Rule 13 — DPDP Rules, 2025
(1) Every Significant Data Fiduciary shall, within such period as may be notified— (a) conduct a Data Protection Impact Assessment; (b) appoint a Data Protection Officer who is based in India; (c) appoint an independent data auditor; (d) undertake algorithmic accountability measures. (2) The Data Protection Impact Assessment under clause (a) of sub-rule (1) shall include— (a) a systematic description of the proposed processing operations and the purposes; (b) an assessment of the necessity and proportionality; (c) assessment of risks to rights of Data Principals; (d) measures to address identified risks. (3) The Significant Data Fiduciary shall submit the results of such periodic DPIA, audit and assessment to the Board in such form and manner as may be specified.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 13 creates a 12-month repeating compliance cycle for Significant Data Fiduciaries. All four obligations — DPIA, DPO appointment, independent audit, algorithmic accountability — must be completed within each cycle. The DPIA is not a once-and-done assessment: it must be re-conducted periodically, and the results submitted to the Board. The independent auditor is distinct from the company's own internal audit function — they must be external to the organisation. Algorithmic accountability applies to profiling, automated decision-making, and similar systems.
Rule 13(2) specifies four elements: systematic description of what you're doing and why, necessity and proportionality assessment (do you really need all this data?), risk assessment for Data Principals, and measures to mitigate identified risks. An SDF cannot submit a generic risk register — the DPIA must be purpose and system-specific.
The independent data auditor must be external to the SDF and cannot be affiliated with the organisation. They review the SDF's data processing practices against DPDP Act compliance. Their findings go to the Board. If an SDF appoints its own CFO or internal legal team as the 'independent auditor,' this does not satisfy Rule 13.
Rule 13's algorithmic accountability requirement applies to any algorithm that processes personal data to make or influence decisions — recommendation engines, credit scoring models, dynamic pricing, content moderation. The SDF must be able to explain what the algorithm does, what data it uses, and what decisions it influences. Black-box systems with no auditability do not satisfy this requirement.