Unstructured Data and DPDP: Where Personal Data Hides in Email, Chat, and Call Recordings

Ask a compliance team where customers' personal data lives, and the answer is usually a list of systems: the core banking platform, the CRM, the loan origination database. This is the structured world. Most DPDP programmes start and end there. But a large share of the personal data an organisation holds is unstructured data that never enters a database at all. It arrives in an email, gets forwarded in a chat, and is spoken aloud on a recorded call. When the DPDP Act asks you to protect, produce, or erase a Data Principal's personal data, how much of it can you actually find?

Consider a home loan applicant at a midsize bank. She emails scans of her PAN and Aadhaar to her relationship manager, who forwards them to the credit team, who forward them again to a verification vendor. A week later, she sends a photo of her salary slip over WhatsApp because the email bounced. When she calls the contact centre to check her status, she reads her Aadhaar number aloud for verification. The line tells her the call may be recorded for quality and training purposes.

Her loan file in the core system is clean, structured, and governed. Everything else is unstructured data. There are several copies of her identity documents, a photo of her salary slip, and one recording of her voice reciting a twelve-digit number. They are scattered across systems no one has mapped.

Unstructured data is not a storage problem. It is a visibility problem. The DPDP Act does not ask what format your personal data is in. It assumes you know where it is.

What Counts as Unstructured Data, and Where Dark Data Comes In

Unstructured data is information with no fixed format or schema. It does not fit neatly into rows and columns. Emails, chat messages, PDFs, scanned documents, photos, spreadsheets, and call recordings are all unstructured data. Analyst estimates widely put it at 80 to 90 percent of enterprise data.

Dark data is the part of it nobody uses and nobody has mapped. It is data an organisation collects and stores during normal work, then loses sight of: the old mailbox export, the forwarded scan, the recording from three years ago. Under DPDP, dark data is not a harmless leftover. If it holds personal data, it is in your possession, and it comes with your duties. Finding it is what data discovery is for.

Unstructured Data Examples That Hold Personal Data

These unstructured data examples matter for DPDP because each one can carry personal data:

• Emails and attachments: KYC scans, resumes with dates of birth and home addresses.
• Chat messages and images: photographed PAN cards, screenshots of bank statements, addresses typed into group threads.
• Call recordings and transcripts: dates of birth, registered mobile numbers, spoken Aadhaar and PAN numbers.
• Documents and scans: salary slips, loan forms, signed agreements.
• Exported files: mailbox archives, chat logs, and spreadsheets on shared drives and laptops.

Where Unstructured Data Hides in Email, Chat, and Call Recordings

Email: The Inbox That Never Forgets

Email is where unstructured personal data begins for most organisations. Customers send KYC documents as attachments. Candidates send resumes with dates of birth and home addresses. Every forward creates a new copy in a new mailbox, often on a new device.

Email feels searchable, and that is the trap. You can search an inbox for a name. You cannot search for an Aadhaar number inside a scanned PDF, because to the mail server that attachment is a picture, not text. When mailboxes are exported or archived to a shared drive, the copies leave the mail system entirely and land as files no one remembers creating.

An inbox does not delete. It accumulates.

Chat: Personal Data in Casual Clothes

Chat is email with the formality stripped away, and the formality was doing useful work. On WhatsApp, Teams, or Slack, customers and employees share personal data the way they would with a friend. A photo of a PAN card. A screenshot of a bank statement. An address typed into a group thread so a field agent can find the house.

Chat data is also scattered in a way email is not. It lives on company servers, on employees' personal phones, in exported conversation logs, and in images saved automatically to device galleries. Much of it is visual. The identity document in a chat is rarely typed out. It is photographed, often at an angle, often in poor light.

Chat makes sharing personal data feel harmless. The Act does not grade it on tone.

Call Recordings: Personal Data You Can Hear but Not Search

Call recordings are the hardest of the three, because the personal data in them is spoken, not written. Contact centres routinely ask callers to confirm a date of birth, a registered mobile number, or a full Aadhaar or PAN. Every one of those answers is stored as audio, usually for years, often well beyond the purpose it was collected for.

Audio cannot be searched the way text can. To find personal data in a recording, it first has to be transcribed. The transcript becomes yet another unstructured file holding the same personal data in a new form. Most organisations have never done this at scale. They hold thousands of hours of personal data they cannot see, cannot index, and cannot selectively erase.

"This call may be recorded" is a disclosure. It is not a retention policy.

Why DPDP Makes Unstructured Data Your Problem

The DPDP Act draws no line between a database row and a voice note, so unstructured data is covered like any other personal data. Personal data is any data about an identifiable individual, and the Act covers it in whatever digital form it takes. These duties and rights apply from 13 May 2027. The data they cover is already in your inboxes.

Every one of these obligations assumes you know where the data is. Erase the loan applicant from the core system and her Aadhaar is still in three inboxes and a call recording. Her salary slip is still in a WhatsApp gallery. You cannot protect, produce, or erase what you have never found.

Dark Data: The Personal Data Nobody Mapped

Dark data builds up in predictable places. Mailbox exports that were never deleted. Shared drives that outlived the project. Laptops of people who left. Recordings kept because nobody set a retention date. Each one holds personal data collected for a purpose that has long since ended. Most dark data is unstructured data: files, exports, and recordings with no owner.

That makes dark data the hardest part of erasure and the largest unknown in a breach. You cannot delete what you do not know exists, and you cannot tell people what was exposed if you never mapped it. The practical aim is to shrink it: find it, decide whether any purpose still needs it, and delete the rest. Tracking where data lives across your stores, in line with data security posture management, is how that stays current.

What to Do Before Your Next Audit

Most DPDP programmes begin by asking which systems hold personal data. That question produces a list of databases and a false sense of completeness. The better question is where personal data goes after it leaves those systems. Into the inbox it was forwarded to. Into the chat it was photographed into. Onto the call it was read aloud on. Into the folder it was eventually saved in.

1. Follow one customer journey end to end, and list every place a copy lands in a data inventory.
2. Scan shared drives, cloud storage, and employee laptops first, because that is where most unstructured data settles as files.
3. Set a retention period for recordings and mailbox archives, tied to a stated purpose.
4. Decide how an access or erasure request reaches unstructured data such as inboxes, chat exports, and recordings.
5. Keep the catalogue current. Rescan on a schedule, not once.

For a full programme, read the DPDP compliance guide for 2026 and the 90 day implementation guide.

The DPDP implementation guide explains the work in order.

For vendor questions, read what a DPDPA compliance platform needs to have in 2026 and IDfy's seven things an ideal DPDP solution should have.

How Privy Finds Unstructured Data That Settles in Files

Unstructured personal data rarely stays where it started. Attachments get saved to shared drives, chat images land in download folders, mailboxes get exported for archiving, and call transcripts get filed as documents. Sooner or later, most of it settles as files, and files can be scanned. The loan applicant's PAN scan, saved by the credit team to a shared drive, is now one of them.

Personal Data Discovery & Governance includes unstructured data scanning built for that layer. It is the kind of data discovery tools should offer for DPDP.

• Where it looks: cloud storage and file servers such as Google Drive, Amazon S3, Azure Blob Storage, and SFTP, with SharePoint and OneDrive in early access. An installed agent extends this to employee laptops and desktops, where downloaded attachments tend to collect.
• What it reads: PDFs, Word and PowerPoint files, including the images embedded in them, plus spreadsheets, CSV and text files, and saved emails in .eml format.
• What it finds: personal data such as Aadhaar, PAN, and phone numbers in text, and identity documents such as Aadhaar and PAN cards in scans and photos.
• Where it runs: inside your own network. Files are read and classified there, and only the findings leave: what kind of personal data is held where, never the values.

Live mailboxes, chat platforms, and raw audio are reached once their content lands as files or transcripts.

The result is a catalogue of where unstructured personal data has settled across your estate. It is the starting point for every safeguard, access request, and erasure the Act requires. Data Discovery & Classification builds it, and Data Principal Rights Management routes access and erasure requests across connected systems.

Automated Data Lineage shows where the data moved after that.

Privy by IDfy has 50+ enterprise implementations in progress across seven industries, and is ranked #1 in the MeitY-NeGD DPDP Innovation Challenge. The official result has the details.

Conclusion

Structured data is where you keep personal data. Unstructured data is where it escapes. A compliance programme that covers only the first is not a compliance programme. It is a partial inventory with a policy attached.

To see how Privy by IDfy can find the unstructured data in your estate, book a demo or write to shivani@idfy.com.

FAQs

What is unstructured data?

 Unstructured data is information with no fixed format or schema, such as emails, chat messages, PDFs, scanned documents, photos, and call recordings. In an enterprise it often holds personal data like Aadhaar, PAN, and phone numbers, which is why it matters for DPDP.

What is the difference between structured and unstructured data? 

Structured data lives in databases with defined fields, such as a loan record in a core banking system. Unstructured data lives in files and messages with no fixed layout, such as the emails, scans, and recordings around that loan. The DPDP Act covers personal data in both.

What is dark data? 

Dark data is data an organisation collects and stores but does not use and has not mapped, such as old mailbox exports or forgotten recordings. If it holds personal data, it still carries DPDP duties, including safeguards and erasure.

Does the DPDP Act apply to unstructured data? 

Yes. The Act covers digital personal data in whatever form it takes. A scanned Aadhaar in an inbox and a voice note on a recorded line are as covered as a database row.

Are call recordings personal data under DPDP? 

Yes, when they relate to an identifiable person. A recording of a caller reading out a date of birth or an Aadhaar number holds personal data. Retention should follow the purpose, and sector rules may require longer retention in some cases, so take legal advice for your sector.

How do you find personal data in scanned documents and images? 

Tools that scan unstructured data, read the images inside PDFs and Office files, and recognise identity documents such as Aadhaar and PAN cards can find it. Running the scan inside your own network keeps the values from leaving.

How long can an organisation keep emails and recordings that hold personal data?

 Under Section 8(7), personal data must be erased once consent is withdrawn or the purpose is served, unless the law requires retention. Set a retention period for each purpose, and keep a schedule that covers mailboxes, chat exports, and recordings.