DPDP Gaps
Compliance gaps generated automatically from discovery findings and inventory reconciliation outcomes.
Open Gaps
7
In Remediation
2
Critical / High
8
Closed
1
Gap distribution
- Inventory Gap2 gaps
- Ownership Gap1 gaps
- Purpose Gap1 gaps
- Retention Gap1 gaps
- Unapproved Location1 gaps
- Children's Data1 gaps
- Cross-Border1 gaps
- Excessive Data1 gaps
- RoPA Gap1 gaps
How gaps are generated
- Inventory Gap — personal data discovered with no inventory record.
- Ownership Gap — personal-data repository without an identified owner.
- Purpose Gap — data exists but no processing purpose is mapped.
- Retention Gap — data retained beyond the defined period.
- Unapproved Location — personal data in an unapproved repository.
- Children's Data — potential children's data identified.
- Cross-Border — personal data discovered overseas.
- Excessive Data — data outside the expected processing scope.
- RoPA Gap — discovered data asset with no RoPA mapping.
10 records
| Gap ID | Category | Finding | Data Asset | Repository | Owner | Risk | Regulatory Requirement | Recommended Action | Due Date | Status | Actions |
|---|---|---|---|---|---|---|---|---|---|---|---|
| GP-001 | Inventory Gap | Aadhaar numbers discovered in Employee Documents with no inventory record | Employee Documents — Identity Data | Employee Database | Rohit Malhotra | Critical | DPDP s.8(1) — accountability for processing | Create inventory record and assign data owner | 14 Sept 2026 | In Remediation | |
| GP-002 | Ownership Gap | Legal Case Files repository has no identified data owner | Legal Case Files | Payroll Database | Ownership Gap | High | DPDP s.8(4) — organisational measures | Assign business and data owner | 17 Sept 2026 | Open | |
| GP-003 | Purpose Gap | Marketing Lead Lists processed without documented purpose | Marketing Lead Lists — Contact Data | Recruitment Folder | Vikram Chandra | High | DPDP s.4(2) — lawful purpose | Document processing purpose and consent basis | 20 Sept 2026 | Open | |
| GP-004 | Retention Gap | Date of birth records retained beyond 7 years in Document Archive Bucket | Document Archive Bucket — Identity Data | Employee Documents | Anita Rao | Medium | DPDP s.8(7) — erasure obligation | Erase or justify continued retention | 23 Sept 2026 | Open | |
| GP-005 | Unapproved Location | KYC documents found in an unapproved shared drive | Finance Shared Drive — Financial Data | CRM Contact Database | Karan Mehta | Critical | Internal data localisation policy | Relocate to approved KYC store and purge copies | 26 Sept 2026 | Open | |
| GP-006 | Children's Data | Potential minor beneficiary details in Support Ticket Store | Support Ticket Store — Children's Data | Customer Portal DB | Priya Nair | Critical | DPDP s.9 — verifiable parental consent | Verify parental consent and restrict processing | 29 Sept 2026 | In Remediation | |
| GP-007 | Cross-Border | Personal data discovered in AWS us-east-1 archive | Document Archive Bucket | Support Ticket Store | Deepak Sharma | High | DPDP s.16 — cross-border transfer | Assess transfer and record safeguards | 02 Oct 2026 | Open | |
| GP-008 | Excessive Data | Credit card numbers detected outside payment scope | Support Ticket Store — Financial Data | Marketing Lead Lists | Farah Sheikh | Critical | DPDP s.6(1) — data minimisation | Mask/remove card data from support records | 05 Oct 2026 | Open | |
| GP-009 | RoPA Gap | Analytics Warehouse datasets not mapped to any processing activity | Analytics Warehouse | Finance Shared Drive | Rohit Malhotra | Medium | DPDP s.8(9) — records of processing | Map data asset to RoPA activity | 08 Oct 2026 | Open | |
| GP-010 | Inventory Gap | Passport numbers in Mail Archive Store not inventorised | Mail Archive Store — Identity Data | KYC Document Store | Sneha Iyer | High | DPDP s.8(1) | Create inventory record and classify | 11 Oct 2026 | Closed |