Does every company covered by India’s Digital Personal Data Protection (DPDP) Act have to conduct a Data Protection Impact Assessment (DPIA)?
No.
Section 10(2) and Rule 13 impose specific DPIA and audit obligations on Significant Data Fiduciaries.
Rule 13(1) requires these organisations to undertake a DPIA and compliance audit once every 12 months.
Other Data Fiduciaries are not subject to this particular mandatory DPIA requirement merely because they process personal data.
However, organisations may still choose to conduct DPIAs to identify and manage privacy risks.
For example, introducing an AI-based employee monitoring system or a new customer profiling platform could justify a DPIA even where it isn’t expressly mandatory.
The takeaway: Understand which assessments the law requires your organisation to perform and which additional assessments would help manage actual privacy risks.
This article is general information, not legal advice.