Data mapping shows where personal data moves, who touches it, and which outside organisations receive it.
The step people compress
One DPDP vendor says clients ignore data mapping more than any other activity. I can confirm it from the field.
Data mapping is the step every programme compresses into a template. It is also the step the whole law stands on.
What real mapping covers
Real mapping at one client meant interviewing people across the whole company.
- Mapping custody of the crown-jewel assets.
- Registering every outside organisation the data touches.
- Following the movement of data across the business and its external relationships.
The data flow map guide explains the record this work creates. The data inventory guide helps name the fields and systems first.
The finding a template missed
The finding that mattered was a single unreleased asset crossing more external hands than anyone in the building could list from memory.
A standard template would have produced a tidy spreadsheet and missed the entire supply chain.
That is why the vendor checklist should begin with questions about the work behind the document.
The question for your programme
Ask who has spoken to the people handling the data.
Ask who has mapped custody of the assets that matter most.
Ask for the list of outside organisations the data touches. That list is the first clear test of whether mapping happened in the field.
Test your data map
Interview people across the whole company about the data they handle.
Map custody of the assets that matter most to the business.
Register every outside organisation the data touches.
Compare the map with a standard template. Record what the template misses.
Ask who owns the finished map and keeps it current.
Next step
Read the public DPDP scope and see where data mapping fits in the full programme.
See the DPDP scope →Related reading
Written by Sushant Pasumarty
DPDP consultant. Founder, Meridian Bridge Strategy. This page began as field notes from live client work.