Data mapping and retention
Know what you hold before you try to protect it.
You cannot give notice for, secure or delete data you have not found. We build the inventory, map how data moves, list the vendors that touch it, and set the retention schedule.
No fee for the first conversation.
Why it matters
The Act asks you to use data only for the purpose you stated, to collect only what that purpose needs, and to erase it once the purpose is served. Without a picture of what you hold and for how long, every other control is guesswork.
What we cover
Data inventory
The personal data you hold, by system and by department.
Flow maps
How data enters, moves, is shared and leaves your organisation.
Classification
Labels for sensitivity, access and retention.
Vendor map
The processors, partners and tools that handle your data.
Retention and erasure schedule
How long to keep each category, what triggers deletion, and who does it.
Record of processing
The record of processing activities that the checklist asks about, in a form your team can keep current.
What you receive
- A data inventory your team can maintain
- Flow diagrams from collection to deletion
- A register of third parties that handle your data
- A retention and erasure schedule with named owners
- A record of processing in a format you can keep up to date
Typical timeline. About 3 to 4 weeks, longer if there are many systems or business units.
How it works
- 01
Interviews
We talk to product, engineering, sales, HR and support.
- 02
System walk-throughs
We go through your CRMs, databases, analytics, cloud storage and SaaS tools with you.
- 03
Map and classify
We build the flow maps and assign sensitivity and retention labels.
- 04
Hand over and train
Your team learns how to keep the map current.
Who it is for
- Teams that use many SaaS tools: CRM, support, marketing and HR
- Businesses with several products or business units
- Organisations that share data with vendors or partners
- Organisations that have mapped data for another privacy law and want it adapted for India
What it does not include
- Scanning your databases or running data-discovery software; we build the map from interviews and walk-throughs
- Deleting or migrating data on your behalf
Questions
How often should the map be updated?
At least once a year, and whenever you launch a product, add a vendor or change a data flow.
We have no data team. Can you still do this?
Yes. We build the map with your operations or IT staff and show them how to maintain it.
Do you work with the tools we already use?
We work from whatever you use today: spreadsheets, a governance tool or a privacy platform.
Other DPDP services
- DPDP readiness reviewCheck the evidence behind your answers and turn the free score into a verified baseline, with owners and dates.
- Notices, consent and grievancePlain-language notices, consent flows you can prove, and a grievance route people can actually use.
- Data principal rights and breach readinessA way to answer rights requests on time, and a breach plan with a real contact list that has been tried.
General advisory, not legal advice or a legal opinion. Where a point needs a lawyer’s view, we will say so. Last reviewed 6 October 2026.