s.10 · Rule 13
Data Protection Impact Assessment
A Data Protection Impact Assessment is the process a Significant Data Fiduciary must carry out under Section 10 and Rule 13 every twelve months, describing the rights of Data Principals, the purpose of processing, the risks, and the measures to manage them.
The DPIA is mandatory only for Significant Data Fiduciaries, alongside an annual audit by an independent data auditor and a report of the significant observations to the Board. Rule 13 fixes the twelve-month cycle.
For everyone else it is voluntary, and useful: the same exercise, done once, is the quickest route to a notice that actually itemises the data and the purposes, because it forces the business to write them down.
Questions people ask
- Do ordinary businesses need a DPIA?
- Not under the Act. It is required of Significant Data Fiduciaries only.
- What must the DPIA contain?
- Section 10(2)(c) describes it as a process comprising a description of the rights of Data Principals and the purpose of processing, an assessment and management of the risk to those rights, and any other matter prescribed.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.