DeepSec Consulting | DPDP Act & GRC Series
In Blog 1, we reached the first conclusion: DPDP readiness starts with visibility. The next question is practical—how do you create that visibility?
The answer is a structured personal data inventory. This is not simply a spreadsheet of customer names. It is a business view of what categories of personal data exist, where they enter the organization, which systems process them, who can access them and why they are retained.
The inventory should cover more than the main production database. Personal data can appear in CRM systems, HR platforms, email, spreadsheets, support tools, cloud storage, application logs, backups and third-party SaaS platforms.
Start With Business Processes
- Customer onboarding
- Employee recruitment and payroll
- Marketing and lead management
- Customer support
- Website and mobile applications
- Payments and billing
- Vendor and contractor management
Record More Than the Data Type
- Business purpose
- Source of data
- System or application
- Data owner or responsible function
- People or systems with access
- Third parties receiving the data
- Retention requirement
- Deletion method
Practical Case Study: The Spreadsheet Nobody Owned
Scenario: A mid-sized company found that sales teams were maintaining separate prospect spreadsheets in addition to the CRM. Some files were stored on personal cloud folders and old laptops. Management initially believed the CRM was the only customer-data repository.
Lesson: A data inventory should follow the business process, not just the official application list. Shadow spreadsheets, email exports and local files can create real governance and security gaps.
Once the inventory exists, the next challenge is understanding movement. Blog 3 will turn the inventory into a data-flow map.
DeepSec Consulting can help organizations assess DPDP readiness, identify privacy and security gaps, and build a practical GRC roadmap aligned with their business environment.
1 Comment