Data protection impact assessment (DPIA) A short written risk check before a new use of personal data, such as an AI tool.
Short answer. A data protection impact assessment (DPIA) is a documented review, done before a new use of personal data starts, of what will be processed and why, whether it is necessary, what risks it creates for the people concerned and how those risks will be reduced. The term comes from Article 35 of the EU GDPR, which requires one where processing, especially with new technologies, is likely to result in a high risk. India’s Digital Personal Data Protection Act, 2023 uses it for significant data fiduciaries: section 10(2)(c)(i) requires periodic DPIAs, and rule 13 of the DPDP Rules, 2025 makes them yearly, with significant observations reported to the Data Protection Board. Other Indian offices are not required by the Act to do one, but a short DPIA is a sensible step before giving an AI tool personal data. This is general information, not legal advice.
01
What the two laws require
Point
EU GDPR
India DPDP
Who must do one
Any controller whose processing is likely to result in a high risk (Article 35(1))
Significant data fiduciaries (section 10(2)(c)(i))
When
Before the processing starts
Once in every twelve months from notification (rule 13(1))
Minimum content
Description and purposes, necessity and proportionality, risks, and measures (Article 35(7))
Rights of data principals, purpose of processing, and assessment and management of risk to their rights (section 10(2)(c)(i))
Who sees it
The supervisory authority is consulted if high risk remains (Article 36)
A report of significant observations goes to the Board (rule 13(2))
02
A DPIA for an AI tool, in outline
Describe the use: for example, summarising outpatient notes into discharge letters.
List the personal data involved and whose it is, including any children’s or health data.
Say where processing happens: which vendor, which country, and whether prompts are kept or used for training.
Test necessity: could the task use less data, or redacted data?
Assess risks to people: wrong information in a record, disclosure to the wrong person, uneven accuracy across languages.
Record safeguards: access by role, a person’s review before anything is filed, logs and retention limits.
Name who approved it and when it will be reviewed.
03
When to do one
Article 35(3) of the GDPR lists cases where a DPIA is always required, including large-scale processing of special categories such as health data, and systematic evaluation by automated processing that leads to decisions with legal or similarly significant effects. Article 35(11) asks for a review when the risk changes.
A practical trigger for an Indian office is any new AI tool that will see client, patient, student or employee data, and any change of model or vendor. If the tool runs on hardware in your office, as ANVE does, the part of the DPIA on transfers and vendor retention gets shorter; the rest still needs doing. This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
04
Questions people ask
Is a DPIA mandatory in India?
Under the DPDP Act it is mandatory only for significant data fiduciaries, under section 10(2)(c)(i) and rule 13. Sector regulators or clients may ask for one in other cases.
How long should a DPIA be for one AI tool?
Its length should match the risk. A few pages can cover one tool used for one task, while uses involving health data or automated decisions about people need more depth.
Who should sign a DPIA?
Someone accountable for the processing, such as a partner or the head of the institution. GDPR Article 35(2) requires a controller to seek its data protection officer’s advice where one is designated.
Does the DPIA need updating when we switch AI models?
Yes, if the change alters what data is processed, where, or with what risk. GDPR Article 35(11) ties reviews to changes in risk.
05
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
