Data protection impact assessment
Run a DPIA under India's DPDP Act and the GDPR, side by side.
Answer the questions once. Ambit sets each provision beside your answers and shows where the two laws differ.
- About 30 to 45 minutes
- Your answers never leave your browser
- Exports to PDF and Word
An illustration with invented risks. Your own matrix is built in section 6.
Where the two regimes part company
Three points of departure, each one changing what a controller or fiduciary must actually do.
| Question | DPDP Act 2023 | GDPR |
|---|---|---|
| What sets the duty off | DPDPThe duty reaches a Significant Data Fiduciary alone, and that status is conferred by notification of the Central Government under s 10(1). Identical processing carries no assessment duty until then. | GDPRArticle 35(1) self executes. Where processing is likely to result in a high risk, the controller must assess it before processing begins. No one has to designate anything first. |
| Whether sensitivity has its own regime | DPDPThere is no special category regime at all. Sensitivity enters only through the s 10(1) factors the Government weighs, and through what counts as reasonable under the rule 6 safeguards. | GDPRArticle 9 prohibits processing special categories absent a listed condition, and Article 10 governs offence data. Large scale processing of either is a named Article 35(3)(b) trigger. |
| What happens at unmitigated high risk | DPDPNothing ex ante. The Board has no clearance function and no provision requires a fiduciary to approach it first. Rule 13(2) instead reports significant observations after the fact. | GDPRArticle 36(1) requires the controller to consult the supervisory authority before processing, where the assessment shows a high risk that mitigation has not brought down. |
A fourth runs underneath all of them. Chapter V prohibits transfers by default and permits them by mechanism, while s 16(1) permits them by default and lets the Government restrict them by notification.
How the scoring works
Most impact assessments reduce a risk score by however many controls happen to be ticked. Ambit does two things differently.
Controls reduce likelihood, never severity
Severity passes through untouched
Encrypting a store does not make the harm to a principal smaller if it spills. It makes the spill less likely. So a control moves a risk left across the matrix and never downward, and the residual position you see is the honest one.
Coverage is counted per risk
Only controls mapped to a risk reduce it
Every risk carries a theme and every control is mapped to the themes it addresses. A risk that nothing in scope addresses is reported as unmitigated, rather than quietly scoring as covered because unrelated boxes were ticked elsewhere. A control counts only once it is ticked and has evidence recorded against it; a box ticked with nothing behind it reduces nothing.
Eight sections, a live risk matrix, and a report to keep on record.
Commencement