Data Protection Impact Assessments For New Projects

Introduction

A Data Protection Impact Assessment (DPIA) is a systematic process used to identify, evaluate, and minimise privacy risks arising from the collection, processing, storage, and sharing of personal data. It is particularly important when organisations introduce new projects involving sensitive information, advanced technologies, large-scale databases, artificial intelligence, biotechnology, or healthcare research.

In biotechnology projects, personal data may include genetic sequences, medical histories, clinical trial records, biometric information, and reproductive health information. Improper handling of such information can cause privacy violations, discrimination, identity misuse, and loss of public trust.

A DPIA helps organisations identify these risks before a project begins and establish appropriate legal, technical, and organisational safeguards.

Meaning And Objectives Of DPIA

A DPIA is a preventive governance mechanism that examines how a proposed project may affect individuals' privacy and data protection rights.

Its main objectives include:

Identifying potential privacy and cybersecurity risks.

Evaluating the necessity and proportionality of data processing.

Ensuring compliance with applicable data protection laws.

Establishing suitable security and confidentiality measures.

Protecting individuals against unauthorised disclosure and misuse.

Improving transparency and institutional accountability.

For example, a biotechnology company developing a genomic testing platform should assess the risks associated with collecting DNA samples, storing sequencing results, sharing information with laboratories, and retaining patient records.

Legal Framework Governing DPIAs

1. Digital Personal Data Protection Act, 2023 (India)

The Digital Personal Data Protection Act, 2023, establishes obligations for organisations processing digital personal data.

Section 10 addresses additional obligations applicable to Significant Data Fiduciaries. These include appointing a Data Protection Officer, undertaking periodic Data Protection Impact Assessments, conducting audits, and implementing other prescribed measures.

The DPIA obligation under Section 10 is therefore specifically associated with Significant Data Fiduciaries rather than being a universal statutory requirement for every organisation.

Its practical application must be considered alongside the applicable commencement notifications and rules.

2. General Data Protection Regulation (GDPR)

Article 35 of the GDPR expressly requires a DPIA where processing is likely to result in a high risk to individuals' rights and freedoms.

Examples include:

Large-scale processing of sensitive personal information.

Systematic and extensive evaluation of individuals.

Certain forms of large-scale monitoring.

Processing involving new technologies that create significant privacy risks.

Article 36 provides for prior consultation with the supervisory authority where a high residual risk remains despite proposed safeguards.

3. Information Technology Act, 2000

The Information Technology Act provides a framework for electronic records, cybersecurity, and protection against certain forms of unauthorised access.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, have also historically addressed security and handling of specified sensitive information. Their current application must be assessed alongside the DPDP Act's commencement framework.

4. OECD Privacy Guidelines

The OECD Privacy Guidelines encourage organisations to adopt privacy safeguards, accountability mechanisms, purpose limitation, and security measures.

These principles support preventive privacy assessments in both public and private projects.

Major Stages Of A Data Protection Impact Assessment

1. Project Identification And Data Mapping

The organisation identifies the proposed project, its objectives, the categories of personal data involved, the individuals affected, and the parties receiving the information.

2. Necessity And Proportionality Assessment

The organisation evaluates whether collecting and processing the information is necessary for achieving the project's objectives. Excessive data collection should be avoided.

3. Risk Identification

Potential risks may include unauthorised access, data breaches, excessive surveillance, discriminatory use, inaccurate records, and unlawful international transfers.

4. Risk Evaluation

Each identified risk is assessed according to its likelihood and potential impact on affected individuals. Genetic and medical information generally requires particularly careful evaluation.

5. Risk Mitigation

Organisations may introduce encryption, pseudonymisation, access restrictions, audit trails, retention limits, staff training, and contractual safeguards.

6. Documentation And Monitoring

The DPIA should record the risks identified, decisions taken, safeguards adopted, and remaining risks. It should be reviewed when significant changes are made to the project.

Relevant Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment discussed legality, legitimate purpose, proportionality, and safeguards against unjustified interference with privacy.

Relevance: DPIAs support these principles by requiring organisations to examine whether proposed data processing is necessary, proportionate, and adequately protected.

2. Puttaswamy v. Union of India (Aadhaar Case) (2018)

The Supreme Court examined the constitutional validity of the Aadhaar framework and considered concerns relating to personal information, surveillance, and proportionality.

Relevance: The decision highlights the importance of assessing privacy risks before implementing large-scale identity and information-processing systems. DPIAs provide a practical mechanism for identifying similar risks in new projects.

3. Digital Rights Ireland Ltd v. Minister for Communications (2014)

The Court of Justice of the European Union invalidated the EU Data Retention Directive because its broad and indiscriminate retention requirements disproportionately interfered with fundamental rights.

Relevance: The judgment demonstrates the consequences of implementing large-scale data collection without sufficient safeguards. DPIAs can help organisations identify excessive collection and retention before a project is launched.

4. Google Spain SL v. AEPD and Mario Costeja González (2014)

The Court of Justice of the European Union considered the responsibilities of search engine operators in relation to personal information and individuals' privacy rights.

Relevance: The judgment illustrates how digital processing activities can significantly affect individual privacy. It supports the importance of evaluating privacy consequences when designing new data-driven services.

These decisions provide important principles for DPIA governance, although they do not all directly establish statutory DPIA requirements.

Importance In Biotechnology Projects

DPIAs are particularly valuable in biotechnology because new projects may involve genomic databases, stem-cell research, artificial intelligence in diagnostics, personalised medicine, and clinical trials.

For example, a company developing an AI-based genetic screening platform should assess whether its data collection is necessary, whether patient identities are adequately protected, and whether third-party laboratories have appropriate security arrangements.

DPIAs also help funding agencies, research institutions, and ethics committees evaluate privacy risks before approving or financing sensitive research activities.

Conclusion

Data Protection Impact Assessments are important preventive tools for responsible project governance. They help organisations identify privacy risks, assess proportionality, establish security safeguards, and demonstrate accountability. India's DPDP Act provides a specific DPIA obligation for Significant Data Fiduciaries, while the GDPR establishes a broader high-risk processing framework. Judicial decisions concerning privacy and proportionality further support the importance of evaluating data protection risks before introducing new projects.