DPDP Rules status: compliance window active. Read the update

Skip to content
Data Privacy · Guide

DPIA Guide

A DPIA is a structured way of asking: 'what could go wrong for the people whose data we process, and what are we doing about it?'

Educational only · not legal adviceLast updated: 5 October 2026Written and edited by Sandesh Kokate

A Data Protection Impact Assessment (DPIA) is a check on how you use, or "process", personal data.

  • Law: Only a Significant Data Fiduciary must do one. It must do a DPIA and an audit once every twelve months (Rule 13(1)).
  • Law: The person who does the DPIA and audit must send the Board a report of the main findings (Rule 13(2)).
  • Law: It must also check that its software, including algorithms, is not likely to risk users' rights (Rule 13(3)).
  • Law: Every Data Fiduciary must keep data complete, accurate and consistent if it is used to make a decision about a person (Section 8(3)).
  • Good practice: If you are not a Significant Data Fiduciary, still do a DPIA before a risky new feature.

These rules start on 13 May 2027 (Rule 1(4)).

Official text — DPDP Rules, 2025, Rule 13(1)–(3)
(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder. (2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit. (3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals.
Official text — DPDP Act, 2023, Section 8(3)
(3) Where personal data processed by a Data Fiduciary is likely to be— (a) used to make a decision that affects the Data Principal; or (b) disclosed to another Data Fiduciary, the Data Fiduciary processing such personal data shall ensure its completeness, accuracy and consistency.

In plain English: could the way you process personal data hurt users if something goes wrong? A DPIA is how you show that you thought about the risk before shipping. You can show it to yourself, to the Board, or to counsel.

Educational only — not legal advice

For a binding DPIA methodology and the current Significant Data Fiduciary criteria, consult qualified counsel and the DPDP Rules notification below.

Source
MeitY — DPDP Rules, 2025 (Gazette PDF)

Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).

Quick self-check

Am I a Data Fiduciary?

Reading about DPDP obligations? Run the 2-minute self-check to see exactly what applies to your product.

Run it now
← Back to Data Privacy hub