Personal data mapping, consent records, access roles, retention rules and breach response, written into the software you already run
Personal data hides in odd places. We map every CRM, billing export, enquiry inbox and backup that holds it, then build consent records, access roles, retention jobs and a breach runbook into the software. Your lawyer reads the privacy law.
- The data map comes before any recommendation
- Engineering from us, legal questions to your lawyer
- No package makes a business compliant alone
Clinics hold patient records. Schools hold children’s details, lenders hold identity-check (KYC) scans and e-commerce brands hold addresses and payment histories, so each faces a different exposure and needs different controls. Service companies fit as well. Their enquiry forms have gathered years of extra fields, free-text boxes and attachments that nobody has reviewed, and each one is a record someone must protect. The scope is engineering. That covers consent capture, roles that limit who sees what, retention jobs that actually delete, a tested deletion path and a breach plan the team can follow.
Where Personal Data Is Held Without a Clear Record
Copies Across Many Systems
Copies multiply quietly. A phone number can sit in the CRM, billing software, an exported sheet, a WhatsApp group, an enquiry inbox and a backup, and nobody has listed them.
Access Without Roles
One login opens everything. Where roles were never set up, a data entry login reads the same addresses, ID documents and payment history as the owner does, because nobody defined a lower level.
Forms That Collect Extra Fields
Templates collect too much. A contact form may ask for date of birth, full address and a free-text box only because the template shipped with them. Unused fields still need protecting.
Records Kept With No Retention Rule
Nothing ever expires. Old enquiries, candidates who never joined and customers who left years ago stay in the database, and without a retention rule the volume of personal data only grows.
Files Held in Personal Accounts
A leaver keeps the file. A customer sheet made on a personal login and shared by link stays reachable after that person leaves, because handover covers the laptop and phone.
Third-Party Tools Connected to Forms
Old integrations keep copying. A website form connected to an email platform during a campaign stays in place after it ends, so every enquiry since has been copied into a system that nobody reviews.
No Written Plan for an Incident
Nobody owns the first hour. A stolen laptop, an exposed database or a copied customer list raises the same questions: who is called, what is checked first, who is told, what is recorded. Today each answer is improvised.
Data protection is not one document. It means knowing what is held, collecting less, limiting who opens it, deleting what is no longer needed and rehearsing an incident before one happens.
Map, Reduce, Control Access and Prepare a Breach Response
Work starts with a data map. It lists every system, form, sheet, inbox and backup that holds personal data, and records what each holds, why, who can reach it and how long it stays. From that map, unneeded fields are removed, consent capture and role-based access are built into the software, and retention rules run on a schedule without reminders. The team gets a written breach response.
Collecting Less Data
Unneeded data needs no protection. Each form is reviewed field by field, and anything nobody uses is removed before any control is built, so the later work covers fewer records and fewer systems.
Consent With Purpose and Date
Each consent record stores purpose, timestamp, source form, language and the notice version the person saw, so the answer to any query can be read from the record. Withdrawal stops the processing itself. It never only sets a flag.
Controls Inside the Software
Rules must live in code. Roles, field masking, audit logs, retention jobs and deletion paths are implemented inside the systems, because a rule that depends on staff remembering it is not a control.
What Changes When Data Protection Is Engineered
What the business gets, before any talk of technology.
A One-Page Answer on What Is Held
The answer is on one page. A written record lists what personal data is held, in which systems, for what purpose, who can reach it and how long it stays. It is kept current.
Forms Limited to Fields in Use
Template leftovers are deleted. Fields that existed only because the form template included them are removed, and each remaining field carries a stated purpose, which keeps every later control smaller.
Access Matched to the Job
The counter sees only what service needs. The accounts desk sees the ledger and invoices, full records need a stated reason, and every export is capped and logged against a named user.
Consent and Withdrawal Recorded
Withdrawal reaches the live list. Each record keeps purpose, timestamp, language and source for the person, and requests land in a monitored inbox with a named owner accountable for the reply.
Old Records Removed by Rule
Old records leave on schedule. Enquiries, candidate records and closed accounts age out under a retention job that runs unattended, so the volume of held data stops growing without limit.
A Checklist for an Incident
Everyone knows the first call. The runbook names who is called first, what is isolated, what evidence is kept, who is told and what is recorded, and it is agreed in advance.
What Data Protection and Privacy Readiness Work Includes
Everything from the first discovery session to production and long-term upkeep.
Personal Data Discovery and Mapping
Discovery finds the copies. Databases, applications, forms, spreadsheets, inboxes, shared drives and backups are scanned for personal data, and the map records what is held, why, and who can reach it.
Data Minimisation Review
Every field gets questioned. Forms and screens are reviewed field by field, asking who uses each one and for what, and the output is a list of fields to stop collecting.
Consent Capture and Records
Consent is captured, not assumed. It is built into web forms, counter software and WhatsApp flows with purpose, timestamp, language and source stored, and a withdrawal path reaches every downstream system.
Privacy Notice and Purpose Documentation
The notice describes real systems. A plain-language notice states what is collected, why, who receives it and how long it is kept, and it is drafted from the data map rather than copied.
Role-Based Access Design
Permissions follow the job. Roles are rebuilt around what each person does, identifiers are masked at field level, bulk export is restricted, and each administrator right is justified.
Retention and Deletion Rules
Deletion runs by itself. A retention schedule is set per record type, such as enquiries, candidates or closed accounts, and implemented as jobs that archive or delete on time. Backup handling is written down.
Data Subject Request Handling
Requests have a route. A working path covers requests from a person to see, correct or erase their data. It defines where the request lands, who acts, how identity is checked and what is recorded.
Security Controls and Hardening
Hardening closes the plain gaps. This covers TLS in transit, encryption at rest, two-step login, database hardening, logs that survive an incident and removal of default or shared accounts.
Third-Party and Processor Review
Every vendor is listed. A list names the vendors that touch the data, what each receives, where it is hosted and what the contract says, and forgotten integrations are marked for disconnection.
Breach Detection and Response Plan
The first hour is planned. Alerting is set for bulk exports and failed logins, and a written runbook names who does what in the first hour, with a template to record the incident.
Staff Handling Rules and Training
Training stays practical. Short sessions cover exports, chat groups, personal drives and customer photographs, and they also cover what happens to a person’s access on the day they leave.
Readiness Assessment and Roadmap
The report sets the order. A written report ranks every finding as fix now, plan later or fine as it is, and legal questions are marked clearly for the client’s lawyer.
Where Data Protection Work Is Needed
The processes this service is most often asked to set up and automate.
Clinic Group With Shared Patient Records
A clinic group with several branches has front desk logins that can open any patient history, so roles now limit the desk to registration and billing. Clinical notes need a clinical login. Each opened record is logged. Old scanned IDs get a retention rule.
Lending Business With KYC Documents
Identity-check (KYC) scans sit in a shared folder. Document scans collected by field agents can be browsed by any staff member, so uploads move into the loan record with restricted access and masked identifiers. Rejected applications get a retention rule.
School With Long-Held Student Data
One system holds everything. Admission forms, photographs, parent phone numbers and medical notes sit together with no role separation, so the office and the teachers are split onto different views. Management sets retention with its lawyer.
Therapy Practice With a Detailed Contact Form
The free-text box leaks. A therapy website’s free-text box feeds a shared inbox and an email marketing tool, so the box is removed and the tool is disconnected. Enquiries go to one private inbox. Advertising pixels come off the booking pages.
E-Commerce Brand With a Shared Admin Login
One login, many people. Customer addresses and order history are readable through one shared admin login, and a former developer’s account still has database access to the live store. Individual accounts with two-step login replace both. Old credentials are revoked. Bulk downloads raise an alert.
Business-to-Business Seller Holding Little Data
Little data, little work. A firm selling only to other businesses holds contact names, tax ID numbers and purchase history, so the work is limited to tighter access and a short notice. The report says so plainly.
Is this the right service for you?
It suits businesses that have outgrown manual processes and want a system they can rely on.
Businesses Holding Health, Financial or Children’s Data
Sensitive records raise the stakes. Clinics, diagnostic centres, therapy practices, lenders, insurance intermediaries and schools hold health, financial and children’s records, and exposure of those records has personal consequences for real people.
Companies With Customer Data Spread Across Systems
Nobody has counted the copies. The same person may exist in the CRM, billing software, a marketing tool, a courier portal and several spreadsheets, each holding a slightly different version of the record.
Businesses Building or Rebuilding an Application
Build it in early. Consent, roles, logging and retention are simplest to add while the screens are being designed, because adding them after go-live means migrating live data and retraining staff.
Firms Answering Customer Questions on Data
Questionnaires arrive without warning. Hospitals, banks, overseas companies and other larger clients send a security questionnaire before signing, and answering it accurately means first knowing what personal data is held and where.
Owners Responding to an Incident
Incidents force the review. A stolen laptop, a departing employee with the customer list or a phishing email each prompt the same response: a data map, tighter access and a plan.
Businesses Holding Only Basic Contact Data
Small scope, small job. A business holding only company contact details, tax ID numbers and purchase history has a smaller scope than a clinic holding patient records. Where data sits in one system behind controlled logins, tighter access and a short notice may be all the engineering needed, and the assessment report says so.
What it can do, in plain terms.
Data Inventory and Flow Map
Every data store is listed. Each entry records purpose, sensitivity, access, location and onward flow, in a format the client’s own team can maintain after the engagement ends.
Consent Records With Purpose
Each person has a history. Purpose, timestamp, language, source and version are stored per person, and the full history of every change is kept so the record can be read back later.
Working Withdrawal Path
Opt-out is tested. An opt-out removes the person from live sending lists and from downstream systems such as the email tool, and the whole path is tested end to end.
Role and Field-Level Permissions
Access follows the job. Identifiers are masked on screens that do not need them, and a full record opens only when the user states a reason, and that reason is logged.
Bulk Export Controls
Bulk exports are capped. Downloads are limited to specific roles and logged with who, when and how many rows, and an unusual volume raises an alert to a named person.
Audit Logging
Logs cannot be edited. They show who opened, changed, exported or deleted which record, and they are stored where the people they record have no write access.
Retention Jobs
Deletion leaves a receipt. Archival and deletion run on a schedule per record type, such as enquiries or closed accounts, and a report afterwards lists what was removed and when.
Erasure and Access Request Handling
Every request has an owner. A defined path runs from request to action, covering identity checks, what is produced for an access request, what a correction changes and how backups are treated.
Encryption and Key Handling
Keys stay out of code. Data is encrypted in transit and at rest, and keys are held in managed key storage rather than in the application’s own source.
Processor Register
The register stays current. A list shows the vendors touching the data, what each receives, where it is hosted and what the contract covers, and it gains a row for each new tool.
Breach Runbook
No step depends on who happens to remember it. The runbook covers who is called, what is isolated, what evidence is kept, who is told and what is recorded, with real names and phone numbers.
Joiner and Leaver Access Control
Leavers lose their access. Access is granted by role on joining and removed on the last day, and a periodic review lists who still holds what, including shared drives and admin panels.
How the work runs, step by step.
From the first conversation to a release your team uses every day. Each step says what you provide and what you get back.
- 01
Discovery and Data Mapping
Systems, forms, shared drives, inboxes and backups are reviewed one by one, and the personal data in each is recorded with its purpose, owner and last-used date. The client gives read access and describes informal places where data lives, such as chat groups, personal drives and old exported sheets, because the scan cannot see those.
- 02
Risk Review and Minimisation
Findings are ranked by sensitivity and exposure, so an exposed ID scan outranks a stale marketing list, and fields to stop collecting are marked beside each finding. Each department names one person. That person knows which fields are used.
- 03
Readiness Report and Roadmap
The report ranks every finding as fix now, plan later or leave alone, and each item gets a plain-language reason and a rough size of work. The lawyer joins here. Several items are legal questions, not engineering ones.
- 04
Engineering the Controls
Consent capture, roles, masking, logging, retention jobs and request handling are built into the systems that already run the business, and are tested before release. The client decides retention periods. A test environment stands in for live data.
- 05
Breach Plan and Staff Rules
The runbook is written, alerting is configured, staff receive short practical training on exports and personal drives, and a rehearsal walks the team through a stolen-laptop scenario. The client agrees who will be called.
- 06
Verification and Review Rhythm
Testing checks that deletion deletes, that withdrawal stops messages and that access matches the roles, and the results are written up as evidence for an auditor. The client names an owner. A date for the next review is fixed.
What you receive when the work is done.
Everything needed to run, maintain and extend the software without depending on us.
It connects to the systems you already use.
Tools that work stay. The new system is joined to them rather than replacing them.
Business Systems Holding Data
- Custom applications and portals
- Zoho CRM and Zoho One
- QuickBooks or Xero
- Odoo
- Clinic, school and lending software
Identity and Access
- Google Workspace
- Microsoft 365 and Entra ID
- Two-step verification
- Password managers
- Single sign-on
Hosting and Storage
- AWS
- Azure
- Google Cloud
- Regional data centre hosting
- Encrypted backup storage
Customer Channels
- Website forms
- WhatsApp Business Platform
- Email marketing tools
- Payment providers
- Courier and logistics portals
Monitoring and Logging
- Centralised log storage
- Alerting on bulk exports
- Uptime and intrusion monitoring
- Backup restore testing
Chosen for reliability and a long life.
Picked to match your scale and to stay maintainable for years.
Access Control
Data Protection
Discovery and Classification
Logging and Alerting
Retention and Deletion
Why owners choose GullySystem.
Engineering by Us, Legal Reading by Your Lawyer
Each side has a job. We engineer controls, write documentation and produce evidence, while legal interpretation belongs to the client’s lawyer, with whom the work is done side by side.
Compliance Is Not a Product
No tool is a shortcut. No software, certificate or package makes a business compliant, and what exists instead is a set of controls that can be shown and decisions that can be explained.
The Map Comes Before the Policy
The map comes first. A privacy notice written before the systems are read describes a business that may not exist, so the data map is prepared first and the documents follow.
A Search for Data to Delete
Deleting beats defending. The review begins by removing unused fields and unneeded records, because data that is no longer held cannot leak and needs no protection.
Controls Inside the Software
Memory is not a control. Roles, masking, logging and retention jobs are implemented in the systems themselves, because a control that depends on daily staff memory fails the first busy week.
Testing of Deletion and Withdrawal
Tests catch the quiet failures. Erasure paths, opt-outs and access restrictions are verified end to end, including what remains in backups, because a control that was never tested is not known to work.
How the engagement can be shaped.
Each model says what it suits and how the work is scoped. Pick the one that fits, or ask which one we would suggest.
Data Protection Assessment
It suits an organisation that handles personal data and has never mapped where it lives; named systems and teams form the scope. A privacy analyst and a systems engineer run discovery and mapping, while your contact introduces the process owners. A system found mid-review gets a note and a price first. A prioritised report ends it.
Readiness Implementation
Meant for an organisation holding a report and still needing controls: consent capture, masking, logging, retention and the breach runbook, itemised in the quotation. Engineers, a tester and a privacy lead build inside the systems you already use, and your contact approves each control before it goes live. A later control is added by a note, priced before the build. Runbooks and access are handed over.
Privacy by Design in a Build
Choose this for a new application that will collect personal data from its first screen; the protection work is billed inside the build’s phases. Designers, developers and a privacy lead settle data fields, retention and access roles during design, and your product owner approves them. Changing a field later is priced as an amendment before it is built. The data map is yours.
Ongoing Review
Aimed at an organisation whose systems and vendors keep changing, with a recurring review on a monthly fee. A privacy analyst and an engineer check access, the processor register, retention jobs and breach rehearsals, and your contact assigns the fixes. Work beyond the routine review is raised in a note first. Registers and logs return to you on exit.
Define what a successful engagement must prove.
Use these checks to agree the evidence, responsibilities and acceptance criteria for the work you commission.
Consent With Purpose and Date
Where is personal information copied, exported and deleted?
For “Consent With Purpose and Date”, trace a fictional personal-data field from collection through exports and deletion. Record who holds each copy and take the resulting map to the person responsible for your privacy obligations.
Background reading: MeitY: DPDP rules and notifications
Data Inventory and Flow Map
What happens to movements entered while a count is being checked?
For “Data Inventory and Flow Map”, choose a count date and trace the movements around it. Agree who investigates a difference before an adjustment changes the available balance.
Background reading: ERPNext: stock reconciliation
Checks to run on your own records.
Acceptance is something you can test, not a feeling. Run these with your own data before the work is called done.
Find one person across every system
Choose a real customer, or a test person, and search for them in the CRM, billing, the enquiry inbox, exported sheets and backups. Compare what you find with the data map. A pass is a map that already lists each copy.
Withdraw consent and watch the sending list
Record consent for a test contact, then withdraw it through the normal route. Check the live email or WhatsApp sending list and the downstream tools. A pass is that no further message goes out. A flag alone is not enough.
Test a lower role against sensitive fields
Sign in as front-desk or data-entry staff and try to open a full record, an ID scan and a bulk export. A pass is masked identifiers and a stated reason for any full view. Exports are logged and capped.
Submit a test access and erasure request
Send a request for a test person’s data to be shown, corrected and erased. Follow it from inbox to owner to action, then read the retention receipt. A pass is a recorded route and real deletion. Backups are treated as written.
What is in, what is out, and what stays with you.
Engineering and evidence this work includes
The work maps personal data and removes unused fields. It builds consent records, roles, masking, logging, retention jobs and request handling, then writes the breach runbook and processor register. Each control is tested and documented. That is engineering and evidence.
Items outside engineering scope
Legal positions, such as purpose, lawful basis, notification duties and whether an officer is needed, are not ours to decide. We mark them clearly. Further systems found midway are named and priced first. Nothing here is legal advice.
Retention periods and contracts stay with you
Your lawyer sets retention periods and reads vendor contract terms and transfer rules. You decide which fields to stop collecting and who owns requests. Third-party tool fees are yours. No tool or package makes a business compliant alone.
Registers, logs and who owns them
The data map, processor register, retention schedule, runbook and logs return to you on exit, in a form your team can keep current. A named owner on your side answers requests. Added controls follow a priced note.
When something simpler is the better choice. A business holding only company contact details in one system behind controlled logins may need little more than tighter access and fewer form fields. A short notice also helps. The assessment can say so. Ask your lawyer whether any formal duty applies.
Questions owners ask first.
Plain answers to the questions asked before work starts.
When do the privacy obligations apply to us?
The dates come from the privacy laws of the countries you trade in, such as the GDPR, so ask your lawyer to confirm which duties apply to your business. Do not take dates from vendor websites. Mapping data, fixing access, adding retention jobs and testing deletion all take real engineering time, so start well before any deadline.
Can you make us compliant with privacy law?
No. Compliance is a legal conclusion about a business, drawn by its lawyer, and it rests on decisions about purposes, retention and risk that only the business can make. We map what is held, cut what is not needed, build consent records, access roles, retention and logging, write the breach runbook and document the decisions. That is engineering and evidence. Where the rules are unclear, your accountant decides and the software records the decision. The software records and prepares data, but it does not give legal advice or file anything without your approval.
What is the first thing we should do?
Find out what is held. Personal data is not only in the CRM. It is also in exported spreadsheets, shared drives, an old enquiry inbox, chat groups, marketing tools, backups and personal accounts of former staff. Until that map exists, policies rest on guesses. Mapping can turn up data that can simply be deleted or never collected again, which makes every later step smaller, from the access roles to the retention jobs.
Does our data have to be stored in one country?
That is a legal question, so ask your lawyer first. The answer depends on the rules on transfers outside the country and on your sector, and banking, insurance, health and payment businesses carry sector rules of their own. We cover the engineering side: which systems and vendors store data abroad, what hosting in a local region involves and what a move would change. That goes into the report.
What happens if we have a data breach?
Follow the runbook and ask your lawyer to confirm the notification duties. The runbook covers the practical side. It names who is called first, what is isolated, what evidence is preserved before fixing begins, who signs off any notification and what is recorded. Preserve the logs first. A hurried team can destroy the logs that would show what happened and how far it spread across the CRM, the file server and the backups.
Do we need consent for every message?
Not for every message. A service notice, invoice or delivery update to a customer you already deal with differs from marketing to a list. Whether consent applies is a legal question. Where it does apply, consent has to be specific, informed and withdrawable, which means a purpose and a date recorded for each person and each form. Then we test that withdrawal removes the person from the real sending list used by the email tool or the WhatsApp broadcast, not just a flag nobody reads.
How long should we keep customer data?
It depends on the purpose the data was collected for and on any separate law requiring records to be kept. Tax and company law sets retention periods for invoices and financial records, and those take priority, so the schedule respects them. Your lawyer sets the periods. We implement the periods as scheduled jobs, with a report after each run listing what was removed, from which system, under which rule and when.
What about data sitting in old backups?
Backups are the harder part. Removing one person from an encrypted backup is rarely practical, so the usual approach is a backup lifecycle in which old copies expire on a defined schedule. Erasure requests are logged and re-applied whenever a backup is restored, and that position is written down for the client’s lawyer to read.
Do we need to appoint a Data Protection Officer?
Your lawyer decides that. Every business still benefits from a named owner, someone who receives customer requests, is called when something goes wrong, reviews access and keeps the data map current. A small firm picks the owner.
How much does this cost?
Cost follows the data. The main factors are the systems to map, how much data sits in unstructured sheets and inboxes, and how much must be built rather than configured. Re-engineering and ongoing review change it. The figure is confirmed after discovery.
Can you work with our existing lawyer or auditor?
Yes, we can. We take the technical side: what exists, what is exposed, what can be built, what it involves and who on the client’s team must decide each point. The lawyer takes the legal positions, such as purposes, lawful basis, retention periods, vendor contract terms and notifications, and we do not substitute our reading for theirs. The report is written for them. Legal questions are marked as legal questions.
We are a small business. Does any of this apply to us?
Whether the law applies to you is a question for your lawyer. What changes with size is what is proportionate. A ten-person firm holding company contacts and purchase history has a small scope, so it can tighten logins, remove unused fields and write a short notice. A clinic holding patient histories and scanned IDs faces much more work, with roles, masking, retention rules and a breach plan all in scope.
Build it in now or add it later?
Build it in during development. Consent fields, role-based access, audit logging, masking and retention are simpler when designed alongside the screens, since each one changes what a form or a table must store. Retrofitting means migrating live data into new structures and retraining staff on new permissions, all while the business is trading and staff are using the old screens. These controls belong in the first scope.
Should an Indian rollout treat every DPDP rule as starting on the same date?
No. The notified DPDP Rules, 2025 have staged commencement provisions. Ask your adviser to map applicable duties and dates to the data you actually collect, using the current notifications and corrigenda. The engineering plan can then sequence notices, access changes and retention work against that written assessment.
Read before you decide.
Practical notes on the questions this service raises, not product marketing.
DPDP Readiness vs DPDP Compliance: What Software Work Covers
Readiness is controls and records you can show. Compliance is a legal conclusion. What engineering can build for DPDP, and what stays with your lawyer.
How to Map the Personal Data Your Business Holds
A practical way to list every system, sheet, inbox and backup holding personal data, record five facts about each and keep the map current after it is done.
How to Test That Deletion and Consent Withdrawal Actually Work
Why erasure and opt-out controls fail quietly, how to test them end to end with a test record, and how to handle what remains in exports and old backups.
DPDP readiness checklist for the software your business runs
Walk through your website forms, CRM, billing, HR files and backups with six checks each: notice, consent, access, retention, erasure and incident log.
More guides on this page’s topic
- How to draft a DPDP privacy notice from your real data map
- Questions to ask a vendor that holds your customers’ personal data
- Data Fiduciary and Data Principal: the DPDP terms in plain English
- Data retention schedule: how to set one and run it in software
- A file went to the wrong person: is that a personal data breach?
- Your website form feeds other tools: who else receives that data?
- Do you need a Data Protection Officer under the DPDP Act?
- Where to record consent: CRM, consent tool or your own database
- Children’s data under the DPDP Act: what schools and apps must plan
Let’s Build the Right Software for Your Business
Tell us about your current operational challenge, spreadsheet bottleneck, or software requirement. An experienced engineer will review your workflow and reply within one business day.
- No obligation consultation
- Senior engineer reviews your brief
- Your operational details stay 100% confidential
Start with your requirements
Seven short steps that tell us what you need. A senior engineer reads them before anyone gets in touch.
Share your requirementsRelated services.
Cybersecurity and Application Security
Testing authentication, permissions, code and configuration, with ranked findings, fix support and a retest that confirms each item is closed.
Cloud Engineering and Managed Infrastructure
Hosting, encryption, backups with tested restores and security baselines are set for the systems the data actually sits on, so protection does not stop at the application.
Custom Software and Product Engineering
Applications are built with consent, roles, logging and retention designed in from the first screen, and not added afterwards when changing them means migrating live records.
Managed IT Support
The everyday controls: accounts created and removed properly, devices patched, backups restore-tested and access reviewed by someone who holds the list of who has what.