SCENARIO D02 · GOVERNANCE & TRANSFERS
A designated SDF deploys algorithmic software without a rights-risk review. What does future Rule 13 say?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Exercise due diligence that the technical measures are not likely to pose a risk to Data Principals’ rights.
For a designated SDF, make the due-diligence record specific to the technical measure and risks to rights.
WHY THE OTHER INSTINCTS MISS
Exercise due diligence that the technical measures are not likely to pose a risk to Data Principals’ rights.
Correct. That closely follows Rule 13(3) without inventing a guaranteed-safety certification.
Obtain government approval for every algorithm before use.
Rule 13(3) does not state that universal approval mechanism.
Review only models that make fully automated decisions.
Rule 13(3) describes algorithmic software across several processing operations and is not limited to that narrower label.
BUILD THIS EVIDENCE
Algorithm register, rights-risk assessment, test results, mitigations and approval record.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Rule 13(3); G.S.R. 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)