PD-001·high·Component: Privacy by Design / DPIAWhat this control requires
Establish and maintain a DPIA programme covering: (i) DPIA template aligned with DPDPA and Rule 12; (ii) DPIA trigger criteria (mandatory for SDFs; recommended for high-risk processing); (iii) DPIA risk mitigation tracking; (iv) periodic DPIA review (at least annually for SDFs); (v) DPIA register with status of each assessment. Objective: Identify and mitigate risks to data principals' rights arising from processing activities before they materialise, and demonstrate proactive risk management to regulators.
In plain English
Establish and maintain a DPIA programme covering: (i) DPIA template aligned with DPDPA and Rule 12; (ii) DPIA trigger criteria (mandatory for SDFs; recommended for high-risk processing); (iii) DPIA risk mitigation tracking; (iv) periodic DPIA review (at least annually for SDFs); (v) DPIA register with status of each assessment. In practice, this means you can prove you establish and maintain data protection impact assessment programme-level controls on a defined cadence.
Why it matters
Penalties under the DPDP Act reach ₹250 crore per instance of significant non-compliance, and the Act applies extra-territorially to any entity processing personal data of individuals in India in connection with offering goods or services.
This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.
What an auditor looks for
Indian DPAs and statutory auditors will look for: documented consent capture and revocation flows, a designated Data Protection Officer (for Significant Data Fiduciaries), breach-notification workflows tied to Data Protection Board notification timelines, and Records of Processing that match the consent notice the user saw.
Within Privacy by Design / DPIA, the assessor will trace your implementation back to the catalogue reference (Control PD-001) and look for objective evidence on the latest two assessment cycles.
How to implement
Policy Management
Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.
Operational checklist
- Establish And Maintain. Document the trigger, the owner and the cadence.
- Maintain. Document the trigger, the owner and the cadence.
- Review. Document the trigger, the owner and the cadence.
- Scope: data protection impact assessment programme.
Evidence to collect
- Policy Document. A signed and version-controlled policy / standard / procedure document.
Signed policies, procedures, and registers document the safeguard. Focus: Data Protection Impact Assessment Programme.
Common pitfalls
- Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.
How it maps to other frameworks
Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.
- ISO/IEC 27701:2025 A.1.2.6 — Privacy impact assessment
- SOC 2 (2017 TSC) P2.1 — Communication of Data Subject Choices and Consequences
- GDPR Article 14 — Information to be provided where personal data have not been obtained from the data subject
- NIST SP 800-53 Rev. 5 RA-8 — Privacy Impact Assessments
- BSI C5:2020 CRY-01 — Policy for the use of encryption procedures and key management
Related controls in India DPDP Act 2023
- Control GV-001 — Data Protection Officer (DPO) Appointment & Publication
- Control SC-004 — Significant Data Fiduciary (SDF) Self-Assessment
- Control DS-008 — Data Principal Nomination Mechanism
- Control DS-002 — Right of Access - Data Copy Provision
- Control LB-005 — Employee Privacy Notice & HR Data Governance
- Control SC-001 — Digital Personal Data Inventory
References
- Ministry of Electronics and Information Technology (India) — India DPDP Act 2023
- Catalogue identifier:
Control PD-001
Topics: governance riskdata protectionprivacy managementpolicy management