white_paper_on_data_protection_in_india_171127_final_v2

(ii)
Data Protection Impact Assessment
A data protection impact assessment (DPIA) is a process centred on evaluating activities that
involve high risks to the data protection rights of individuals. The process can become
necessary whenever a new project is taken up or a new policy is adopted by a data controller
which may involve the use of a new technology or may have a significant impact on the data
protection rights of individuals. A DPIA is aimed at describing the details regarding the
processing activity, assessing the necessity and proportionality of such an activity, and
helping manage the risks that are identified in relation to this activity. 738 The DPIA is carried
out before the proposed processing activity is initiated so that the relevant data controller can
plan the processing at the outset itself.
International Practices
European Union
Under Article 35 of the EU GDPR, there is a requirement to undertake a compulsory data
protection impact assessment prior to data processing where a type of processing is likely to
result in a high risk for the rights and freedoms of individuals. Certain kinds of processing
activities are identified under the EU GDPR that would require such an assessment 739 and a
supervisory authority is permitted to specify certain further activities that would trigger
similar obligations. 740 Certain details regarding the contents of the assessment are also laid
down. Recital 84 of the EU GDPR makes it clear that the outcome of the DPIA must be
taken into account during the actual processing to demonstrate compliance and that where a
DPIA indicates risks that cannot be mitigated, a consultation with the supervisory authority
should be undertaken. 741
Australia
Section 33D of the Privacy Act empowers the OAIC to direct an agency to carry out and
submit a privacy impact assessment if the relevant activity or function might have a
significant impact on the privacy of individuals. The provision also provides a non-exhaustive
list of contents of the assessment.
Canada
Further, EU, Canada, Australia and South Africa do not appear to place any requirements for the registration of
processing entities.
738 Article 29 Data Protection Working Party, ‗Guidelines on Data Protection Impact Assessment (DPIA) and
determining whether processing is ―likely to result in a high risk‖ for the purposes of Regulation 2016/679‘,
European Commission (4 April 2017), available at: http://ec.europa.eu/newsroom/document.cfm?doc_id=44137,
(last accessed 20 November 2017).
739 Article 35(3), EU GDPR. A DPIA would be required for ―a systematic and extensive evaluation of personal
aspects‖ through automated processing, large scale processing of special categories of data, and processing of
data related to criminal convictions and offences.
740 Articles 35 (4) and (5), EU GDPR.
741 It may be noted that the UK DPA and South Africa‘s POPI Act do not make DPIAs mandatory.
168