Build a Personal Data Inventory for DPDP Compliance (India 2026)

You Cannot Protect Data You Have Not Mapped

Every obligation under the DPDP Act 2023 depends on one prerequisite: knowing what personal data your organisation holds, where it resides, why it was collected, and who has access to it.

Purpose limitation requires you to state the purpose for each data element. You cannot state a purpose for data you do not know exists. Retention schedules require you to delete data when its purpose is fulfilled. You cannot enforce a retention schedule for data that is not catalogued. Data principal rights require you to locate and produce, correct, or erase a specific individual’s data on request. You cannot fulfil that request if you do not have a map of where that data lives.

A data inventory is not a nice-to-have governance artefact. It is the operational foundation on which consent management, breach response, vendor assessment, and regulatory reporting all depend. Without it, compliance is guesswork.

The Data Protection Board will not accept guesswork.

What a Data Inventory Contains

A data inventory is a structured register that documents every category of personal data your organisation collects, along with the context surrounding its collection, processing, and storage. Each row in the inventory represents a distinct data element or category. Each column captures a dimension of that element’s lifecycle.

Field	Purpose
Data element	The specific category of personal data (name, email, phone number, Aadhaar, financial records)
Collection point	Where the data enters your systems (website form, mobile app, API endpoint, manual entry, third-party feed)
Purpose	The stated business reason for collecting this data (order fulfilment, identity verification, marketing communication)
Legal basis	The lawful ground for processing (consent, legitimate use under a specific provision of the Act)
Storage location	Where the data is stored (database name, cloud service, SaaS platform, physical records)
Retention period	How long the data is kept before deletion (30 days, 1 year, duration of contract, until purpose fulfilled)
Third-party sharing	Which external parties receive this data (CRM provider, analytics platform, payment processor)
Cross-border transfer	Whether the data leaves India, and if so, to which jurisdiction (US, EU, Singapore)

Every field in this table maps directly to a compliance obligation. Purpose and legal basis support consent management. Retention period supports data minimisation. Third-party sharing and cross-border transfer support Data Fiduciary obligations around processor management and transfer safeguards.

An incomplete inventory creates compliance gaps you will not discover until a data principal files a request or the Data Protection Board asks for documentation.

Step 1: Identify All Data Collection Points

Most organisations undercount their data collection points by a factor of two or more. The visible points are obvious: website forms, registration flows, checkout pages. The invisible ones create the compliance gaps.

Run a Discovery Audit

Walk through every channel where personal data enters your organisation:

Digital surfaces:

• Website forms (contact, registration, assessment, subscription, feedback)
• Mobile application inputs
• API endpoints that accept personal data from partners or integrations
• Cookies, analytics SDKs, and tracking pixels that collect behavioural or device data
• Chatbots and live chat transcripts
• Email parsing systems that extract contact information from inbound messages

Operational processes:

• Employee onboarding paperwork (HR systems, payroll, benefits administration)
• Sales processes where prospect data is entered manually into CRMs
• Customer support tickets that capture personal details
• In-person events where business cards or registration forms are collected
• Vendor and partner onboarding that involves collecting representative contact information

Third-party inflows:

• Data received from business partners, distributors, or affiliates
• Purchased marketing lists (these carry significant DPDP risk)
• Data imported from acquired companies during M&A integration
• Social media platform integrations that pull profile data

Document each collection point with the following details: the system or interface involved, the data elements collected, the volume of records (approximate), and the business owner responsible for that collection point.

Common Blind Spots

Three categories of data collection are consistently missed during audits:

1. Log files. Server logs, application logs, and security logs frequently contain IP addresses, user agent strings, session identifiers, and sometimes email addresses or usernames. These constitute personal data under the DPDP Act.

2. Analytics and marketing tools. Google Analytics, Meta Pixel, LinkedIn Insight Tag, and similar tools collect behavioural data tied to identifiable individuals. If your analytics stack can identify or re-identify users, the data it collects belongs in your inventory.

3. Employee data. Organisations focused on customer-facing compliance often overlook the personal data they hold about their own workforce. The DPDP Act applies to employee data with equal force.

Step 2: Classify Data Elements

The DPDP Act defines personal data broadly: any data about an individual who is identifiable by or in relation to such data. Within this broad definition, certain categories carry higher sensitivity and stricter handling requirements.

Classification Table

Category	Examples	Sensitivity	Additional Requirements
Identity data	Name, date of birth, gender, photograph	Standard	Purpose limitation, retention schedule
Contact data	Email address, phone number, postal address	Standard	Consent for marketing use, easy unsubscribe
Government identifiers	Aadhaar number, PAN, passport number, driving licence	High	Strict purpose limitation, minimise storage duration
Financial data	Bank account details, credit card numbers, income records, transaction history	High	Encryption at rest, PCI-DSS where applicable
Health data	Medical records, prescriptions, insurance claims, diagnostic reports	High	Restricted access, explicit consent, no secondary use
Biometric data	Fingerprints, facial recognition templates, voice prints, iris scans	High	Explicit consent, no indefinite retention
Behavioural data	Browsing history, purchase patterns, location data, app usage	Standard to High	Transparency about collection, opt-out mechanisms
Children’s data	Any personal data of individuals under 18	Highest	Verifiable parental consent, no tracking or behavioural monitoring

Assign each data element in your inventory a sensitivity classification. This classification determines the security controls, access restrictions, and consent requirements that apply to that element.

Data elements classified as High or Highest sensitivity should be flagged for immediate review. These are the elements where a breach carries the greatest regulatory and reputational cost.

Step 3: Map Data Flows

A data inventory tells you what data you have and where it sits. A data flow map tells you how it moves. Both are necessary for compliance. A static inventory without flow mapping will miss processing activities, sharing arrangements, and deletion gaps.

From Collection to Deletion

For each data element, trace the complete lifecycle:

Collection. Where and how is the data captured? What interface does the data principal interact with? What consent mechanism (if any) is presented at this point?

Processing. What happens to the data after collection? Is it transformed, enriched, aggregated, or combined with other datasets? Which internal systems process it, and for what purpose?

Storage. Where does the data come to rest? Primary database, backup systems, data warehouses, analytics platforms, exported spreadsheets on employee laptops. Every copy counts.

Sharing. Which internal teams access the data? Which external parties receive it? Under what contractual terms? Through what transfer mechanisms (API, file transfer, manual export)?

Deletion. When and how is the data removed? Is deletion automated or manual? Does deletion extend to backups and derived datasets? Can you verify that deletion has occurred?

Internal vs External Flows

Distinguish between data that moves within your organisation and data that crosses your organisational boundary.

Internal flows move data between your own systems, teams, and processes. A customer’s email address moving from a web form to your CRM to your email marketing platform to your analytics dashboard represents four internal processing steps. Each step needs a documented purpose.

External flows move data to or from third parties. Every external flow creates a Data Processor relationship that requires contractual safeguards. If the third party is located outside India, the flow also triggers cross-border transfer requirements.

Document both types. For external flows, record the third party’s name, the data elements shared, the purpose of sharing, the contractual basis, and the destination country.

Step 4: Document Legal Basis and Purpose

The DPDP Act operates on a principle of purpose limitation. Every processing activity must be tied to a specific, stated purpose. Data collected for one purpose cannot be repurposed without fresh consent or a separate legal basis.

Purpose Documentation

For each entry in your data inventory, document:

1. The specific purpose. Not “business operations” or “improving our services.” A valid purpose is concrete: “verifying the identity of the applicant during loan origination” or “sending order dispatch notifications via SMS.”

2. The legal basis. Under the DPDP Act, the two primary bases for processing are:

   • Consent: The data principal has given free, specific, informed, and unambiguous consent. Consent must be recorded with a timestamp and the specific purpose stated at the time of collection.
   • Legitimate use: Processing is permitted without consent under specific circumstances defined in the Act. These include performance of a State function, compliance with a court order, medical emergencies, and employment-related processing.

3. The consent record reference. If the legal basis is consent, link the inventory entry to the consent management system record that captures when consent was given, the notice presented to the data principal, and the mechanism for withdrawal.

Purpose Creep Detection

Purpose creep occurs when data collected for one purpose is gradually used for unrelated purposes without updating the consent basis. Your data inventory should make purpose creep visible.

If a data element’s actual processing activities exceed its stated purpose, you have a compliance gap. Either obtain fresh consent for the expanded purpose, or cease the processing activity that exceeds the original purpose.

Review the purpose column of your inventory quarterly. Compare stated purposes against actual system usage. Flag any divergence.

Step 5: Assess Third-Party Processors

Every external party that receives personal data from your organisation is a Data Processor under the DPDP Act. As the Data Fiduciary, you remain accountable for what your processors do with that data.

Vendor Assessment Checklist

For each third-party processor in your data inventory, evaluate:

Assessment Area	Questions to Answer
Data handling	What data elements does this vendor receive? For what purpose? How long do they retain it?
Security controls	What technical and organisational measures does the vendor maintain? Encryption standards? Access controls? Audit logging?
Sub-processors	Does the vendor share data with its own sub-processors? Who are they? Where are they located?
Cross-border transfers	Does the vendor store or process data outside India? In which jurisdictions? What transfer safeguards are in place?
Breach notification	Does the contract require the vendor to notify you of a data breach? Within what timeframe?
Deletion obligations	Does the contract require the vendor to delete data when the processing purpose is complete or the contract terminates?
Audit rights	Does the contract grant you the right to audit the vendor’s data handling practices?

Contractual Requirements

Your Data Processing Agreements (DPAs) must address every item in the checklist above. Existing vendor contracts signed before the DPDP Act likely do not include these provisions. Identify which contracts need amendment and prioritise them by the volume and sensitivity of data shared.

For vendors located outside India, document the cross-border transfer and the safeguards applied. The DPDP Act empowers the Central Government to restrict transfers to specific jurisdictions. Monitor the restricted list as it develops and ensure your vendor portfolio does not include processors in restricted jurisdictions.

Step 6: Establish Retention Schedules

The DPDP Act requires that personal data be deleted when the purpose for which it was collected has been fulfilled, unless retention is required by another law. This creates a direct mandate: every data element in your inventory needs a defined retention period.

Purpose-Aligned Retention

The retention period for each data element should be derived from its stated purpose:

Purpose	Retention Trigger	Example Period
Order fulfilment	Order delivered and return window closed	90 days post-delivery
Marketing communication	Consent withdrawal or unsubscribe	Delete within 30 days of withdrawal
Identity verification (unregulated business)	Verification complete, no ongoing relationship	30 days post-verification
Employment records	Employment termination	As required by labour law (varies by state)
Tax compliance	Financial year closure	The period income-tax law prescribes for that record type
Regulatory reporting	Report submission	As mandated by sector regulator

Conflicting Retention Mandates

Indian businesses operate under multiple regulatory regimes, and these regimes sometimes impose conflicting retention requirements:

• The DPDP Act mandates deletion when purpose is fulfilled.
• Income-tax law prescribes how long books of account are kept. Take the period for each record type from the current Act and rules, not from a rule of thumb.
• The RBI Know Your Customer Directions, 2025 require banks and NBFCs to keep identification records for at least five years after the business relationship ends (Chapter VII, Record Management).
• SEBI regulations require retention of trading records for specified periods.
• Labour laws require retention of employee records for varying periods across states.

When another statute mandates longer retention, that mandate takes precedence. Document the statutory basis for extended retention in your inventory. When the statutory retention period expires, deletion must proceed. For regulated lenders, where this collision is sharpest, the RBI-DPDP retention conflict guide sets out how to classify each record and document every refused erasure.

The resolution approach: retain the data for the longest period required by any applicable statute, but restrict processing to only the purpose mandated by that statute. Data retained for tax compliance should not be available for marketing use during its extended retention period. Access controls should enforce this restriction.

Where an Indian Lender’s Personal Data Sits

For an NBFC or a fintech lender, the six steps above land on a short list of systems. Each carries its own retention source, and the inventory entry has to name it.

Loan origination and loan management systems. The application, the bureau pull, income documents, the sanction letter, the repayment schedule, collections notes. Most of a lender’s personal data lives here, usually duplicated between the LOS, the LMS and the document store behind them. Map all three and mark which copy is the system of record.

KYC records and CKYCR. An NBFC captures each customer’s KYC records and uploads them to the Central KYC Records Registry within 10 days of starting an account-based relationship, and sends updated information within seven days, or any other period the Central Government notifies. The KYC entry therefore has two locations: the lender’s own copy, kept for at least five years after the business relationship ends, and the copy uploaded to CKYCR, which sits outside the lender’s systems.

Account Aggregator pulls. Bank statements fetched through an Account Aggregator arrive under a standardised consent artefact that records the customer’s identity, the information requested, the purpose, the recipients, and the consent’s creation and expiry dates. The Account Aggregator keeps none of the financial information it passes on. The statements land in the lender’s own systems, usually the LOS, and enter the inventory there, each row tied to the purpose and expiry of the artefact that authorised it. Sahamati, the not-for-profit industry alliance for the network, states on its site that the RBI recognises it as the self-regulatory organisation for Account Aggregators.

Payroll and provident fund data. Salary, bank details, PAN and provident fund account numbers sit in HR and payroll systems, outside the customer stack. First inventories often miss them.

Processing logs. From 13 May 2027, Rule 8(3) of the DPDP Rules 2025 requires a Data Fiduciary to keep personal data, associated traffic data and other logs of processing for at least one year from the date of processing. Application, access and API gateway logs are inventory entries with a one-year floor.

Sources: RBI (Non-Banking Financial Companies – Know Your Customer) Directions, 2025, paragraph 63(1) and (7) for CKYCR uploads and Chapter VII (Record Management) for five-year retention; RBI (Non-Banking Financial Companies - Account Aggregator) Directions, 2025, paragraphs 14(7) and 17; Sahamati, About; DPDP Rules 2025, Rule 8(3).

Maintaining the Inventory

A data inventory built once and never updated is a compliance risk, not a compliance asset. Personal data collection changes every time your organisation launches a new product, integrates a new vendor, enters a new market, or modifies an existing process.

Update Triggers

Define the events that trigger an inventory review:

• New product or feature launch that collects personal data
• New vendor or processor engagement that involves data sharing
• New data collection point added to website, app, or operational process
• Change in data processing purpose for an existing data element
• Regulatory change that affects retention periods, cross-border transfers, or consent requirements
• Security incident or breach that reveals previously undocumented data flows
• Organisational change such as acquisition, merger, or restructuring

Assign Ownership

Every data element in the inventory should have an assigned owner: the individual or team responsible for the accuracy of that entry and for triggering updates when processing changes. Unowned entries go stale.

For most organisations, the practical approach is to assign ownership by system. The team that owns the CRM owns the inventory entries for CRM data. The team that owns the HR platform owns the entries for employee data. The inventory as a whole belongs to the contact person the organisation publishes under Section 8(9), or, for a Significant Data Fiduciary, the Data Protection Officer appointed under Section 10(2)(a). That person validates it on a fixed cycle.

Review Cadence

The update triggers above do most of the work. On top of them, a lender runs a full review each quarter and checks five things:

• Every LOS, LMS and document-store field that holds personal data has an entry
• KYC uploads reached CKYCR within 10 days of each new account-based relationship
• Statements pulled through an Account Aggregator are erased once the artefact’s purpose is served or it expires, unless a statute requires them kept
• Records past their retention period are gone, and records inside a statutory hold cite the law that requires it
• No processing log is erased inside its one-year floor

Start With What You Have

A complete inventory takes weeks. For a lender, start with the LOS and the KYC store: they hold the most personal data and carry the longest statutory holds. Account Aggregator pulls come next, then payroll, then logs.

The DPDP Gap Assessment evaluates your current compliance posture across five areas, including data mapping. It will identify the most significant gaps in your existing documentation and produce a prioritised action list.

The Compliance Checklist provides a structured set of controls to verify against as you build and maintain your inventory.

For a broader view of how the data inventory fits into a full compliance programme, read Building a Privacy Program from Scratch.

DPDP obligations take effect on 13 May 2027. An inventory built now gives the erasure, breach and notice work a map to run on.