Data Protection Impact Assessment: annual template for Significant Data Fiduciaries
1. Assessment details
Organisation (legal name):
Processing activity assessed:
Twelve-month period covered:
Date of this assessment:
Date of the previous assessment:
Prepared by (name and role):
2. Description of the processing
Personal data processed (itemise by class):
Data Principals affected (for example customers, children or employees) and approximate numbers:
Systems, data stores and processors involved:
Transfers outside India, if any:
Algorithmic software used on the personal data:
3. Purposes and ground
Specified purpose of the processing:
Ground relied on, consent (s.6) or a legitimate use (s.7, which one):
4. Rights of Data Principals affected
Rights this processing could affect (access, correction, completion, updating, erasure, grievance redressal, nomination):
How Data Principals exercise those rights for this processing:
5. Risks
Risks to the rights of Data Principals from this processing:
Likelihood and severity of each risk:
Risks from algorithmic software, and the due diligence done (Rule 13):
6. Measures
Security safeguards in place (Rule 6):
Measures to reduce each risk:
Owner and due date for each new measure:
7. Residual risk
Risk remaining after the measures:
Further action required:
Residual risk accepted by (name and role):
8. Significant observations for the Board
Rule 13 asks a Significant Data Fiduciary to furnish the significant observations from its DPIA and audit to the Data Protection Board.
Significant observations:
Date furnished to the Data Protection Board:
9. Sign-off
Data Protection Officer (name and date):
Independent data auditor's comments, if reviewed (name and date):
Approved by (Board of Directors or delegated authority, name and date):