Almost every DPDP obligation — accurate notices, honouring rights, erasing data, reporting a breach — assumes you know what personal data you hold and where. Most organisations don't, in detail. A Record of Processing (RoPA) and a data map fix that. Here is how to build one.
What a RoPA and data map are
The DPDP Act does not use the term 'RoPA', but you cannot meet its duties without the underlying inventory. A data map records, for each processing activity: what personal data, why (purpose), whose (categories of people), where it is stored, who it is shared with, the legal basis (consent or legitimate use), and the retention period.
Step 1: Discover where personal data lives
Go system by system: CRM, billing, email tools, HR and payroll, support desk, marketing, databases, spreadsheets, cloud storage, backups and SaaS apps. Don't forget shadow systems — the marketing team's export, the founder's inbox. Automated discovery speeds this up.
Step 2: Classify the data
For each store, record the categories: identifiers, contact details, financial, health, location, behavioural, employee data, children's data. Flag the higher-risk categories even though the DPDP Act has no formal 'sensitive' tier — they shape your safeguards.
Step 3: Map the flows
Trace how data moves: collected where, flowing to which systems, shared with which processors, transferred to which countries. This is what lets you answer an access request and tell affected people after a breach.
Step 4: Attach purpose, basis and retention
For each activity, write the specific purpose, whether you rely on consent or a Section 7 legitimate use, and how long you keep the data. Gaps here are usually where compliance breaks — data kept with no purpose, or a notice that doesn't match reality.
Step 5: Keep it alive
A data map is not a one-off audit; it drifts as you add tools. Assign an owner, review it on a schedule, and update it when you adopt a new system or purpose. A living map is what makes notices, rights and breach response fast instead of frantic.
Why this is the first project, not the last
Teams often start with a privacy-notice template. But a notice is only true if it mirrors your real processing, which only the data map reveals. Build the map first, and the rest of DPDP compliance becomes a set of tractable tasks instead of guesswork.
How DPDP Bridge helps
DPDP Bridge builds and maintains your data map — discovering where personal data lives, the purposes it serves and the vendors who receive it — so your notices, rights handling and breach response all rest on reality. Take the free assessment to see exactly where your organisation stands and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.