Know Exactly What Data You Hold

A RoPA is a structured document listing every category of personal data your organisation processes, including purpose, legal basis, data categories, retention period, and processor details. Under DPDPA, Significant Data Fiduciaries are required to maintain an up-to-date RoPA. Even non-SDF companies benefit from maintaining one — it's the primary evidence document in any regulatory inquiry. DPDPA Shield generates your RoPA automatically from your data inventory.

A DPA is a contract between a Data Fiduciary (you) and a Data Processor (any third party that handles personal data on your behalf) that specifies the scope, purpose, and obligations of the processing. DPDPA S.8(2) requires written agreements with all data processors. A missing or expired DPA is a direct liability — if a processor causes a breach, you bear full regulatory responsibility without a valid DPA in place.

DPDPA Shield tracks 6 asset types: Database (PostgreSQL, MySQL, MongoDB etc.), Application (web apps, mobile apps, SaaS tools), File Store (Google Drive, S3, SharePoint), Third-Party (vendors and processors), API (external integrations), and Device (endpoints and servers). Each asset can be tagged with data categories and sensitivity level.

Yes. Data Inventory and RoPA generation are available on all DPDPA Shield plans, including Starter. There are no plan gates on this module — DPDPA compliance requires every organisation to know what data they hold, regardless of company size.