On this page
- Five statutory duties that depend on knowing where your data lives
- Data inventory versus data flow map versus processor register
- How to run a complete data mapping exercise in six steps
- Our view: build your map so it answers customer requests and breach drills in minutes
- Common questions
- In the news
- Sources
If you read the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 from cover to cover, you will not find the words "data mapping" or the European acronym "RoPA" (Record of Processing Activities) printed as a standalone filing requirement. Yet the moment your team sits down to draft your consent notices, sign vendor contracts, answer a customer's rights request or prepare for a 72-hour breach report, you discover that none of those legal duties can be performed without an accurate map of your personal data and the processors that touch it.
Five statutory duties that depend on knowing where your data lives
Rather than asking for a static register on paper, the Act and Rules require operational outcomes that only work if you maintain a current personal data inventory and a data flow and processor register:
| Operational duty under the Act and Rules | What you must produce or do | Why it fails without a data map |
|---|---|---|
| Itemised consent notice | Give the individual an itemised description of the personal data requested and the specific purpose for each item | You cannot list what you collect or why if product, marketing and support teams add form fields and SDKs without a central inventory |
| Right to know who received the data | On request, give the individual the identities of all Data Processors and other Data Fiduciaries with whom their personal data has been shared, along with the data categories shared | You cannot name every recipient of a customer's data on demand unless every API, webhook, cloud vendor and agency is mapped by workflow |
| Consent withdrawal and erasure | Cease processing within a reasonable time, cause your Data Processors to cease processing, and erase personal data when the purpose is no longer served (with 48 hours' advance notice where applicable) | If copies of customer records sit in unmapped spreadsheets, CRM exports, analytics tools or vendor buckets, erasure and withdrawal remain incomplete |
| Reasonable security safeguards and one-year logs | Protect personal data in your possession or under your control with encryption, access control, backups and one-year processing logs | Security teams cannot encrypt fields, restrict access or collect logs from shadow databases and third-party tools they do not know exist |
| Personal data breach reporting | Notify affected individuals without delay and send the Board a 72-hour report stating the nature, extent, timing, location and likely impact of the breach | During an incident, spending the first 48 hours figuring out which tables hold personal data and which vendor hosts them blows past the 72-hour clock |
Data inventory versus data flow map versus processor register
Compliance teams often mix up three related worksheets. Keeping them distinct—or combining them into three linked tabs of one workbook—keeps the exercise fast and practical:
- Personal data inventory: Lists each business activity (such as customer onboarding, order delivery, customer support or payroll), the categories of individuals involved, the exact personal data fields collected, the lawful ground (consent or a specific legitimate use), the system of record and the retention period.
- Data flow map: Traces how a record moves from the collection point (web form, mobile app, branch desk, WhatsApp chat) through internal databases, internal teams and external vendor hops until archival or erasure.
- Data Processor and recipient register: Lists every external software tool, cloud host, payment gateway, courier, marketing agency or outsourcing partner that receives personal data, what fields they receive, where their servers sit, whether a valid Data Processor contract is signed, and how erasure instructions are sent to them.
How to run a complete data mapping exercise in six steps
You do not need expensive discovery software to map a small or mid-sized organisation. A structured walkthrough across your department heads can build a reliable baseline in a week:
- List your core workflows by department: Group activities across Sales and Marketing, Product and Operations, Customer Support, Finance and Billing, and HR and Recruitment.
- Catalogue every entry point: Walk through every website form, mobile app screen, WhatsApp Business flow, phone intake script and paper register that gets typed into a computer.
- Name the systems and storage locations: Record the primary database, CRM, ERP, accounting tool, shared drive, email inbox and backup bucket where each dataset lands.
- Identify every external processor and recipient: For each workflow, list every third-party vendor, API or agency that touches the data and flag any vendor lacking a DPDP-compliant contract.
- Assign the lawful basis and retention clock: Mark whether each activity relies on consent or a legitimate use, and record when the data must be erased versus retained under another law.
- Assign an owner and review trigger: Name the team lead responsible for each row and require an update whenever a new tool, vendor or product feature is launched.
Our view: build your map so it answers customer requests and breach drills in minutes
In our view, the real test of a data map is not how many columns it has, but whether your team can use it under pressure on 13 May 2027. If a customer asks for the list of every Data Processor that received their data, or if a vendor alerts you to an unauthorised login at 6 p.m. on a Friday, a well-built inventory and processor register lets you pull the exact systems, data fields, vendor contracts and affected individuals in minutes rather than days.
Common questions
Is data mapping or a Record of Processing Activities (RoPA) explicitly named in the DPDP Act?
No. The statute does not print the words "data mapping" or "RoPA". Instead, it requires operational outcomes—such as itemised notices, naming every processor on a customer request, and 72-hour breach reports—that depend on having an up-to-date inventory and processor register.
What is the difference between a personal data inventory and a processor register?
A personal data inventory lists your internal business workflows, the data fields collected, the lawful ground, storage systems and retention periods. A processor register lists every external vendor or recipient that handles that data, their location and their contract status.
Why does the right to access information require a processor register?
When an individual requests a summary of their personal data, they are also entitled to obtain the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared, along with a description of the data shared.
How does a data flow map help during a 72-hour personal data breach clock?
Within 72 hours of becoming aware of a breach, you must report the nature, extent, timing, location and likely impact to the Board and notify every affected person without delay. A data map tells you immediately which systems and records were exposed.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 03: Know your data, in the toolkit
- How-to 09: Control your vendors, in the toolkit
- How-to 06: Keep only as long as needed, in the toolkit
- The free duties list, every duty in plain words
In the news
First DPDP challenge: Knowing where your personal data lives
DPDP Act & Rules takeaway: Explains why mapping where personal data sits across databases, CRMs and vendors is the practical starting point for DPDP compliance.
View statutory briefing illustration
Source & Courtesy Reference: Hindustan Times (HT Insight) (original report)Third-Party Data Processors And Privacy Compliance: Emerging Risks Under Digital Personal Data Protection Act, 2023
DPDP Act & Rules takeaway: Shows why maintaining an up-to-date Data Processor register and vendor contract schedule is essential.
View statutory briefing illustration
Source & Courtesy Reference: LiveLaw (original report)DPDP Act comes into force: Here's a timeline for smooth transition to new data rules
DPDP Act & Rules takeaway: Walks through the phased transition window during which organisations map their data flows, vendor contracts and security controls.
View statutory briefing illustration
Source & Courtesy Reference: The Economic Times (original report)
Videos
Sources
Every section, rule and date above was checked against the official text on 22 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 2(i)Data Fiduciary
- Section 2(k)Data Processor
- Section 2(t)Personal data
- Section 2(x)Processing
- Section 4(1)Lawful grounds for processing
- Section 5(1)Itemised description of personal data and specified purpose in the notice
- Section 6(6)Cessation of processing by Data Fiduciary and its Data Processors upon consent withdrawal
- Section 8(1)Responsibility for compliance across Data Processors
- Section 8(2)Engagement of Data Processor only under a valid contract
- Section 8(5)Reasonable security safeguards across personal data in possession or under control
- Section 8(6)Breach intimation to the Board and each affected Data Principal
- Section 8(7)Erasure by Data Fiduciary and its Data Processors when the specified purpose is no longer served
- Section 11(1)Right to obtain a summary of personal data processed and the identities of all Data Processors and Data Fiduciaries with whom it has been shared
- Section 12Right to correction, completion, updating and erasure
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 3Itemised notice contents
- Rule 6Security safeguards, access control and one-year visibility logs
- Rule 7Breach intimation without delay and 72-hour detailed Board report including location and extent
- Rule 8Retention, 48-hour pre-erasure notice and minimum one-year log retention
- Rule 14Published rights request mechanism and 90-day grievance limit
Notifications
- G.S.R. 843(E), clause (c)Core duties in force eighteen months from 13 November 2025 (13 May 2027)
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
