How to Find Personal Data in Your Office Files: A First Step Under the DPDP Act

Before you can protect personal data or delete what you no longer need, you have to know where it sits. A personal data scanner is the practical first step. It reads the files in the folders you choose and lists the Aadhaar numbers, PAN, GSTIN, bank details, UPI IDs, phone numbers, email addresses and names it finds, in a report you can read on your own computer. EasyDP’s version is free and open source, and nothing it reads is uploaded.

This guide is for business owners and for the Chartered Accountants who advise them. It covers what the scanner is for, when to run it, how to run it, how to read the report, and what to do with what it finds. The tool itself is on our Personal Data Scanner page, with every download and the source code on GitHub.

What Does a Personal Data Scanner Do?

It goes through every file in the folders you point it at, such as invoices, KYC copies, salary sheets, vendor payout lists and customer registers. Each piece of text is checked against the format of the identifier it might be. Aadhaar numbers and GSTINs are also checked against their built-in check digits, so a random twelve-digit invoice number is not reported as someone’s Aadhaar number.

The output is a report. For each finding it shows the file, the kind of data, where in the file it was found, and a masked version of the value. The scan runs on your computer, and the files it reads and the report it writes stay there.

Why Start With a List of What You Hold?

The DPDP Act does not ask you for a list of files as such. It asks for things that are impossible to do without one:

• Protect the personal data you hold, including data a vendor processes for you, with reasonable security safeguards to prevent a personal data breach (Section 8(5)). Rule 6(1)(a) names encryption, obfuscation, masking and virtual tokens among those safeguards, and Rule 6(1)(b) asks for control over who can access the computer resources that hold the data.
• Erase personal data once consent is withdrawn, or once it is reasonable to assume the purpose is no longer being served, unless a law requires you to keep it (Section 8(7)(a)). Where a processor holds a copy, you must also cause it to erase that copy (Section 8(7)(b)).
• Answer access requests with a summary of the personal data you process about the person (Section 11(1)(a)), and act on erasure requests (Section 12).

You cannot do any of these for data you do not know you hold. An old folder of KYC scans on a retired laptop is still personal data in your possession. The Act applies to digital personal data, and that includes paper records you later scan or type into a computer (Section 3(a)). The files on your office computers are in scope.

These duties apply from 13 May 2027 (as of October 2026). Finding out what you hold now leaves time to close the gaps. Finding out in the last few weeks does not.

When Should You Run a Scan?

No provision of the Act sets a date for a scan. These are the points at which one earns its place:

• Now, as a baseline, if you have never looked. The Desktop and Downloads folders are where stray copies tend to collect, and the scanner checks both.
• Before 13 May 2027, when the core duties begin, so that the gaps can be fixed in time.
• When a staff member leaves, or when a computer is being replaced, reassigned or sold. Files often stay on the machine after the person has gone.
• Before a CA or auditor reviews your records, so the conversation starts from facts about what is on the computers.
• After a change of software or vendor that touches customer or employee data, such as a new payroll package, CRM or e-commerce platform.
• Once a year, as a routine check. The report flags files nobody has changed in over a year and in over three years, which is a quick way to spot material that may no longer need to be kept.

Who Should Run It?

Usually the owner, an office manager, or whoever looks after the office computers. The standard scan needs no Python or other software: you download one file for your computer. If Command Prompt is unfamiliar, your IT person or your CA can run it for you.

A CA scanning a client’s machines should have the client’s written permission first, and should scan only the computers and folders the client has authorised. The scanner’s own licence and disclaimer put that responsibility on whoever runs it.

What Does It Look For?

Each number is checked against its official format, so a stray order number is less likely to be reported as someone’s identity.

The scanner reads Word, PDF files with selectable text, Excel, CSV, OpenDocument, RTF and plain text files. A PDF that is a photograph of a page has no selectable text, so it is not read.

How Do You Run It?

1. Download the file for your computer from the Personal Data Scanner page, which links to the latest release on GitHub. On a Mac, the simplest route is the app: unzip it and open EasyDP Scanner, and it guides you through the scan.
2. Choose what to scan. On Windows, run the scanner from the folder you downloaded it to. For a folder of accounts on the D: drive:

   .easydp-scan-windows-amd64.exe scan "D:Accounts" --format html --output-dir reports

   To scan the Desktop, Documents and Downloads folders in one go, use --user-dirs in place of the folder name.
3. Open the report. It is saved as scan_report.html in the reports folder. It opens in any browser without an internet connection, and you can print it or save it as a PDF.

Technical teams can also install the scanner with a script, npm or pip. Those routes are listed on the scanner page for anyone who needs them.

What Should You Do With the Report?

A report is a list, not a plan. For each finding, decide one of three things:

• Keep it, and protect it. If you need the record, restrict who can open the file and use encryption or masking where you can. A PAN in a spreadsheet that the whole office can open is a Section 8(5) problem, and Rule 6(1)(b) asks for access to be controlled.
• Delete it, if nothing requires you to keep it. Once the purpose has been served, Section 8(7)(a) requires erasure. Tax and accounting law often requires certain records to be kept for several years, so check before you delete. Keep a note of what you kept and under which law.
• Stop collecting it. A copy of every customer’s identity card in a shared folder is often more than the business needs. Asking “why do we have this?” usually settles the question.

Then write the outcome down: the folder, the kind of data, what you decided, and why. A short register like this is the simplest evidence that you looked and acted, and it is the first thing a CA will ask to see.

Is It Safe to Run on Client or Staff Files?

The scan is built to keep data where it is. It runs on your own computer, the files it reads stay there, and the report masks each value. An Aadhaar number appears as XXXX-XXXX-2562, so the report can be shared with your CA without the full numbers leaving the office. The scanner’s code is public on GitHub, so your IT person or CA can read what it does before running it.

Two things still apply. You should only scan files you are authorised to scan. And the report is itself a document about personal data, so it should be kept with the same care as the files it describes.

What Does the Deeper Scan Add?

The normal scan is strongest on numbers and labelled fields. Contracts, CVs, emails and letters hold names and addresses in ordinary sentences, and that is where the optional deeper scan, Local AI mode, helps. It uses a small AI model on your computer to find names and addresses written in plain text, and mentions of a medical condition. Nothing from your files is sent anywhere.

It is slower than the normal scan, and it has two conditions you should know before you start:

• It needs Python 3.10 or later on the computer, even if you use the download file. If Python is not installed, use the normal scan.
• The first run needs an internet connection to download the AI libraries and the model, which is about 600 MB. Later scans run without the internet.

On Windows, it is switched on with one extra option:

.easydp-scan-windows-amd64.exe scan "D:Letters" --local-ai --output-dir reports

What Does the Scanner Not Do?

• It is not a compliance certificate or an audit. The report shows where personal data sits. It does not decide whether your use of that data is lawful.
• It does not protect or delete anything. It gives you the list. The decisions and the changes are yours to make.
• It does not read scanned pages or photographs. Review those folders by hand.
• It can miss things and can flag things that are not personal data. If you find a false alarm, the scanner’s GitHub page has an Issues section where it can be reported.

The report is general information about where personal data sits. It is not legal advice.

How Can a Chartered Accountant Use It With Clients?

A CA can use the scan as the factual starting point for a conversation about the client’s data, and to record what was checked. A sensible sequence:

1. Get written permission from the client to scan the named computers and folders.
2. Agree the scope: which computers, which folders, and the date of the scan.
3. Run the scan on the client’s machines, or with the client’s IT person present.
4. Walk the client through the report, and record the decisions on what to protect, delete and stop collecting.

The scan is not an audit certificate, and it does not replace the wider review in our DPDP audit checklist for CAs. For the wider advisory picture, see DPDP compliance for Chartered Accountants.

What Should You Do Next?

Start with the tool on the Personal Data Scanner page. To see which DPDP duties apply to your business, use the free DPDP checker, and then work through the compliance checklist. For the dates in the Act and Rules, see the DPDP implementation timeline. If you find personal data you cannot account for, and it is involved in a breach, the clock in the 72-hour breach notification rule starts running.