Your First DPDP Task: A Data Inventory in Two Weeks

The DPDP Act never asks you to keep a data inventory. Article 30 of the EU's GDPR makes most controllers keep "records of processing activities", but neither the Digital Personal Data Protection Act, 2023 nor the 2025 Rules impose anything similar on an ordinary data fiduciary (the business that decides why and how personal data is processed). Yet most duties that commence on 13 May 2027 assume you know what personal data you hold, about whom, why, where, and who else has it. A data inventory is that list, one row per processing activity.

Six duties that assume you have one

• Notices (Rule 3). A consent notice must give "an itemised description" of the personal data and the purpose. Consents collected before commencement also need a notice "as soon as it is reasonably practicable" (s.5(2)); the inventory shows which datasets those are.
• Access requests (s.11(1)(a)–(b)). A data principal (the person the data is about) who gave consent or s.7(a) data can ask for "a summary of personal data" processed, the processing activities, and the identities of every other fiduciary and processor that received it. Article 30 asks only for categories of recipients; s.11 wants names.
• Erasure (s.8(7)). Unless a law requires retention, data must go when consent is withdrawn or the purpose ends, and processors must erase their copies too. Copies you never listed survive.
• Breach scoping (Rule 7). Each affected person and the Board must be told the breach's nature and extent, and the 72-hour report must cover the notices sent. Without an inventory, "extent" is a guess.
• Proof (s.6(10)). Where consent is questioned in a proceeding, the fiduciary must prove notice and consent. The inventory points each activity to its notice version and consent log.
• Government calls (s.36, Rule 23). The Centre may call for information, including to assess whether a business should be designated a Significant Data Fiduciary. A current inventory answers in days.

Trayambic's pieces on notices and consent, data principal rights, breach notification and government requests cover each duty in depth.

Two weeks, three sources

Name one lead and an owner in each function (product, engineering, marketing, operations, HR, finance) who answers for its rows. Then work through systems, vendors and paper.

1. 1.Days 1–3, systems. Export the single sign-on app list, cloud accounts, database schemas, website tags and the software kits inside your mobile app. Each is a candidate row.
2. 2.Days 4–5, vendors. Pull twelve months of accounts-payable and company-card payments. Tools nobody registered show up here, and any that touch customer or staff data are likely processors.
3. 3.Days 6–7, paper. Walk the front desk, field teams and HR files. Paper sits outside the Act until it is digitised (s.3(a)), so record where scanning, photographing or typing happens; the row starts there.
4. 4.Days 8–10, interviews. Ask each owner five questions: what do you collect, from whom, why, where does it go, and when does it leave? Check shared drives, spreadsheets and messaging groups too.
5. 5.Days 11–13, grounds and retention. Mark consent or the section 7 clause for each activity, and the retention period with its driver. Trayambic's retention whitepaper explains what counts as a legal driver.
6. 6.Day 14, sign-off. The lead and owners sign the first version; every blank cell becomes a dated, owned ticket.

A one-page template

Worked example: a home-collection diagnostics startup

All figures are illustrative. A 70-person startup takes test bookings through an app and a call centre, sends phlebotomists to homes and sends samples to two partner laboratories.

Its first systems export listed nine tools. The payments ledger added six, including a route-planning service, a call-transcription tool and a survey platform. The paper walk found two surprises: requisition forms scanned at the laboratories, and prescriptions photographed by phlebotomists on personal phones. Both are digital personal data once captured.

Three decisions followed. Prescription photos moved into the app's upload flow, and copies on personal phones were deleted. Paediatric bookings got their own row, because the parent acts for the child (s.2(j)) and s.9 applies, subject to the Fourth Schedule's health-service exemption. And when the team rehearsed a leak at the route-planning vendor, the inventory showed it held names, addresses and phone numbers for about 40,000 patients but no results, so the Rule 7 scope was clear within the hour.

Keep it alive

An inventory decays from the day it is signed. Make it a gate: no vendor paid, form launched or software kit shipped without a row. Review it every quarter, and after any incident or any rights request that turns up data it missed. Keep dated versions, and file any DPIAs alongside. Seven months remain before 13 May 2027: enough for two weeks of mapping and the fixes it reveals.

Key takeaways

• Neither the DPDP Act nor the 2025 Rules require an ordinary data fiduciary to keep a record of processing, unlike GDPR Article 30.
• Rule 3 notices, s.11 access summaries, s.8(7) erasure, Rule 7 breach scoping, the s.6(10) burden of proof and s.36 information calls all depend on an inventory.
• Section 11(1)(b) needs the identities of every fiduciary and processor that received the data, not just categories of recipients.
• Build it in two weeks from three sources: system exports, the payments ledger and a walk through paper processes.
• Keep it alive by making a new row a condition for paying a vendor, launching a form or shipping a software kit.