Data Discovery Checklist For Dpdp Act Compliance

By Author: Rohan Suri
Total Articles: 2
Comment this article

Ask a simple question in your organisation: “Where do we store customer data?” The first answers usually name a database or a CRM. The full answer is longer. It includes spreadsheets on laptops, old backups, email attachments, vendor portals, chat tools, analytics dashboards and log files.
This matters because the Digital Personal Data Protection (DPDP) Act, 2023 holds your organisation, the Data Fiduciary, responsible for all personal data it handles. The Rules were notified on 13 November 2025, and most core obligations apply from 13 May 2027. Those include notice, consent, security safeguards, breach intimation and data principal rights. Every one of them depends on one thing: knowing what personal data you hold and where it sits.
That is what data discovery does. It is the process of finding personal data across your systems. Classification is the next step, where you decide what each piece of data is, how sensitive it is and which rules apply to it.
Use the checklist below as a starting point.

The 10-point data discovery checklist
1. Define what counts as personal data for your business
...
... Under the Act, personal data is any data about an individual who can be identified from it. List the types you are likely to hold: names, phone numbers, email addresses, Aadhaar and PAN numbers, bank details, addresses, location data, device IDs and employee records.
2. List every system that may hold it
Go beyond the obvious. Include databases, cloud storage, SaaS tools, file shares, laptops, email, chat apps, backups, logs, analytics platforms and any AI or machine learning pipelines.
3. Include data held by vendors
Under Section 8(2), you can involve a Data Processor only under a valid contract. List every vendor that handles personal data for you, such as payment gateways, call centres, marketing agencies and cloud providers. Note what data they receive and why.
4. Look at all data formats
Personal data is not only in neat database columns. Scan structured data (tables), semi-structured data (logs, JSON files) and unstructured data (PDFs, scanned documents, images, emails). Unstructured data is where teams most often find surprises.
5. Separate customers, employees and children
Different groups carry different obligations. Section 9 requires verifiable parental consent before processing a child’s data. A child is anyone under 18. Tag the data so you can tell these groups apart.
6. Classify by sensitivity and purpose
For each data set, record how sensitive it is (for example public, internal, confidential or restricted) and why you collected it. Purpose matters because the Act is built around purpose-limited use of data.
7. Assign an owner to every data set
Each data set needs a named person or team responsible for it. Without an owner, nobody is accountable for access, retention or deletion.
8. Map data to consent and notice
For each data set, check which notice was shown and which consent covers it. Where you rely on a legitimate use under the Act instead of consent, record that basis. If you can’t link data to a notice or consent record, treat it as a gap.
9. Set retention and deletion rules
Section 8(7) requires you to erase personal data once its purpose is served, unless the law requires you to keep it. Find old data sets that nobody uses, and write down how long each type will be retained and who will delete it.
10. Keep a living inventory
A one-time exercise goes out of date quickly. Maintain a central, searchable record of your personal data assets, their owners, purposes and risks. It supports your Records of Processing, speeds up breach response and gives you evidence if the Data Protection Board asks questions.

Common mistakes to avoid
Only scanning “main” systems. Shadow IT, personal drives and vendor tools are often where the risk sits.
Relying on pattern-matching alone. A 10-digit number may or may not be a phone number. Context matters, and so do Indian formats such as Aadhaar, PAN, GSTIN and UPI IDs.
Treating discovery as a one-off project. Data keeps moving, so your map must keep updating.
Keeping the work inside one team. Legal, IT, security, HR and business teams all hold data. Discovery works best as a shared effort.
Ignoring the cost of scanning. Scanning every source in full, every time, is slow and expensive. Prioritise high-risk systems and scan the rest on a schedule.
Why this matters now
The penalties under the Act are significant. Failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to notify a breach can attract up to ₹200 crore. But the practical benefit is bigger than avoiding fines. When you know where your data is, you can answer a customer’s access or erasure request faster, report a breach with confidence, and cut the volume of data you carry and could lose.
Where to start this week
Pick your three most data-heavy systems and run a small discovery pass.
Name an owner for each one.
Record what you find, then expand outward to other systems and vendors.
Shortlist data discovery and classification software that recognises Indian identifiers (Aadhaar, PAN, GSTIN, UPI IDs) and connects to the systems you actually use.
DPDP compliance is a programme, not a one-day task. Data discovery is the first step, and a clear data map makes every later step easier.
Disclaimer: This article is for general information and is not legal advice. Please consult a qualified professional for your specific situation.

I am an SEO & Content Marketing Specialist focused on organic growth and content strategy. I am associated with DPDP.ai, India's DPDP compliance platform, where I work on driving search visibility and audience engagement for solutions related to consent management, PII discovery, breach management, and data privacy compliance under India's Digital Personal Data Protection Act through keyword-driven content and off-page SEO initiatives.