Your data, on one map.
Before DPDP and AI tools get to it.
One map of everything your company holds and where it goes. A new law arrives for customer data in May 2027. AI tools are already inside your own data today.
Or explore the sample map belowTwo things are coming for your data.
Your company holds two kinds of information: information about people, and information the company owns. Each has its own problem, and the map shows both.
A new law for information about people
- The DPDP Act starts fining companies for mishandling customer and staff information.
- You need to show why you hold it, that the person agreed, and when you delete it.
- The top fine is Rs 250 crore.
AI tools already have your own information
- Your staff paste recipes, prices, and contracts into ChatGPT and tools like it.
- Those tools can keep what they get and learn from it.
- No law stops that. Only your own rules do.
Data at rest. Data in transit.
Where data sits.
- Shopify, the CRM, Tally, Google Drive.
- A founder's laptop, a WhatsApp group.
- A cupboard of signed contracts, a lab notebook.
Where data goes.
- Delivery companies, payment apps, ad platforms.
- Agencies, the manufacturer, the CA.
- The AI tools staff paste into.
The map then splits in two.
Information about people, which the DPDP law covers.
Information the company owns, which is yours to protect.
A few short meetings. Two maps.
Amaltas Skincare
A fictional D2C skincare brand. 40 people, Mumbai. Shopify store, Amazon, and Nykaa.
The company is invented. The stack and the gaps are the ones we find in most D2C brands.
What this map says to Amaltas
Personal data. Business data.
Personal Data Map
Information about people: customers, staff, creators, job applicants.
- Where it comes in.
- Which systems hold it.
- Which outside companies get it.
- Where permission, deletion, and customer requests break.
The DPDP law covers this. The lawyer's view, the list of gaps, and the permission tool all start here.
Business Data Map
Information the company owns: recipes, code, footage, prices, contracts, accounts.
- Where each kind sits.
- Who has a copy outside the company.
- Which AI tools already read it.
- What would hurt most if it left.
Yours to protect. The rules for who keeps what, the contracts with outside companies, and the AI rules all start here.
Four ways to get a data map.
A spreadsheet your team fills
- Takes weeks of everyone's time.
- Records what people remember, and people forget WhatsApp and laptops.
- Guesses and facts look the same.
A software scan
- Lists the systems it can connect to.
- Blind to paper, devices, vendors, and the manufacturer's inbox.
- Gives you a list. Working out what it means is left to you.
A lawyer's questionnaire
- Built for the legal register.
- Stops at information about people.
- Stops before the AI tools.
The MBS map
- Where it sits and where it goes, from a few short meetings.
- Paper, devices, vendors, and AI tools included.
- Each box says whether we checked it.
- Ends with what to do next.
How a map gets built.
- 1
First call
- Thirty minutes.
- We learn the business and the tools you use.
- 2
Short meetings with your team
- The people who run each system walk us through it.
- Sales, operations, finance, marketing, tech.
- 3
The map
- Both maps in one file that opens in any browser.
- Every box marked confirmed or unconfirmed.
- 4
The walk-through
- One meeting with your leadership team.
- The map shows what to do next: the law, your own information, or both.
The map picks the next move.
Sanctum, the DPDP programme
- A lawyer's written view of your duties, and a list of what is missing.
- The tool that records customer permission, and training.
- A written sign-off that you are ready.
Data Security and AI Governance
- Sort your information by how much it matters.
- Decide which tools and which outside companies may hold it.
- Write the AI rules.
Data mapping, answered.
Why does a company need a data map? +
To see what the company holds before deciding what to protect. A new law arrives for customer information in May 2027, and your own information is already inside AI tools today. One map shows both.
What is a data map? +
A list, built from your team's answers, of every place your information sits and everyone it goes to.
- At rest: the systems, devices, drives, and paper that hold it.
- In transit: the vendors, platforms, agencies, and tools it flows to.
- Each box is marked confirmed or unconfirmed.
Why two maps? +
Because the law covers only one half.
- Information about people falls under the DPDP law: permission, notices, how long you keep it, customer requests, outside companies.
- The company's own information needs rules for who keeps what, contracts with outside companies, and AI rules.
Does DPDP require a data map? +
Yes, in effect.
- The DPDP law says a company must know why it holds each piece of information, whether the person agreed, who else handles it, and how long it is kept.
- Every notice, contract, complaint reply, and deletion depends on knowing where the information sits.
- A map is how a company knows those things.
How long does a map take? +
It depends on how much you hold.
- A few weeks for a company with one core stack, such as a D2C brand or a restaurant group.
- Longer for bigger companies.
- The first call tells you how big the job is.
What does it cost? +
How much you hold sets the price.
- Some maps we do free, where we want to learn an industry.
- Ask on the call.
What does MBS do with our data? +
We build the map. The contract stops there.
- You keep the file and everything in it.
- MBS uses client data for training, benchmarking, or marketing only with your written permission.
Start with the map.
Thirty minutes with Sushant Pasumarty. You leave knowing how big the job is, how long it takes, and what your map would show.
Book a mapping callData mapping, a data inventory, data flow mapping, a record of processing, or a data discovery exercise: the names differ and the work is the same. Meridian Bridge Strategy maps the systems that hold a company's data and the vendors, platforms, and AI tools it flows to, then splits the picture into the Personal Data Map for DPDP and the Business Data Map for code, IP, commercial data, and AI exposure, for Indian companies, led by Sushant Pasumarty.