Top 10 Common DPDP Mistakes
Mistake #1: No Consent
❌ Collect data without asking ✅ Explicit, written consent before collection Fine Risk: ₹5-250 Cr
Mistake #2: Conflating Consent & Terms
❌ "Agree to Terms" = consent to all data processing ✅ Separate, specific consent per data use
Mistake #3: No Third-Party DPAs
❌ Using vendors without signed DPAs ✅ Signed DPA with every vendor handling data Fine Risk: ₹5-250 Cr per vendor
Mistake #4: Cross-Border Transfers
❌ Storing Indian data in US cloud regions ✅ India-specific cloud regions only Fine Risk: ₹250 Cr
Mistake #5: Indefinite Retention
❌ Keeping data "just in case" forever ✅ Documented retention schedule; automated deletion
Mistake #6: Delayed Breach Notification
❌ Taking 30 days to notify users ✅ Notify within 72 hours Fine Risk: ₹250 Cr additional
Mistake #7: No Incident Response Plan
❌ Panicking when breach happens ✅ Documented, tested incident response plan
Mistake #8: Ignoring User Rights
❌ User asks for data; you ignore ✅ Respond within 30 days Fine Risk: ₹5 Cr
Mistake #9: No Data Minimization
❌ Collecting phone, location, payment for newsletter ✅ Collect only necessary data
Mistake #10: No DPO/Oversight
❌ No one responsible for compliance ✅ Appoint DPO (in-house or outsourced)
