The DPIA Checklist

Data Protection Impact Assessment execution checklist evaluating systemic risks to Data Principal rights under Section 10(2)(c)(i) and Rule 13.

Statutory Source: Ch. 20 + s.10(2)(c)(i)/r.13: rights description, purpose, risk-to-rights assessment, management, approval authority

Total Verification Points: 6 Audit Checks

C-20Ch. 20 + s.10(2)(c)(i)/r.13: rights description, purpose, risk-to-rights assessment, management, approval authority

The DPIA Checklist

The DPIA template's working checklist

Readiness Score

0 / 6 checks

Systematic Processing Description: Comprehensive mapping of data inputs, algorithms, processors, and outputs.

Rule 13

Necessity & Proportionality Test: Validation that personal data processing is strictly necessary for specified business purpose.

Rule 13

Risk to Data Principal Rights: Evaluation of risks of unauthorized disclosure, discriminatory profiling, or identity theft.

Rule 13

Mitigation Controls Plan: Specific technical safeguards, tokenization, and encryption deployed to reduce risk scores.

Rule 13

DPO Independent Review & Opinion: Formal written opinion and risk acceptance recommendation issued by DPO.

Section 10(2)(a)

Executive Sign-Off & Archive: Final approval signed by executive sponsor and archived in compliance register.

Rule 13

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 10(2)(c)(i)

Rule 13

Statutory Context:

This checklist is directly anchored in Ch. 20 + s.10(2)(c)(i)/r.13: rights description, purpose, risk-to-rights assessment, management, approval authority. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

SYS-014 Architecture Spec →

Restore Quarantine & Sandbox Store

Isolated test environment ensuring recovered backups pass tombstone replay

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-04 Workpaper →

Control Dossier OBL-04

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-19 — The Sector Checklist Set (Retail / Health / Employment)

Next Checklist

C-21 — The Control-Test Acceptance Checklist