Top 10 Common DPDP Mistakes

Mistake #1: No Consent

❌ Collect data without asking ✅ Explicit, written consent before collection Fine Risk: ₹5-250 Cr

Mistake #2: Conflating Consent & Terms

❌ "Agree to Terms" = consent to all data processing ✅ Separate, specific consent per data use

Mistake #3: No Third-Party DPAs

❌ Using vendors without signed DPAs ✅ Signed DPA with every vendor handling data Fine Risk: ₹5-250 Cr per vendor

Mistake #4: Cross-Border Transfers

❌ Storing Indian data in US cloud regions ✅ India-specific cloud regions only Fine Risk: ₹250 Cr

Mistake #5: Indefinite Retention

❌ Keeping data "just in case" forever ✅ Documented retention schedule; automated deletion

Mistake #6: Delayed Breach Notification

❌ Taking 30 days to notify users ✅ Notify within 72 hours Fine Risk: ₹250 Cr additional

Mistake #7: No Incident Response Plan

❌ Panicking when breach happens ✅ Documented, tested incident response plan

Mistake #8: Ignoring User Rights

❌ User asks for data; you ignore ✅ Respond within 30 days Fine Risk: ₹5 Cr

Mistake #9: No Data Minimization

❌ Collecting phone, location, payment for newsletter ✅ Collect only necessary data

Mistake #10: No DPO/Oversight

❌ No one responsible for compliance ✅ Appoint DPO (in-house or outsourced)

Self-Audit Checklist

• Documented consent?
• All vendors have DPAs?
• Data stored in India?
• Breach response plan?
• 30-day data request capability?
• Automated deletion after retention?
• DPO appointed?

Less than 5 "yes"? High risk. Act immediately. what is dpdp act 2023 DPDP Compliance Hub

---

Disclaimer: General informational article. Consult compliance experts. dpdp penalties explained

Start Now: Start your free DPDP compliance assessment dpdp vs gdpr