Map the data once, properly, and every other DPDP task gets easier.

The Digital Personal Data Protection Act, 2023 (the Act) never uses the words data map. It does not need to. Its duties only work if you already know your data. Take the right to access: a person can ask for a summary of their data and your processing, and for the identities of every other data fiduciary and data processor you shared it with. You cannot answer that from memory.

• Notice and consent need the purpose and the data items for each activity.
• Access requests need the list of recipients, by name.
• Erasure needs to know every copy, including the ones a processor holds.
• Breach response needs to know whose data sat in the affected system.
• Processor contracts need a full list of who processes on your behalf.
• Security safeguards need to know where the sensitive stores are.

An activity is something the business does with personal data for one reason: running payroll, onboarding a customer, sending a newsletter. Record at that level. A row per database tells you where data sits but not why, and the Act turns on the why.

Keep the purpose field identical to the notice. When the two drift apart, you end up processing for a purpose nobody consented to.

1. 01

   Owner interviews

   Short sessions with each team that collects or uses personal data.

   What happens

   • Walk through one activity at a time
   • Ask what they collect, why, and who they send it to
   • Note spreadsheets and exports nobody has listed

   You get

   • A draft row per activity
   • A named owner for each row

   Good practice

   • Use the template as the agenda
   • Interview the people who do the work, not only their managers

   Watch for

   • Sending a questionnaire and waiting
   • Accepting 'we only keep what we need' without examples

2. 02

   System scan

   Check what the systems actually hold against what people said.

   What happens

   • List data stores from cloud accounts and the asset register
   • Sample schemas and buckets for personal fields
   • Look at logs, analytics and backups, which people forget

   You get

   • Systems and data items confirmed or corrected
   • Stores with no owner, flagged

   Good practice

   • Start from the asset inventory if an ISMS already exists
   • Record the evidence for each finding

   Watch for

   • Treating a tool's discovery output as the map itself
   • Skipping backups and test copies

3. 03

   Contract and vendor review

   Find every party that touches the data for you.

   What happens

   • Pull the vendor list from finance, not only from IT
   • Match each vendor to the activities it supports
   • Note where each one stores data

   You get

   • The processor and recipient fields filled
   • Missing contracts, flagged

   Good practice

   • Include free tools paid for on a card
   • Record subprocessors the vendor discloses

   Watch for

   • Listing vendors without the activity they serve

Under the EU GDPR, Article 30 requires a record of processing activities with set contents. We found no equivalent provision in the Act. Its duties are framed as outcomes: accurate data where decisions depend on it, safeguards, erasure, answers to the people concerned. The record is how you prove those outcomes, so most programmes keep one anyway.

• Procurement gate. No new vendor that handles personal data is paid until its row exists.
• Product change. A new form field, feature or integration updates the map before release.
• Owner attestation. Each owner confirms their rows on a fixed cycle, with changes logged.
• Incident feedback. Every incident checks whether the map named the affected data correctly.
• Request feedback. Each access or erasure request that finds unlisted data reopens the row.

• Mapping systems, not activities. You learn where data is but not the purpose, so notices and erasure cannot be tested.
• Leaving out employees. HR, payroll and monitoring data is personal data too.
• Vendor names without locations. Transfer questions then need a second exercise.
• No retention trigger. A period with no starting event never ends.
• Built once by a consultant. Nobody inside owns it, so it ages from the day it is delivered.
• Spreadsheet with no version history. You cannot show what the map said on the day of an incident.

Sources: the Digital Personal Data Protection Act, 2023 (sections 2, 8, 10 and 11); Regulation (EU) 2016/679, Article 30, for comparison only. The Digital Personal Data Protection Rules, 2025 should be read for any record-keeping detail they add.