Article
Data mapping: the first step to DPDP compliance
11 Nov 2026 · Dpofficer.in team · 2 min read
You can’t protect data you don’t know you have. How to build a data inventory in three weeks, with a simple template any team can use.
Every DPDP compliance programme starts in the same place: a map of what personal data you hold, where it lives, why you have it and who you share it with. Without it, notices are guesswork, retention is impossible, and breach reports are slow.
What a data map captures
For each processing activity (for example “customer orders”, “payroll”, “website newsletter”), record:
| Question | Example |
|---|---|
| What data? | Name, phone, address, order history |
| Whose? | Customers, including under-18s? |
| Why? | Deliver orders, send receipts |
| On what ground? | Consent, or a section 7 legitimate use |
| Where is it stored? | Shopify, Google Sheets, courier portal |
| Who can access it? | Ops team, two admins |
| Who else gets it? | Courier company, payment gateway |
| Does it leave India? | Cloud region, vendor locations |
| How long is it kept? | 8 years for invoices, 2 years for marketing |
| How is it protected? | Encryption, access control |
A three-week plan
Week 1: find it
- Interview each department head for 30 minutes: what data do you collect, and where does it go?
- List every system, spreadsheet, shared drive, WhatsApp group and paper register that holds personal data.
- Don’t forget email inboxes and personal laptops.
Week 2: describe it
- Fill in the table above for each activity.
- Mark gaps: unknown purpose, no legal ground, no contract, no retention period.
Week 3: decide
- Delete what has no purpose.
- Plan consent or notice fixes.
- Add contracts for vendors.
- Set retention periods.
Common surprises
- Shadow spreadsheets: exports from the CRM kept on desktops.
- WhatsApp groups with customer photos and IDs.
- Old marketing lists from events years ago.
- Test databases copied from production with real data.
- Ex-employees’ mailboxes still holding customer correspondence.
Keep it alive
A data map is useless if it’s a one-off. Make updating it part of buying any new tool, launching any new product and onboarding any new vendor. Review it every year.
Go deeper
Our courses include a ready-to-use data mapping workbook. Browse the courses.
This article is for education and is not legal advice.
Get a new DPDP explainer every day
Follow dpdpcourse.in: