DPDP and personal data

DVSentry finds the personal data your code handles and shows where it goes, so you can evidence your work under India's Digital Personal Data Protection (DPDP) Act. It shows what the scans found and what your team recorded; it does not decide compliance. Notices, consent records, processor contracts and operations outside the code are not visible to a scanner.

Everything below sits under DPDP in the left menu.

#Where the data comes from

Every Smart or Full repository scan runs the personal data inventory scanner. It reads field names, tables, request handlers and outgoing calls, never a value, and records:

• what kinds of personal data the code collects (email, phone, Aadhaar, PAN, health data and so on) and which are sensitive;
• where each one is stored (table and column, and whether it is encrypted or hashed);
• where it is logged, written to a file or sent to a third party, and whether it is masked;
• whether each table that holds personal data can be deleted.

Cloud data stores come from your cloud accounts' newest full posture scans. Nothing new is read from your cloud.

#DPDP overview

DPDP → DPDP overview shows the numbers for the whole organization: repositories read, kinds of personal data, how many have no recorded purpose, tables with no deletion path found, third parties that receive personal data, open personal data findings, cloud data stores, open rights requests and open breaches. What to look at next lists the open items, each with a button to the page where you act on it. Where each part lives links to the four places below.

#Data map

DPDP → Data map is one register across all repositories:

• Data types: each kind of personal data, its fields, repositories and recipients. An Admin records its purpose, lawful basis (consent, legitimate use, legal obligation or other) and how long it is kept.
• Stores: each table, with its deletion answer: deletable, other copies not covered, soft delete only, or no deletion path found in this repository (that means none was found here, not that it cannot be deleted).
• Third parties: every external service the code sends personal data to.
• Cloud data stores: buckets and databases with region, exposure and the failing checks that touch encryption, public access, backups or logging.
• Breach scope: pick a table, a third party or a cloud store to see what personal data it holds.
• Erasure runbook: every place to act on when one person asks for their data to be erased, in order.
• Export: CSV, Markdown or JSON.

With many repositories, pick one under Source at the top of the data map to see only what was found there: its data types, the file and line where each one is collected, stored, logged or sent, its tables, its third parties and its erasure steps, with a link to the scan. Pick a cloud account to see only its data stores. All sources shows everything, with the repository named on every row. The DPDP overview's By source list opens the map on any one source.

#Can it be deleted

Each repository report's Personal Data tab has a Can it be deleted section and these findings:

When a place is fine as it is, review it in code with a reason, on the line or the line above:

# dvsentry-pii: ignore[pii/soft-delete-only] kept 30 days for refunds, then purged by the nightly job

Only scans run after this was added show these findings.

#Release rule

A release policy (Governance → Policies, Personal data) can fail the gate when an open finding shows personal data that is logged, written to a file or sent to a third party unmasked. Places reviewed in code and waived findings pass, so only new, unreviewed places fail a release.

#Rights requests

DPDP → Rights requests (Admins) logs each request a person makes about their data: access, correction, erasure, a grievance, a nominee, or withdrawing consent. Give it your ticket number as the reference (not the person's name), the date received and a due date (30 days unless you set one). An erasure request takes the data map's erasure runbook as a checklist; tick each step when it is done. Complete needs a note of what was done and where the evidence is, and every erasure step ticked; Refuse needs the reason. Reference, notes and proof are stored encrypted.

#Breaches

DPDP → Breaches (Admins) records a personal data breach: a short title, when you became aware and what it touched (tables, third parties and cloud stores picked from the data map). DVSentry shows the notice clocks from that moment (the Board's first intimation and telling affected people without delay, the Board's detailed report within 72 hours) and Draft the notices writes drafts of the notice to the Data Protection Board and to each affected person. DVSentry sends nothing: check each draft, fill in the [ ] parts and send it yourself, then record when it was sent. Confirm with your counsel which notices apply.

#Consent

DPDP → Consent lists each kind of personal data with its lawful basis from the data map. For a type based on consent, an Admin records the notice or consent form behind it (name and version), where it is collected, how a person withdraws it and where the evidence is kept. A type reviewed as consent with no record is shown as a gap and counted on the overview. DVSentry stores no person's consent, only where your own records are.

#Cross-border

DPDP → Cross-border lists every country personal data is stored in or sent to. Cloud data stores are placed by the region your cloud scan recorded; for each third party an Admin picks the country from the contract or the provider's data residency page. Each country outside India gets a review (allowed after review, on the restricted list, under review) with a note. DVSentry does not decide whether a transfer is lawful.

#Value check (optional)

The inventory reads field names, not values. An Admin can turn on Value check on the DPDP overview: the scanner then also counts, inside its isolated container, values in committed data files (CSV, JSON, SQL) that look like an email address, phone number, Aadhaar number, PAN, card number or UPI ID, and whether the values confirm the columns the names point to. Only counts leave the container, never a value. It starts with the next scan.

#DPDP evidence pack

Admins download the DPDP pack from Governance → Scorecards → Compliance evidence and Trust Center (PDF, Word or signed JSON). Its rows for sections 5, 6, 8(2), 8(4) and 8(7) and Rules 6(a) and 8(3) read the data map's numbers. Each row says what DVSentry recorded; the pack is supporting evidence, never a certification.

#Who can do what

Something missing or unclear? Tell us with Feedback in the app.