
- A new HR, payroll or attendance system, especially with biometrics.
- A customer app or website that collects sign-ups.
- Sharing data with a new vendor or moving it to a new cloud region.
- Using AI tools on customer or employee records.
- Large-scale profiling or monitoring.
- Any project involving children's data.
A seven-step method
This follows the structure of the ICO guidance we opened, adapted to plain language.
1. Decide if it is needed. Screen the project against your triggers. Write down the decision either way.
2. Describe the processing. What data, from whom, how much, where it is stored, who sees it, how long you keep it, and why you collect it.
3. Consult. Talk to the people affected where practical, and to IT security, legal and the vendors involved. Note any view you set aside, and why.
4. Test necessity and proportionality. Do you need all this data to reach the goal? Is there a less intrusive way? Do you have a valid basis for use, a clear notice and a way for people to exercise their rights?
5. Identify the risks to people. Think about harm to individuals: fraud, financial loss, discrimination, loss of control over their data, embarrassment. Rate each risk on likelihood and severity with a risk assessment matrix.
6. Choose measures. Collect less, keep it for a shorter time, mask or pseudonymise, restrict access, train staff, tighten vendor contracts. Record whether each measure removes or reduces the risk.
7. Sign off and follow up. Record what you decided, who approved it and the residual risk. Give each action an owner and a date. Review again when the project changes.
A simple record layout
| Section | What to write |
|---|---|
| Project and owner | Name, business owner, date |
| Data map | Data items, source, purpose, storage, recipients, retention |
| Necessity check | Why each item is needed; alternatives considered |
| Risks to individuals | Description, likelihood, severity, rating |
| Measures | Action, owner, due date, effect on risk |
| Residual risk | What remains after measures; who accepted it |
| Review date | When to repeat |
Keep it short enough that people use it. Three to five pages is plenty for most projects.
Common mistakes
- Treating it as a form to tick. If the answer is never "change the project", you did not assess anything.
- Looking only at company risk. The point is risk to the people whose data you hold.
- No owner for follow-up actions.
- Done after launch.
- Copying a European template without checking Indian requirements.
Using it with your other controls
The impact assessment feeds the risk register: each high residual risk becomes a row. See how to build a risk register. If your team also uses AI tools on client data, our DPDP-safe prompt library shows safer ways to work. For a ready checklist, see the DPDP compliance checklist template.
Frequently Asked Questions
What is the difference between a PIA and a DPIA?
In practice the terms are used interchangeably. Both are reviews of how a project uses personal data and what risks it creates for individuals. DPIA is the term used in the DPDP Rules commentary.
Is a DPIA mandatory in India?
Based on the secondary sources we found, the stated requirement applies to significant data fiduciaries, once in every twelve months from notification. We did not find a general duty for all companies, but confirm this against the Gazette text.
When do the DPDP duties start?
The Rules were notified on 14 November 2025 with an eighteen-month phased period. Reports suggest most working duties start on 14 May 2027, but check the notified Rules for each provision.
Who should lead the assessment?
The business owner of the project, supported by IT security and legal. If you have a data protection lead, they should review and challenge the result.
How long should it take?
For a small project, a day or two of focused work. Larger systems take longer. Do not let it delay the project, but do not skip it.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error