Section 8
Data discovery for DPDP data fiduciaries
You cannot protect, erase or explain personal data you have not found. Discovery shows which systems hold it, and what kind.
Sample workspace
Data inventory loans-db
- customers.pan_noPAN · confirmed
- customers.aadhaar_refAadhaar number · confirmed
- applicants.upi_handleUPI ID · suggested
- notes.free_textRejected
Latest scan
- Scan finished: 14 personal data fields
- Samples masked at source
- Confirm or reject 3 suggestions
Short answer
Under the DPDP Act a Data Fiduciary is responsible for the personal data it processes, including processing by its Data Processors (s.8(1)), and must take reasonable security safeguards (s.8(5), Rule 6). TruePrivacy's data discovery scans connected databases, cloud storage and SaaS tools, masks samples before they leave the source, and lists the personal data fields it finds for a person to confirm. Core obligations begin on 13 May 2027.
What data discovery does
Discovery builds the inventory every other duty depends on: what personal data you hold, in which system, and in which table or file.
Pre-built connectors with OAuth or API-key setup. Scanner sources include PostgreSQL, MySQL, MongoDB, Amazon S3, Azure Blob Storage, Google Drive, Slack and Zendesk.
System discovery lists the tools your organisation uses, added by website or domain with how you found them. Each is marked detected, reviewed or connected, so shadow SaaS becomes visible.
Scans list the tables, files and personal data fields they find. AI suggests a classification and a person confirms or rejects it.
59 detection rules, including Aadhaar, PAN, GSTIN, UPI ID, ABHA and Indian mobile numbers. See data classification.
The scanner masks samples before they leave the source system.
An optional DSPM endpoint agent scans local files on enrolled macOS, Windows and Linux devices.
How a discovery scan runs
- 01List your systems
Add the tools you use by website or domain, or review what system discovery has found. Each system is marked detected, reviewed or connected.
- 02Connect the ones holding personal data
Pick a connector from the catalog and authorise it with OAuth or an API key. All connectors are included on every plan, with no per-source fee.
- 03Scan and review
Scans list personal data fields by table or file, with masked samples. Confirm or reject each AI suggestion so the inventory reflects a human decision.
- 04Use the inventory
Records of processing sync from discovery, retention rules can target a data category or connected system, and rights requests fan out to connected systems.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Be responsible for processing, including processing by your Data Processors | s.8(1) | Lists the systems and fields that hold personal data, so you know what you are responsible for |
| Reasonable security safeguards, including masking and access control | s.8(5), Rule 6 | Shows where personal data sits so safeguards cover it; samples are masked at the source |
| Give a summary of personal data and its processing on request | s.11 | Gives you an inventory to prepare the summary from |
| Erase when consent is withdrawn or the purpose is no longer served | s.8(7) | Shows where data sits so retention rules and erasure tasks reach connected systems |
What a scan cannot see
Discovery covers the systems you connect and the devices you enrol. Systems you have not connected, and data held only by your processors, stay outside a scan. Use vendor assessments to ask processors what they hold.
Works with
59 detection rules for Indian identifiers, and data classes ranked most sensitive first.
Records of processingProcessing activities synced from what discovery finds, exportable for auditors.
IntegrationsThe connector catalog and system discovery behind every scan.
Retention and erasureRules per data category, connected system or processing activity, with an executions log.
Which systems can TruePrivacy scan?
Scanner sources include PostgreSQL, MySQL, MongoDB, Amazon S3, Azure Blob Storage, Google Drive, Slack and Zendesk. An optional DSPM endpoint agent scans local files on enrolled laptops and desktops.
Are personal data samples shown in full?
No. Samples are masked by the scanner before they leave the source. India data residency for customer personal data is available where offered.
Does the AI decide what counts as personal data?
No. AI suggests a classification for each finding, and a person confirms or rejects it.
Is there a fee per connected source?
No. All connectors are on every plan, with no per-source fee. Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin