Compare · Spreadsheets and email
TrustOS or spreadsheets and email for DPDP work
Almost every DPDP programme starts in a spreadsheet, and that is a sensible place to start. The question is how long it can carry the work once requests arrive every week, systems multiply and someone asks you to prove what happened six months ago.
A fair reading
When spreadsheets and email is enough, and when teams outgrow it
Enough for now
- You are still mappingIn the first weeks, a spreadsheet of systems, data categories and purposes is quick to build and easy to share. Many teams should do exactly that before buying anything.
- Few systems, few requestsA clinic with one practice management system and a handful of requests a year can track them in a register and a shared mailbox, provided someone owns it.
- One person holds it togetherWhen the same careful person receives every request, knows every system and keeps every reply, the record is in good hands, for as long as that person stays.
Where teams outgrow it
- Withdrawal has to reach other systemsThe spreadsheet records that Neha withdrew consent for WhatsApp offers. It cannot tell the WhatsApp sender, the CRM and the SMS vendor, or show that each of them stopped.
- Deadlines live in people's headsRequests come in through email, the call centre, branches and app reviews. Without one queue with due dates, the ones that arrive on a busy Friday are the ones that slip.
- Evidence is rebuilt at audit timeWhen internal audit asks for proof that every erasure in six months was completed in all systems, the answer is ten days of exports and screenshots, and a gap wherever someone has left.
- The sheet cannot vouch for itselfAnyone with edit access can change a cell, and the file does not show who changed what or when, which makes it a weak basis for a record you may have to show the Board.
Side by side
Spreadsheets and email and TrustOS, topic by topic
| Topic | Spreadsheets and email | TrustOS |
|---|---|---|
| Getting started | Nothing to buy. A template and a shared mailbox. | A licence and a first phase, usually one or two products, set up in weeks. |
| Data inventory | Rows in a sheet, kept current by whoever remembers. | Systems, data categories, purposes and owners on one record, with reviews assigned to owners. |
| Consent and withdrawal | A column per purpose. Changes in other systems are made by hand, if someone is told. | Tamper evident consent records with the notice version seen. Withdrawal creates work in each system and keeps each confirmation. |
| Requests and grievances | An inbox and a tracker. Due dates depend on someone checking. | One queue for every channel, with owners, due dates, reminders and a Privacy Centre where people see status. |
| Erasure | An email to each system owner, and a reply if you are lucky. | An erasure plan from the inventory, connectors where possible, tasks where not, and a reason recorded for anything kept. |
| Breach response | A call, a chat group and a document written under pressure. | An incident record with a clock from awareness, tasks per team, and drafts for the Board and affected people. |
| Evidence | Collected after the fact from inboxes and screenshots. | Attached as each task closes. Evidence packs for a period or question, verifiable by hash. |
Our view
Choosing between the two
If you hold personal data in two or three systems and see a few requests a year, a well kept spreadsheet and a named owner can be enough, and we would tell you so. Once withdrawal and erasure have to reach several systems and processors, or you expect to show evidence to an auditor, a bank partner or the Board, the work outgrows the sheet. Many teams keep their first spreadsheet as the starting point for the TrustOS inventory.
Questions
Asked by teams weighing this up
Can we import our spreadsheet into TrustOS?
Yes. The inventory you have built is usually the first thing loaded, then reviewed with each system owner.
We have one product and a small team. Do we need TrustOS?
Possibly not yet. Take the gap assessment, and if a register and a named owner cover your volume, start there and revisit when volumes grow.
What is the first sign a spreadsheet is no longer enough?
Usually a withdrawal or erasure that did not reach one system, and the customer found it first. The second sign is an audit request that takes more than a day to answer.
Keep comparing
Other comparisons
Compare
TrustOS or consent only tools
What a consent or cookie banner tool covers under the DPDP Act, what it leaves out, and how the two can work together. A fair comparison.
Learn moreCompare
TrustOS or building it yourself
When building your own DPDP workflows makes sense, what it really takes to build and keep up, and the middle path of self hosting with source code.
Learn morePlatform
See all ten modules
What TrustOS covers, module by module, on one record of data, systems and owners.
Learn moreSee it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.