Self Assessment → ← Run a scan
DPDP · AI data flow mapper

What does your AI system do with personal data?

A DPDP data flow map traces where personal data lives across your AI system's lifecycle — collection, then training, fine-tuning, retrieval, or on-device processing, then deployment — and shows your likely fiduciary or processor role and how hard erasure is at each stage. Answer three quick questions about one system you work on to get yours. Takes about two minutes.

Nothing you enter leaves your browser during the quiz. Nothing is stored or sent — the one exception is if you choose to email yourself the result below.
Question 1 of 3

Which best describes your system?

Pick the closest match. You can map other systems after.

Question 2 of 3

Where does the personal data come from?

The source shapes your lawful basis.

Question 3 of 3

Who decides why the data is used?

This is what sets fiduciary apart from processor. Not who wrote the code, who sets the purpose.

Your DPDP data-flow map
System
-
Take this to your team
-
    Screenshot this to keep your map. Then map another system.
    Go deeper
    DPDP Technical Evidence Handbook →
    The safeguard-by-safeguard breakdown — access control, encryption, retention — mapped to specific DPDP provisions, for the engineer who has to actually implement this.
    JuroCompliant · DPDP AI Data Flow Mapper

    Common questions

    What is a DPDP data flow map for an AI system?

    A DPDP data flow map traces where personal data lives across an AI system's lifecycle — collection, then training, fine-tuning, retrieval, or on-device processing depending on the system, then deployment — and shows the likely fiduciary or processor role and typical safeguards at each stage under India's DPDP Act 2023.

    Can personal data be deleted from a trained AI model?

    Usually not directly. Deleting a source record does not un-train a model that memorised it during training. Retrieval-based systems (RAG) are typically easier: deleting a person's entries from the vector store is usually enough, provided the same data wasn't also used to fine-tune the model.

    Am I a data fiduciary or a processor for my AI system under DPDP?

    It depends on who sets the purpose for the data, not who wrote the code. If you decide why the data is used, you are typically the fiduciary. If you process it on a client's instructions, you are typically the processor. Many teams are both at once, fiduciary for some data flows and processor for others.