ayushhvdo

India’s DPDP Act has pushed many mid‑market and enterprise organizations into the same practical realization: compliance is not just about publishing a privacy notice or collecting consent. It is about being able to explain, at any point in time, what personal data you process, why you process it, where it flows, who touches it, how […]

1) Data Inventory (what data, about whom, and where) Include fields that let you answer: “What personal data do we process in this activity, for which data principals, and in which systems?” Minimum fields to include: data principal group(s), personal data categories, high-risk tags (for example, financial identifiers/children), source channels (web/app/call center/partner), primary systems of