Data Protection Impact Assessments

A Data Protection Impact Assessment (DPIA) looks at the privacy risks of a new system, product or use of personal data before it starts.

Starting a DPIA

Choose DPIA in the client’s menu, then New DPIA, or start from an inventory activity so its details are filled in for you.

1. Describe the processing

What is being introduced or changed, why personal data is needed, the data involved, whose data and roughly how many people, the vendors and recipients, and any transfers outside India.

2. Screening

Eight questions ask about factors that point to higher risk, such as children’s data, large scale, profiling or artificial intelligence, monitoring, and transfers outside India. Weigh them together:

• Two or more factors usually call for a full DPIA.
• One factor: decide whether a full DPIA is needed, looking at the processing as a whole, and record why.
• Under the DPDP Act a periodic DPIA is required only of a notified Significant Data Fiduciary; for other organisations it is good practice.

3. Assessment

Questions on necessity, notice and consent, rights, security, vendors and transfers, retention and governance, answered Yes, Partially, No or Not Applicable. Clients in some sectors get extra questions for their sector. No and Partially answers are the gaps; each comes with its risk and a recommended action. The score gives a risk level.

4. Sign-off

Record the status (Draft, Completed or Approved), the decision (Proceed, Proceed with conditions or Do not proceed), any conditions, and a date to review it. Once a DPIA is completed or approved, its gaps become findings in the risk register. The menu badge turns red when a review date has passed.

The report

Each DPIA has a printable report with the description, screening, gaps and recommended actions, and sign-off.