Section 10(2)(c) in THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
(c)undertake the following other measures, namely:—(i)periodic Data Protection ImpactAssessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;(ii)periodic audit; and(iii)such other measures, consistent with the provisions of this Act, as may be prescribed.