1. Annual Data Protection Impact Assessment (DPIA) and Audit

• An SDF must conduct a DPIA and an audit every 12 months from the date it is classified as such.
• Purpose: To ensure ongoing compliance with the law and applicable rules.
• This assessment should analyze:
  • Risks to personal data processing,
  • Mitigation strategies,
  • Adherence to principles of data protection (such as purpose limitation, storage limitation, etc.).

2. Reporting to the Data Protection Board

• The person or entity conducting the DPIA and audit must submit a report to the Data Protection Board.
• The report should include significant observations, helping regulators monitor compliance.

3. Algorithmic Risk Mitigation

• The SDF must verify algorithmic software used for processing personal data—e.g., for uploading, sharing, storing, modifying, etc.
• The goal is to ensure the software does not endanger the rights of Data Principals (i.e., individuals whose data is being processed).
• This includes examining:
  • Bias or discrimination risks,
  • Lack of transparency in automated decision-making,
  • Infringement of privacy rights.

4. Data Localization for Specified Categories

• The Central Government, upon recommendation from a designated committee, may specify certain personal data.
• Such data must be:
  • Stored and processed in India, and
  • Not transferred outside India, including its traffic data.
• This obligation aims to:
  • Enhance data sovereignty,
  • Protect national interests, and
  • Limit exposure to foreign jurisdictions.