Ludhiana, a Thursday afternoon, and I’m sitting across from a man who sells garments online. Nice guy. Fast talker. He wants a privacy policy by Friday, and he’s treating it like ordering a chai. Quick, please, extra sugar.
I didn’t open my laptop. I just asked, “Where does your customer data live?”
Silence. Then he started counting on his fingers. Shopify store, one. A Google Sheet his cousin updates for COD orders, two. WhatsApp chats, three. The courier portal, four. And an old Excel file on a laptop that nobody touches, five. Somewhere around six he stopped and said, “Arre, I never really thought about it.”
Most people haven’t. That list he just made out loud is data mapping for DPDP Act, and it’s the step nearly everybody skips.
So What Is Data Mapping for DPDP Act?
It’s a plain record. What personal data you hold, where it sits, why you have it, who can see it, where it goes after that. No software required. Some companies pay lakhs for tools, and sure, that’s their choice, but a spreadsheet gets you most of the way.
Quick honesty moment. The Act doesn’t actually say “do a data map” in those words. So it’s not a box you tick for the law. But try following the Act without one and see how far you get. You can’t tell customers what you collect if you don’t know yourself. You can’t delete what you can’t find. And when a breach happens, you’ll be guessing what was in the system that got hit.
Think of it less as paperwork, more as the floor you’re standing on.
What Goes Into the Spreadsheet
One row per type of data. Then a few columns, nothing fancy.
What is it? Names, numbers, addresses, Aadhaar copies, payment details, photos.
Why do you have it? One honest reason. If you can’t think of one, well, that’s your first finding right there.
Where does it sit? Website, CRM, an email inbox, somebody’s personal phone. Be annoyingly specific. “The cloud” isn’t an answer.
Who can see it? Your team, sure. But also the accountant, the courier partner, and that freelance designer from last year who still has the shared drive link.
How long are you keeping it? Most people leave this blank. We’ve written about why that’s risky in our post on data retention under the DPDP Act.
Does it leave India? You’d be surprised. Plenty of email tools and support platforms quietly send data abroad.
Where the Surprises Hide
Nobody finds the big stuff hiding. The main database is usually fine, or at least it’s known. It’s the corners that get you.
WhatsApp groups where customers send their documents. Screenshots in someone’s phone gallery. Old backups. A free survey tool the marketing intern signed up for in 2022 and never closed. An Excel sheet emailed around so many times that six copies exist now, and nobody knows which one is current.
One client of ours found a shared folder with scanned ID cards of ex-employees. Three years old. Nobody had opened it since. Still sitting there, still personal data, still a problem waiting for a bad day.
A Map Is Useless Until You Act on It
I’ve seen beautiful data maps that nobody ever looked at again. Don’t do that. Go through each row and ask a blunt question. Do we actually need this?
If no, stop collecting it. Done. If yes, check that you have a proper basis. Usually that’s consent. Sometimes it’s one of the narrow exceptions we covered in legitimate use under the DPDP Act.
Then look at the vendors on your map. Anyone who touches personal data needs a proper contract with you. If you’re fuzzy on who carries which responsibility, our post on data fiduciary vs data processor clears it up.
And use the map to write your privacy notice. Honestly, it gets so much easier once you’ve written down what you actually do.
Maps Go Stale
This part people forget. A new app, a new tool, a new hire who stores things their own way. Every one of them changes your picture, and nobody tells you.
So set a reminder, once every three months. Ask your team one simple thing. Has anything new started collecting customer data? The answer is “yes” more often than you’d think. Almost every time, in fact.
Read the Act Itself
For the exact duties, go to the source. The Ministry of Electronics and Information Technology publishes the Act and its rules. They do get updated, so check the latest version before you finalise anything.
Back to Ludhiana
He got his privacy policy. Took a week longer than Friday, and it was a much better policy for the wait. Also turned out his dusty Excel file still held around 3,000 customer addresses. He deleted it that same afternoon. Looked a bit relieved, honestly.
If you’d like a hand building your own data map, book a free consultation. We’ll go through it together, row by row.