How to Do a DPIA and Annual Audit (Rule 13)
A Data Protection Impact Assessment (DPIA) is a structured check of a processing activity: what it does, what could go wrong for people, and how you will reduce the risk. It is mandatory only for Significant Data Fiduciaries, but a short version is smart for any risky project. This DPDPA 2023 course page explains how to do a dpia in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Who must do it (how to do a dpia)
| Situation | Duty |
|---|---|
| You are notified by the Government as a Significant Data Fiduciary (based on volume and sensitivity of data, risk to people, effect on sovereignty, democracy, security or public order) | DPIA and audit once every 12 months, report significant findings to the Board, appoint a DPO in India and an independent data auditor (Rule 13, Section 10) |
| You are a normal small company | No legal duty. Do a DPIA-lite before any new high-risk activity: children, location tracking, large-scale profiling, AI scoring, health or financial data, new vendors abroad. |
DPIA in six steps (tap each)
Risk score tool (how to do a dpia)
DPIA-lite template
1. Activity and owner: 2. Purpose (one sentence): 3. Data items and why each is needed: 4. People affected (customers, staff, children?): 5. Who can access it, where it is stored, how long: 6. Risks (list) with likelihood x impact score: 7. Controls added: 8. Residual risk after controls (low / medium / high): 9. Decision (go / go with changes / stop): 10. Approved by, date, next review date:
The annual audit (SDFs) (how to do a dpia)
- Plan: Pick an independent data auditor and agree scope: notice, consent, security, requests, breaches, retention, vendors, algorithms.
- Collect evidence from your evidence folder.
- Test: sample consents, check access lists, restore a backup, review a breach drill.
- Write findings with severity and a fix date.
- Report significant observations to the Board as Rule 13 requires and track fixes to closure.
Algorithm due diligence (Rule 13)
If software such as scoring or recommendation models processes personal data, SDFs must take technical measures to verify it does not put people’s rights at risk. In practice: document what the model does, test for errors and unfair outcomes, keep a human reviewer for important decisions, and log changes to the model.
Keeping data in India (how to do a dpia)
Rule 13 says specified personal data, and related traffic data, must be processed in India if a government committee recommends it. Only SDFs are affected, and only for the data the Government specifies.
Related guides
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.