Mastering the "3 Ss" of Data Segregation

Compliance doesn't start with a firewall; it starts with a spreadsheet (or a query). Here is how to architect your data discovery process using the State, Stage, and Scenario framework.

Most organizations fail at DPDP compliance because they treat all data as equal. A 10-year-old resigned employee file is not the same as a live customer transaction. To apply the right rules (Retention, Consent, Security), you must first segregate the data. We do this using the "3 Ss" Framework.

1. The 3 Ss Explained

State (Timeline)

Is the data Legacy (Pre-Act) or New Flow (Post-Act)?

Legacy Data: Requires a "Notice of Processing". You don't need new consent immediately if the purpose hasn't changed, but you must inform them.
New Flow: Requires fresh, explicit consent via a Consent Manager before the first byte is stored.

Stage (Lifecycle)

Is the data Active, Dormant, or Archived?

Active (Hot): Used for daily operations (e.g., current login sessions). Needs high availability.
Dormant (Warm): Not accessed in 6+ months but might be needed for annual reports. Move to cheaper, secure storage.
Archived (Cold): Retained only for legal reasons (e.g., Tax audit for 7 years). Should be encrypted and "Air-gapped" from daily apps.

Scenario (Relationship)

Who is the Data Principal? Citizen, Employee, Vendor, or Minor?

Why it matters: You can process Employee data for "Employment Purposes" without explicit consent (under legitimate uses), but you CANNOT do the same for a Customer's marketing data.

2. How to Build the Identification Process

You cannot manually tag million of records. You need an automated "Data Discovery" script or process. Here is the logic flow you should give your IT team.

Step A Scan all Databases (SQL/NoSQL) and File Servers.

Step B Identify columns containing PII (Pan Card, Aadhaar, Phone, Email).

Step C Apply "Meta-Tags" to these rows based on the Identification Parameters below.

3. Defining Identification Parameters

Use this table to map your technical metadata to DPDP Compliance tags.

Classification	Technical Parameter (Look for these)	Logic / Rule
State: Legacy	`created_at` timestamp	If `date < [Act_Notification_Date]`, Tag as LEGACY. Send Notice.
Stage: Dormant	`last_login` OR `last_transaction_date`	If `date < (Today - 180 Days)`, Tag as DORMANT. Move to Warm Storage.
Scenario: Minor	`dob` (Date of Birth)	If `(Today - dob) < 18 years`, Tag as MINOR. Disable tracking/ads. Enforce Parental Consent.
Scenario: Employee	`user_role` OR `contract_type`	If role = 'Staff'/'Payroll', Apply 'Employment Exemption' rules.

Example: SQL Logic for Tagging

-- Tagging Dormant Users
UPDATE user_master 
SET data_stage = 'DORMANT' 
WHERE last_login_date < DATE_SUB(NOW(), INTERVAL 6 MONTH);

-- Identifying Minors for Restricted Processing
SELECT user_id, email FROM user_master 
WHERE DATEDIFF(NOW(), dob) / 365.25 < 18;
                    

The Result? Once you run this process, you will have a clean inventory. You can then say: "We have 10,000 Dormant Legacy Customer records." Now, you can confidently run a deletion script or a re-consent campaign for just that segment, saving cost and reducing risk.

Disclaimer: This guide is for educational and technical planning purposes only. It does not constitute legal advice. Please consult with your legal counsel for specific interpretations of the DPDP Act 2023.