Template library

Privacy impact assessment

A working assessment with a risk register at its heart, a DPDPA-specific legal-basis check and the rule 13 (3) algorithmic due-diligence module. Mandatory every twelve months for Significant Data Fiduciaries; a strong voluntary control for everyone else.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Project Name][Assessor Name and Role][Statement of the Assessor's Independence from the Project][SDF Status: yes, no, or notification expected][SDF Notification Date][Assessment Due Date][Sign-off Name and Role][Assessment Version][Assessment Date][Trigger Description][Data Items Processed][Data Sources][Systems and Processors][Outputs and Recipients][Retention Trigger and Period][Storage and Access Destinations][Assessed Purpose][Gate Relied On][Evidence Reference][Notice Compliance: yes or gap][Necessity Findings][Minimisation Findings][Accuracy Findings][Access Review: yes or gap][Correction and Erasure Review: yes or gap][Withdrawal Parity Review: yes or gap][Nomination and Grievance Review: yes or gap][Children Review: yes, gap, or not applicable][Algorithmic System Name][System Function][Testing Evidence][Reasoned Conclusion][Safeguard Status][Safeguard Notes][Access Control Status][Access Control Notes][Logging Status][Logging Notes][Backup Status][Backup Notes][Log Retention Status][Log Retention Notes][Processor Contract Status][Processor Contract Notes][Breach Readiness Status][Breach Readiness Notes][Risk Description][Affected Cohort][Likelihood Rating][Severity Rating][Mitigation Plan][Risk Owner][Mitigation Deadline][Residual Risk and Acceptor][Restricted Country Finding][Rule 15 Finding][Localisation Finding][Agreed Actions][Significant Observations][Decision: proceed, proceed with changes, or do not proceed][Next Review Date][Sign-off Date][Board or Board Committee Name]

The document

The opening clauses — open to everyone

Assessment header

Project or system assessed: [Project Name]

Assessor: [Assessor Name and Role] — [Statement of the Assessor's Independence from the Project]

Significant Data Fiduciary status: [SDF Status: yes, no, or notification expected]

If SDF — notification date and this cycle's twelve-month due date: [SDF Notification Date], [Assessment Due Date]

Sign-off (DPO for an SDF; privacy lead otherwise): [Sign-off Name and Role]

Version and date: [Assessment Version], [Assessment Date]

For a Significant Data Fiduciary, rule 13 (1) of the DPDP Rules, 2025 requires this assessment, and an audit, once in every period of twelve months, and rule 13 (2) requires the person carrying it out to furnish the Data Protection Board of India a report containing significant observations. Write every finding knowing the regulator may read it: factual, remediation-anchored, no speculation. For everyone else this template runs as a voluntary assessment, and the completed copy doubles as mitigation evidence if a penalty is ever assessed.

Trigger and scope

Why this assessment is happening now — tick all that apply:

☐

Annual SDF cycle

☐

New system, product or vendor

☐

New purpose for existing data

☐

Children's or guardians' data involved

☐

Large-scale profiling, scoring or automated recommendations

☐

Cross-border…