DPScan finds personal data sitting on employee laptops, so you can meet the obligations of India's Digital Personal Data Protection Act, 2023. It never records the personal data it finds.
In KYC, claims, lending and grievance processes, a reviewer opens an attached document and a copy lands on their local disk: in Downloads, a viewer cache, or an Outlook attachment store. That copy has no access log, no retention clock and no owner.
Multiply that by every reviewer and every working day, and an organisation ends up holding personal data in places it cannot see. Nobody knows it's there. DPScan is the part that finds it.
Security safeguard obligation, with a breach penalty ceiling of ₹250 crore.
Erasure obligation: personal data must not outlive its purpose.
For each file, DPScan decides whether it holds personal data, what kind, how much and how confident it is. Cheap checks run on everything. The expensive ones run only where they're likely to pay off.
Spots values shaped like an identifier, such as a 12-digit run or a GSTIN. A shape alone is never trusted.
Verhoeff, Luhn and Luhn mod-36 check the value itself, removing false positives without missing real ones.
Nearby keywords, in English and Devanagari, raise or cap confidence based on what's written around a match.
A small on-device language model looks for names and addresses, but only in files that have already earned a closer look.
Recognises the kind of document and combines everything into one risk band: Critical, High, Medium or Low.
A finding says “1 Aadhaar number, high confidence.” It never says which one.
Every laptop's findings in one view, on a server inside your own network.
A pattern match alone is never a finding. Something has to back it up: a checksum, a reference list, or a keyword nearby.
Highlighted identifiers are checksum-validated.
Every file is identified by its content, not its extension. A spreadsheet renamed
to .txt is still read as a spreadsheet, and the mismatch is itself flagged.
Scanned documents are read with OCR. Spreadsheets are checked column by column.
No personal data value is ever stored, logged or transmitted. That covers findings, databases, debug logs and error traces.
Strict limits on size, time, depth, decompression and memory keep a malformed file from causing harm.
Wherever an identifier has a checksum, it is verified. A pattern match alone is never a finding.
Built only on permissively licensed components, with no copyleft code and no non-commercial model weights.
Single-threaded by design, so the scan never competes with the person whose machine it runs on.
The same input always gives the same finding, so results hold up in an audit or a dispute.
Talk to us about a DPScan pilot for your KYC, claims, lending or grievance teams.
No obligation. Strategic clarity in the first conversation.