Compare
TruePrivacy vs spreadsheets
Many DPDP programmes start in a spreadsheet. Here is where sheets fall short of the Act and Rules, and how to move off them.
Short answer
A spreadsheet can list processing activities, but DPDP work needs clocks, evidence and action across systems. Rule 7 asks for a detailed report to the Board within 72 hours, Rule 14(3) caps your grievance period at 90 days, and s.6(10) makes you prove notice and consent. A sheet runs no clocks, keeps no event log per person and purpose, and cannot send a withdrawal or erasure to the systems that hold the data.
Where spreadsheets fall short for DPDP
- No clocks. A date column does not start, pause or alert. Rule 7 and grievance deadlines depend on someone checking.
- No event log. Cells can be overwritten. File history, where your tool keeps one, is not an event log of each grant and withdrawal per person and purpose.
- No fan-out. A sheet cannot tell your CRM, database or processors to stop processing after a withdrawal (s.6(6)) or to erase (s.8(7)).
- Version drift. Copies multiply across teams and email, and nobody is sure which one is current.
- Access control. Anyone with edit access can change any row. A tracker that lists Data Principals is itself personal data that needs the Rule 6 safeguards.
Audit evidence gaps
When counsel, an auditor or the Board asks you to show your work, the question is what record exists, who made it and when. The table compares the two.
| Criterion | Why it matters under DPDP | TruePrivacy | In a spreadsheet |
|---|---|---|---|
| Consent proof | s.6(10): you prove notice and consent | Record per person and purpose, event log, consent receipts | A row per person, edited by hand, with no receipt |
| Rights requests | Rule 14: publish how to make requests, then act on them | Privacy center intake, identity verification, deadline tracking, tasks to connected systems | Requests arrive by email and are copied in by hand |
| Grievances | Rule 14(3): published period of no more than 90 days | Grievance desk with SLA states and escalation | A status column someone updates |
| Breach | Rule 7: intimations without delay, then a 72-hour detailed report | Incident record, risk assessment, a clock per audience | A log tab with times typed in after the event |
| Logs | Keep logs for at least one year (Rule 6, Rule 8(3)) | Audit trail of every action with before and after, exportable as CSV; logs kept at least one year | History depends on the file tool and who has access |
| Finding data | You cannot act on personal data you have not found | Connectors and 59 detection rules, with samples masked at the source | Whatever people remember to add |
A migration path
- 01Freeze the sheets
Date-stamp and archive the current trackers. Keep them as historical records and stop editing them.
- 02Connect systems and scan
Connect your databases, cloud storage and SaaS tools and run discovery to build the data inventory and records of processing.
- 03Set purposes and notices
Define consent purposes, write your notice text and switch on the banner. New consent records start from the cut-over date.
- 04Carry over open items
List open requests, grievances and incidents, decide how each moves across, and check its deadline before you switch.
- 05Retire the sheet
Remove edit access once nothing new is written to it, and keep the archive under your retention rules.
How to decide
A sheet can hold a first inventory. Once requests, withdrawals or incidents arrive, the gaps above become hard to manage. Run a sample withdrawal for DPR-1042 at Example Finance in your sheet and in TruePrivacy, and compare the evidence each leaves.
See consent management, breach management and the record-keeping guide. Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Can we run DPDP compliance on spreadsheets?
The Act does not name a tool. What matters is meeting the duties and proving it: clocks for Rule 7 and grievances, consent evidence under s.6(10), and logs kept for at least one year.
What evidence does DPDP expect us to keep?
Proof of notice and consent (s.6(10)), logs kept for at least one year (Rule 6, Rule 8(3)), and, after a breach, a detailed report to the Board within 72 hours (Rule 7).
Do we lose our spreadsheet history when we move?
No. Archive the sheets with a date and keep them as historical records under your retention rules.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin