SCENARIO D01 · GOVERNANCE & TRANSFERS
A designated SDF postpones its DPIA and audit indefinitely. What will future Rule 13 require?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
A DPIA and audit once in every 12 months from designation or inclusion in the notified class.
Confirm designation first, then schedule the recurring assessment and report workflow from the correct date.
WHY THE OTHER INSTINCTS MISS
A DPIA and audit once in every 12 months from designation or inclusion in the notified class.
Correct. This is a future legal duty for a Significant Data Fiduciary, not merely a governance suggestion.
A review only after the Board asks for one.
Rule 13(1) sets a recurring duty tied to designation, not a request-only trigger.
One DPIA at company formation, with no recurring audit.
That does not match the once-in-every-12-months wording.
BUILD THIS EVIDENCE
Designation evidence, 12-month calendar, DPIA, audit and significant-observations report.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 10; Rule 13(1)–(2); G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)