Be honest. How many privacy policies have you read from start to finish? Most of us scroll past them the way we skip the terms on a software update. The Digital Personal Data Protection Act, 2023 (DPDP Act) doesn’t let you skip them. It is India’s dedicated law for digital personal data, and it places real duties on any business that handles the personal data of people in India.

Good DPDP Compliance is not about filling a folder with policies that gather dust. It is about building habits that protect your customers and, as a bonus, protect your business from expensive trouble. The Act is already law, and the Rules that make it work are rolling out in phases. That gives you time to fix things before the full obligations apply.

Here are ten common mistakes. Each one is linked to the section of the Act or the Rules behind it, so you can check the source yourself.

Where Things Stand Today

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Some provisions took effect immediately. Consent Manager registration applies after 12 months, and most obligations on businesses apply after 18 months, which lands around May 2027. Waiting is not a strategy, though. The breach and consent rules are much easier to build in now than to retrofit in a panic later.

Mistake 1: Assuming the Law Doesn’t Apply to You

Many owners believe privacy law is meant for big technology companies. Section 3 of the Act says otherwise. It covers personal data processed within India, and it also covers processing outside India when that processing relates to offering goods or services to people in India.

The core duties don’t come with a size threshold. A bakery that collects phone numbers for home delivery is still handling personal data. Only a special category called Significant Data Fiduciaries, which the government notifies under Section 10, faces extra obligations on top of the basics.

Mistake 2: Bundling Consent Into the Fine Print

Some businesses hide consent inside a long term page and then declare that using the website means agreeing to everything. Section 6 asks for more. Consent must be free, specific, informed, unconditional and unambiguous, and it must come through a clear affirmative action. Pre-ticked boxes don’t meet that standard.

Walls that say “accept everything or leave” don’t work either. Ask for consent separately for each purpose, and let people say no without losing access to the service they came for.

Mistake 3: Writing Privacy Notices Nobody Can Read

A notice full of dense legal jargon might satisfy your lawyer, but it won’t satisfy your customer. Section 5 requires a notice that clearly describes the personal data you collect and the purpose behind it. It must also explain how a person can exercise their rights and how they can complain to the Data Protection Board.

The Act allows people to access the notice in English or in any language listed in the Eighth Schedule to the Constitution. Write short sentences, use plain words, and add a language option if your customers need one. If your customer can’t understand the notice, the notice isn’t doing its job.

Mistake 4: Making It Hard to Withdraw Consent

Signing up took one tap. Cancelling requires a phone call during office hours, a form, and a three week wait. Section 6(4) says the ease of withdrawing consent must be comparable to the ease of giving it. Nobody should need a carrier pigeon to say “please stop.”

Put a visible withdrawal option in your app or account settings. Test it yourself. If it takes you longer to withdraw than it took to sign up, your customers will notice before a regulator does.

Mistake 5: Treating Children’s Data Like Any Other Data

Section 9 gives children special protection. For anyone under 18, you need verifiable consent from a parent or lawful guardian. The Act also bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions the Rules may prescribe.

If your product attracts younger users, check your age gate and consent flow before anything else. The penalty for failing to meet children’s data obligations can reach ₹200 crore. That number gets everyone’s attention, including the people who approve your marketing budget.

Mistake 6: Treating Security as Only an IT Problem

Section 8(5) requires a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach. Security is not a single tool you install and forget. It covers people, processes and technology together.

The Rules list baseline measures such as encryption, access controls, logs and backups. The penalty for failing to maintain reasonable security safeguards can reach ₹250 crore. Your finance and operations teams deserve a seat at the security table too, because a leaked payroll file hurts just as much as a leaked customer database.

Mistake 7: Having No Plan for a Data Breach

Breaches happen to careful companies too. What separates a manageable incident from a disaster is preparation. Section 8(6) requires you to inform the Data Protection Board and each affected person about a personal data breach.

Under Rule 7, you must notify affected individuals and the Board without delay. A detailed report follows to the Board within 72 hours, unless the Board allows more time on a written request. Those clocks start ticking the moment you become aware of the breach, so you can’t afford to invent the process after the incident. Write a response playbook, name the people who make decisions, and rehearse it once a year like a fire drill for your data.

Mistake 8: Keeping Data Forever “Just in Case”

Hoarding customer data feels harmless until it leaks. Section 8(7) requires you to erase personal data once the purpose for which you collected it is served, unless you must keep it to comply with another law.

Old records of inactive accounts, duplicate spreadsheets and forgotten backups all count. Rule 8 sets out the retention and erasure framework, and for certain large platforms it includes a three year inactivity limit. Data you don’t need is not an asset. It is a liability with a friendly name. Set retention periods for each category of data and delete on schedule.

Mistake 9: Ignoring the Rights of the People You Serve

The Act gives people real rights. Section 11 lets them ask for a summary of their personal data and the processing involved. Section 12 covers correction, completion and erasure. Section 13 requires a grievance redressal mechanism.

Many businesses have no process at all, so requests land in a random inbox and sit there until someone complains publicly. Create a single channel for requests, assign an owner, track each case, and respond within the timelines the Rules prescribe. A well handled request can turn an annoyed customer into a loyal one.

Mistake 10: Trusting Vendors Without Checking Them

You might outsource email marketing, payroll, cloud hosting or customer support. That’s fine. Your legal responsibility doesn’t disappear when a vendor handles the data, though. Section 8(1) makes the Data Fiduciary responsible for compliance regardless of any agreement to the contrary.

Section 8(2) allows engaging a Data Processor only under a valid contract. Review your vendor agreements for security commitments, breach notification duties and deletion terms. Section 16 also allows the government to restrict transfers of personal data to certain countries, so check where your vendors store and process data.

Putting It All Together

Think of DPDP Compliance as a set of habits rather than a one time project. Start with an honest inventory of the personal data you collect, why you collect it, where it lives and who can access it. Then fix the biggest gaps first: consent flows, privacy notices, security controls and breach readiness.

Review your progress every quarter, because your products and your data will keep changing. The businesses that struggle with DPDP Compliance are usually the ones that treat it as a document to file rather than a process to run.

Sources

1. The Digital Personal Data Protection Act, 2023, Government of India. Available at indiacode.nic.in.
2. The Digital Personal Data Protection Rules, 2025, Ministry of Electronics and Information Technology (MeitY), notified 13 November 2025. Available at meity.gov.in and in the Gazette of India.
3. EY India, “Transforming data privacy: DPDP Act, 2023 and DPDP Rules, 2025.” ey.com/en_in
4. BDO India, “The DPDP Rules 2025 and its implementation.” bdo.in
5. Khaitan & Co, “Digital Personal Data Protection Rules, 2025” (analysis dated 15 November 2025). khaitanco.com
6. King Stubb & Kasiva, guidance on personal data breach obligations under Section 8(6). ksandk.com

Disclaimer

The information in this article is provided for general awareness only. It is not legal advice, and reading it does not create a lawyer client relationship. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are complex, and their application depends on the facts of each business. Before acting on anything in this article, consult a qualified lawyer who practises data protection law in India.

The timelines, penalty figures and procedural details mentioned here reflect the Act and Rules as we understand them at the time of writing. Government notifications, implementation dates and regulatory guidance can change. Always check the official text published in the Gazette of India and on the MeitY and India Code portals before making compliance decisions.

We have referenced third party analyses for context. Those sources are not endorsed by this article, and we are not responsible for their content. We accept no liability for any loss or damage arising from reliance on this article.