DeepSec Consulting | DPDP Act & GRC Series
In Blog 2, we identified the need for a personal data inventory. But an inventory answers ‘where’ only partially. A mature DPDP program also needs to understand movement.
Data mapping connects collection points, applications, databases, people, vendors, integrations and destinations. It helps an organization understand what happens after a customer submits information on a website.
A simple customer journey may look like: Website → Application → Database → CRM → Support Platform → Analytics Platform → Backup. Each connection may introduce a different access, security, contractual or retention consideration.
What a Useful Data Map Shows
- Collection point
- Purpose of processing
- Data categories
- Application or database
- Internal users
- External processors or vendors
- Storage locations
- Transfers and integrations
- Retention and deletion point
Questions to Ask About Every Flow
- Is the flow necessary?
- Is the purpose documented?
- Is access restricted?
- Is the vendor relationship documented?
- Is the information retained longer than necessary?
- Can the organization trace the data during an incident?
Practical Case Study: The Marketing Integration Surprise
Scenario: A company connected its website forms to a marketing automation platform. Later, a second integration copied selected contact fields into an analytics service. The privacy team knew about the first integration but not the second.
Lesson: Data mapping exposes hidden dependencies. A process can look simple to a business user while actually moving personal data through several systems.
After we know what data exists and where it travels, the next question is what people are told at collection. That takes us to notices and consent in Blog 4.
DeepSec Consulting can help organizations assess DPDP readiness, identify privacy and security gaps, and build a practical GRC roadmap aligned with their business environment.
1 Comment