Running a DPIA When You Are Not a Significant Data Fiduciary

A Data Protection Impact Assessment (DPIA) is a short written check, made before launch, of how a project could harm the people whose data it uses. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), only a Significant Data Fiduciary (SDF), a business the government designates for extra duties, must run one, and none has been designated. Run one anyway: when a customer, an investor or the Data Protection Board of India asks why your safeguards were enough, a dated DPIA is the answer.

Why bother if you are not an SDF

Section 10(2)(c)(i) sets the SDF version: a description of the rights of data principals (the people the data is about) and the purposes of processing, and an assessment and management of the risk to those rights. From 13 May 2027, Rule 13 makes it annual, with a report to the Board. Trayambic's whitepaper on SDFs covers that regime. Four reasons apply to everyone else.

• Reasonable safeguards. Section 8(5) requires "reasonable security safeguards" and section 8(4) "appropriate" technical and organisational measures. In our view neither can be shown without a record of the risk you were guarding against.
• Penalty factors. Section 33(2) tells the Board to weigh, among other things, the type of data affected and whether the business acted promptly and effectively to mitigate a breach's effects. In our view a DPIA that cut data and planned the response is good evidence on both.
• Sector rules. ABDM's Health Data Management Policy requires participating data fiduciaries to run a DPIA before processing that uses new technologies or risks significant harm (clause 27.3). The RBI's 2025 outsourcing directions make commercial banks assess risks, including country risk, and vet service providers (paras 22, 29 and 30), so bank vendors get asked too. EU and California users can bring in Article 35 of the GDPR and the CPPA's risk-assessment rules, in force since 1 January 2026.
• Diligence. Investors and enterprise customers ask how privacy risk is managed; a DPIA register answers them.

When to run one

Before launch or a material change, if the project involves:

• children, where section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising;
• biometrics such as face, fingerprint or voice;
• AI or automated decisions about people, where section 8(3) requires accurate, complete and consistent data;
• precise or continuous location;
• health data;
• a new vendor or hosting abroad, even though section 16(1) restricts no country yet.

Seven steps

1. 1.Screen. Check the list above. If nothing applies, record that in one line and stop.
2. 2.Start with the people. Note who is affected, who cannot easily refuse (patients, students, employees) and which rights they will use.
3. 3.Trace the data journey from collection to deletion, naming every system, vendor and country.
4. 4.Test each purpose. Record its ground, consent or a section 7 legitimate use, and cut any item it does not need (section 6(1)).
5. 5.Picture the bad day. Write each harm as the person would describe it, then rate likelihood and severity as high, medium or low.
6. 6.Decide and assign. Give every high or medium harm a control, owner and date, with Rule 6 as the security floor, and name who accepts what remains.
7. 7.Schedule the rerun. Set a trigger, such as a new vendor, model or data type, or a date, and file the DPIA with your data map.

ISO/IEC 29134:2023 gives fuller, voluntary guidance on the process and the report. The DPDP Act does not mention it, so use it as scaffolding around the Act's test: risk to people's rights.

A one-page template, filled in

Take an illustrative diagnostics startup with three labs that is adding an overseas vendor's AI tool to pre-read chest X-rays.

Two findings changed the launch. The vendor's standard terms let it train on customer data, so the startup struck that clause before signing. And in our view the Fourth Schedule exemption for clinical establishments covers the health service, not model improvement, so under-18 scans stay out of training unless a parent gives verifiable consent under Rule 10. If the labs share records through ABDM, the same page serves clause 27.3.

Keep it short and keep it current

A DPIA nobody revisits proves little. Keep each one to a page, update it when its trigger fires and keep every version, because the dated sequence is the evidence. If you are designated an SDF later, these pages feed the annual DPIA that Rule 13 requires.

Key takeaways

• Only SDFs must run DPIAs under s.10(2)(c)(i) and Rule 13, but s.8(4), s.8(5) and the s.33(2) penalty factors make a dated DPIA valuable for every data fiduciary.
• Sector rules already ask for risk assessments: ABDM's Health Data Management Policy clause 27.3, RBI outsourcing due diligence, GDPR Article 35 and California's CPPA regulations.
• Run one before launching anything involving children, biometrics, automated decisions, precise location, health data or a vendor abroad.
• A seven-step, one-page DPIA (screen, people, data journey, purpose test, bad-day harms, decide and assign, rerun) is enough for most projects; ISO/IEC 29134:2023 is an optional reference.