Evidence

Discovery does not end at a finding. Every decision, certification and remediation produces an artefact mapped to a requirement and control, so the outcome is defensible in an audit.

Compliance Mapping Engine

Finding → Requirement → Control → Evidence → Action

Framework	Requirement	Control	Evidence	Gap category
DPDP	Maintain an accurate record of personal data processing	Data inventory reconciliation	Reconciliation report	Inventory Gap
DPDP	Identify a responsible owner for every data asset	Ownership assignment workflow	Owner certification	Ownership Gap
DPDP	Process personal data only for a specified purpose	Purpose documentation in RoPA	RoPA extract	Purpose Gap
DPDP	Erase personal data when the purpose is served	Retention schedule enforcement	Deletion log	Retention Gap
DPDP	Obtain verifiable consent for children's data	Children's data detection rule	Finding review record	Children's Data
DPDP	Apply reasonable security safeguards	Encryption and access control discovery	Control assessment	Unapproved Location
ISO 27701	Limit collection to what is necessary	Duplicate and excessive data analysis	Minimisation review	Excessive Data
GDPR	Document transfers outside the primary jurisdiction	Cross-border flow discovery	Transfer register	Cross-Border
Internal Privacy Policy	Every discovered repository must map to a processing activity	RoPA mapping	RoPA linkage	RoPA Gap

14 records

Evidence	Artefact	Type	Requirement	Framework	Linked To	Owner	Captured	Status
EV-100	Full Scan — PAYROLL-DB-01 — scan report.pdf	Scan Report	Maintain an accurate record of personal data processing	DPDP	SC-001	Discovery Operator	06 Sept 2026	Accepted
EV-101	Incremental Scan — CRM-APP-01 — scan report.pdf	Scan Report	Maintain an accurate record of personal data processing	DPDP	SC-002	Discovery Operator	05 Sept 2026	Accepted
EV-102	Targeted Scan — CUSTOMER-PORTAL — scan report.pdf	Scan Report	Maintain an accurate record of personal data processing	DPDP	SC-003	Discovery Operator	04 Sept 2026	Accepted
EV-103	On-Demand Scan — FIN-SRV-02 — scan report.pdf	Scan Report	Maintain an accurate record of personal data processing	DPDP	SC-004	Discovery Operator	03 Sept 2026	Accepted
EV-104	Re-scan — EMP-FILES-NAS — scan report.pdf	Scan Report	Maintain an accurate record of personal data processing	DPDP	SC-005	Discovery Operator	02 Sept 2026	Accepted
EV-200	GP-001 — Reconciliation report.pdf	Remediation Evidence	Maintain an accurate record of personal data processing	DPDP	GP-001	Rohit Malhotra	14 Sept 2026	Pending Review
EV-201	GP-002 — Owner certification.pdf	Remediation Evidence	Identify a responsible owner for every data asset	DPDP	GP-002	Unassigned	17 Sept 2026	Accepted
EV-202	GP-003 — RoPA extract.pdf	Remediation Evidence	Process personal data only for a specified purpose	DPDP	GP-003	Vikram Chandra	20 Sept 2026	Accepted
EV-203	GP-004 — Deletion log.pdf	Remediation Evidence	Erase personal data when the purpose is served	DPDP	GP-004	Anita Rao	23 Sept 2026	Pending Review
EV-204	GP-005 — Control assessment.pdf	Remediation Evidence	Apply reasonable security safeguards	DPDP	GP-005	Karan Mehta	26 Sept 2026	Accepted

Page 1 of 2