India · DPDP · Data inventory
PII data discovery: the first step of DPDP compliance.
PII data discovery finds and lists the personal data an organisation holds, wherever it sits. Under the DPDP Act it is the starting point for notices, safeguards, retention and breach reporting.
PII data discovery is the automated search of an organisation’s systems for personally identifiable information, so that every store of personal data is known, classified and owned. Under India’s DPDP Act it is the first step of compliance, because notices, consent, security safeguards, retention and breach reporting all depend on knowing where personal data is.
How PII discovery works
| Method | What it does | Good for |
|---|---|---|
| Pattern matching | Regular expressions and checksums for structured identifiers | Aadhaar, PAN, IFSC, card and phone numbers |
| Dictionary and context | Field names, nearby words and column headers | Names, addresses and dates of birth |
| Database schema scanning | Samples columns in each table and flags personal data | SQL and NoSQL databases |
| File and email scanning | Reads documents, spreadsheets, PDFs and mailboxes | Shared drives, email and cloud storage |
| Endpoint agents | Scans laptops and servers where files collect | Downloads, exports and local copies |
Indian identifiers a discovery tool must recognise
- Aadhaar numbers (with the Verhoeff checksum)
- PAN numbers
- Passport, voter ID and driving licence numbers
- Indian mobile numbers
- Bank account numbers and IFSC codes
- UPI IDs
- GSTIN, which can identify sole proprietors
What to do with the inventory
- Classify. Mark sensitive stores, children’s data and data shared with processors.
- Assign owners. Every store needs a named owner.
- Apply safeguards. Encrypt, mask or delete what you do not need, and restrict access.
- Test. Penetration test the systems that hold the most sensitive data.
Frequently asked questions
What is PII data discovery?
The automated search of systems for personal data, so that every store of it is known, classified and owned.
Is PII discovery required by the DPDP Act?
The Act does not name a tool, but its duties on notice, safeguards, retention and breach reporting cannot be met without knowing where personal data is.
Does Sumrite’s tool send our data outside our network?
No. It runs on a host inside your own network, so the personal data it finds never leaves it.
More on the DPDP Act
Build your personal data inventory for free
Run the free tool, then talk to Sumrite about testing the safeguards.