Data Discovery & Classification
Find every piece of personal data you hold — across databases, cloud storage, SaaS apps and APIs — before you try to govern it.
What it does
You cannot honour a deletion request, build a RoPA or scope a breach if you do not know where personal data lives. Discovery is the module everything else depends on, which is why it is the one we start every deployment with.
Read-only connectors scan structured and unstructured sources on a schedule you set. Classification is checksum-validated for India-first identifiers — Aadhaar, PAN, GSTIN, UPI handles, Indian mobile formats — rather than the US-centric patterns most tools ship with, so the false-positive rate stays low enough to act on.
The output is a live inventory and identity graph: which systems hold data about a given person, how it flows between them, and which stores have drifted out of policy since the last scan.
Capabilities
Automated scanning across 35+ data sources
Relational and NoSQL databases, object storage, data warehouses, file shares, SaaS apps and APIs — connected read-only, scanned on schedule.
Checksum-validated India PII detection
Aadhaar, PAN, GSTIN, UPI and Indian mobile formats validated by checksum, not regex alone, so a column of random digits is not flagged as Aadhaar.
Sensitive and children's data flags
Health, financial, biometric and caste/religion markers, plus the age signals that trigger the DPDP Act's heightened duties for children.
Cloud DSPM & shadow-data discovery
Finds the forgotten snapshot, the open bucket and the dev copy of production — the stores that never make it onto a manual inventory.
Identity graph & lineage
Links records about the same person across sources, so a rights request resolves to every copy rather than the one system someone remembered.
Which duties this discharges
The obligations under the DPDP Act 2023 that this module is built to satisfy. The Act takes full effect on 13 May 2027.
- s.8(4)Keep personal data complete, accurate and consistent
- s.8(7)Erase data when the purpose is served — you must know where it is
- s.9Identify children's data and apply heightened obligations
Section references are to the Digital Personal Data Protection Act, 2023 and are provided for orientation, not as legal advice.
Works with
Governance, Records & Audit
The obligations that prove you are compliant — records, assessments, retention and audit integrity — kept current instead of rebuilt before each audit.
Read moreData Principal Rights
Automate the rights a Data Principal is owed — access, correction, erasure, nomination and grievance — end to end, with signed proof.
Read moreAI Governance & Cloud Posture
Know which models touch personal data, where that data came from, and whether your cloud posture still matches what you told the regulator.
Read moreSee Data Discovery & Classification on your own data
A 30-minute walkthrough against the systems you actually run — not a generic demo environment.