Most compliance failures do not begin with negligence. They begin with a sentence everyone in the room nodded along to.
"We are too small for this." "That is our vendor's problem." "We will look at it in 2027." I have heard every one of these in boardrooms, vendor reviews and procurement calls, and each was said by a sensible person trying to protect the budget. The irony is that every one of them ends up costing more than the work it was meant to avoid: a contract delayed because a questionnaire could not be answered, a consent flow rebuilt twice, a tool bought before anyone knew what data the company held.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 are shorter and more practical than most people expect. They are also less forgiving of assumptions. Below are the ten myths I meet most often, what the law actually says about each, and what believing it costs. Where something is a judgment call rather than a legal requirement, I say so.
First, the ground you are standing on
The Act covers digital personal data, including paper records that are later digitised. It also reaches processing outside India when it relates to offering goods or services to people in India. The Rules were notified in November 2025 and commence in phases, which matters for several myths below.
Penalties are set by the Schedule to the Act. They are ceilings that the Data Protection Board may impose after an inquiry, not fixed fees. Even so, they set the tone of every boardroom conversation.
Why intelligent people believe these myths
None of these beliefs is stupid. Each one is a reasonable shortcut taken under pressure. The law is new, the commentary is loud and contradictory, and early advice often came from a GDPR lens that does not map neatly onto India. Add the fact that the core obligations and penalties are not yet enforceable, and "later" becomes an easy answer. But the absence of enforcement today says nothing about the evidence you will be asked for tomorrow, and the cost of a myth is rarely a penalty. It is the quiet drag of rework, delay and lost trust. The ten that follow are ordered loosely from the most common to the most expensive.
Myth 1: "DPDP is a big-tech problem"
Reality: The Act has no turnover, headcount or sector threshold. Anyone who determines the purpose and means of processing digital personal data is a Data Fiduciary. The Act does let the Government exempt classes of fiduciaries, startups included, from certain provisions under Section 17(3). That relief does not extend to the duty to keep reasonable security safeguards or to report breaches.
What it costs: Small and mid-sized firms feel DPDP first through their customers, not the regulator. A supplier that cannot answer a buyer's data protection questionnaire loses the renewal long before any Board inquiry is opened. Size does not exempt you, and in my experience it rarely protects you either.
Myth 2: "The deadline is May 2027, so we have time"
Reality: The core obligations (notice, consent, rights, safeguards, breach intimation, retention) commence on 13 May 2027. But the Data Protection Board is already constituted, Consent Manager provisions begin in November 2026, and Rule 6 expects logs to be retained for a year, which means evidence you start collecting late is evidence you will not have.
What it costs: Eighteen months sounds generous until you list the work: finding data, mapping flows, rewriting notices, renegotiating vendor contracts, testing breach response. Compress that into a final quarter and you pay premium rates for rushed consultants and rushed tooling. Meanwhile, enterprise buyers, banks and insurers are asking for DPDP evidence in contracts today. The commercial deadline has already passed.
Myth 3: "We are B2B, so we do not hold personal data"
Reality: Personal data is any data about an individual who can be identified by or in relation to it. A procurement manager's name, work email, mobile number and LinkedIn profile qualify. The Act carves out data made public by the individual or under a legal obligation, but a contact list scraped, bought or exported from your CRM is not that.
What it costs: B2B companies tend to discover their exposure late because their data sits in sales tools, event lead sheets, email marketing platforms and shared drives, not in a "customer database". Teams buy lists, run campaigns and keep contacts for years without a stated purpose. When a prospect asks what you hold on them, nobody can answer, and the sales team spends a week assembling a reply that should have taken a minute.
Myth 4: "We are only a processor, so our client is responsible"
Reality: Roles are decided per activity, not per company. You may be a Data Processor for a client's customer data and a Data Fiduciary for your own employees, applicants, website visitors and leads. A fiduciary is also responsible for compliance irrespective of any agreement or any failure by its processor (Section 8(1)), and may engage a processor only under a valid contract (Section 8(2)).
What it costs: The expense appears in two places. IT services and BPO firms who assumed they were fully outside the Act scramble when a client's contract demands specific security and breach terms. Fiduciaries who assumed a vendor contract moved the risk find that it did not, and then pay for a reactive vendor review after something has gone wrong.
Myth 5: "A checkbox and a privacy policy page mean we have consent"
Reality: Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the stated purpose. The request must be in plain language and available in English or any language in the Eighth Schedule. Withdrawal must be as easy as giving consent. Pre-ticked boxes, bundled marketing permissions and "by continuing you agree to everything" banners do not meet this standard.
What it costs: Rebuilding a consent flow after launch costs several times more than designing it properly, because it touches the website, the app, the CRM, the email platform and every campaign that relied on the old opt-in. Legacy databases add another layer. Section 5(2) requires notice for data collected before the Act, as soon as reasonably practicable, so an eight-year-old list is not safe simply because it is old.
| Processing situation | Typical basis under the Act | What you must still do |
|---|---|---|
| Marketing emails and promotional calls | Consent (Section 6) | Specific notice, clear opt-in, easy withdrawal |
| Data a customer volunteers to receive a service | Legitimate use, Section 7(a), where no objection is indicated | Use it only for that stated purpose |
| Payroll, attendance and employee benefits | Legitimate use, Section 7(i) | Safeguards, accuracy, retention limits, breach readiness |
| Disclosure ordered by a court or required by law | Legitimate use, Section 7 | Disclose only what the order or law requires |
Myth 6: "Employee data is out of scope"
Reality: Section 7(i) allows processing for employment purposes, and for safeguarding the employer from loss or liability, without separate consent. That removes one requirement. It does not exempt you from the rest: reasonable security safeguards, correctness of data, erasure once the purpose is served, breach intimation and grievance handling still apply to HR records, biometric attendance and CCTV footage.
What it costs: HR is usually the most neglected data estate in the company. Old candidate databases, scanned identity documents on shared drives, ex-employee records kept "just in case" and unencrypted exports sent to payroll vendors are all breach waiting to happen. The cost is not only a possible penalty. It is a quiet, ongoing storage and risk bill for data with no purpose.
Myth 7: "All data must stay in India" (or its opposite, "it can go anywhere")
Reality: Both halves are wrong. Section 16 follows a negative-list approach: transfers outside India are permitted except to countries the Central Government restricts by notification. Section 16(2) preserves stricter sectoral laws, so RBI, SEBI or IRDAI requirements can still mandate localisation for particular data. Significant Data Fiduciaries may also face government-specified localisation for certain categories.
What it costs: Companies that believe in blanket localisation migrate workloads and pay twice for infrastructure they did not need. Companies that believe in free movement sign SaaS and analytics contracts without recording where data goes, and then cannot answer the question when a regulator or enterprise customer asks. The fix is the same in both cases: know your flows and record them. Start with the vendors that matter most, ask each one where it stores and processes your data and which sub-processors it uses, and write the answers into your Record of Processing Activities.
Myth 8: "We are GDPR-compliant, so we are done"
Reality: GDPR work gives you a head start in discipline, not a finish line. The two regimes differ on lawful bases, children, breach reporting, officer requirements and enforcement.
| Area | GDPR | DPDP Act and Rules |
|---|---|---|
| Lawful bases | Six, including legitimate interests | Consent plus a closed list of "legitimate uses" under Section 7 |
| Special categories | Yes (health, biometrics and others) | No separate category; all personal data is covered |
| Children | Age threshold of 13 to 16 by country | Under 18; verifiable parental consent; no tracking or targeted advertising |
| Breach reporting | To the authority where risk exists | Every personal data breach: to the Board and affected individuals |
| Officer | DPO in defined cases | India-based DPO for Significant Data Fiduciaries only |
| Right to portability | Yes | Not provided |
| Regulator | National supervisory authorities | Data Protection Board of India |
| Penalty basis | Percentage of turnover or fixed euro cap | Fixed rupee ceilings per Schedule, up to ₹250 crore |
What it costs: Teams reuse a GDPR template and discover the gaps only when a customer audit asks for Board-specific breach procedures or age-verification evidence. Reworking a finished programme costs more than adapting it deliberately.
Myth 9: "Only serious breaches need to be reported"
Reality: Section 8(6) requires intimation of a personal data breach to the Board and to each affected Data Principal. Rule 7 sets the mechanics: affected individuals and the Board are informed without delay, followed by a detailed report to the Board within 72 hours, extendable if the Board allows. The Rules contain no materiality threshold. Failing to notify carries a ceiling of ₹200 crore.
What it costs: The expensive version of this myth is the Sunday-night discovery: a misconfigured storage bucket, a mis-sent spreadsheet, a vendor's compromised laptop. Without a rehearsed plan, the first hours go on debating whether it "counts". The cheap version is a one-hour tabletop exercise this quarter.
| Obligation | Timeline | Source |
|---|---|---|
| Breach intimation to individuals and Board | Without delay | Rule 7 |
| Detailed breach report to the Board | Within 72 hours | Rule 7 |
| Response to grievances | Within 90 days | Rule 14(3) |
| Retention of logs and relevant personal data | One year | Rule 6(1)(e) |
| Large e-commerce, gaming and social media platforms: erasure | After three years of inactivity, with 48 hours' prior notice | Rule 8, Third Schedule |
Myth 10: "It is a one-time IT project"
Reality: The Act is built on ongoing duties: keep data accurate, erase it when the purpose is served or consent is withdrawn (Section 8(7)), maintain safeguards, answer rights requests, and for Significant Data Fiduciaries run an annual DPIA and independent audit under Rule 13. A programme built once and left alone drifts out of date the moment marketing adopts a new tool or operations onboards a new courier partner.
What it costs: This is the most expensive myth, because it hides behind a finished project. Money is spent on a rollout, a certificate-style report is filed, and twelve months later the data map describes a company that no longer exists. Auditors and customers do not examine one day. They examine a dated trail across the year.
The real challenges nobody puts on the slide
If these myths were the whole story, a good checklist would solve it. In practice the hard parts are organisational:
- Shadow data. Spreadsheets on laptops, WhatsApp groups, exported reports and old backups never appear in an application inventory.
- Legacy consent. Most Indian firms hold years of data collected under assumptions that no longer apply, with no record of what individuals agreed to.
- Retention against deletion. Tax, labour and sectoral rules oblige you to keep some records, while the Act obliges you to erase others. Someone must decide, category by category, and write the reason down.
- Vendor sprawl. A typical mid-sized company has dozens of vendors touching personal data, many on contracts signed years ago with no breach or deletion terms.
- Ownership. IT assumes Legal owns it. Legal assumes IT does. HR and Marketing hold the most data and own none of the process.
- Language and access. Notices must be understandable and available in scheduled languages, which most websites and apps are not built for.
How VaultDef helps
Each myth survives because nobody can see the facts. VaultDef is built to make the facts visible and keep them current. It connects to your systems to discover and classify personal data, builds the Record of Processing Activities and data map from what it finds, manages notices and consent with timestamps and withdrawal records, and handles data principal requests with tracked deadlines. It tracks vendors and cross-border flows, supports DPIAs, runs a breach workflow with a running clock, and keeps a tamper-evident evidence trail so the answer to "prove it" is a folder, not a war room.
| Myth | The question it avoids | How VaultDef helps |
|---|---|---|
| 1, 3, 6: "We hold little personal data" | Where is it really? | Automated discovery and classification across systems |
| 5: "Our consent is fine" | Can you prove it? | Consent and notice management with dated records |
| 4: "Vendors own the risk" | Who touches the data? | Vendor register and processing mapping |
| 7: "Localisation, one way or the other" | Where does it flow? | Cross-border tracking against each activity |
| 9: "We would know" | Could you report in 72 hours? | Breach workflow with owners and a clock |
| 2, 8, 10: "We did this once" | Is it still true today? | Continuous evidence trail and quarterly review support |
Software does not replace ownership, policy decisions or vendor negotiations. Those stay with your people. What the platform removes is the manual, error-prone work of finding, recording and proving, which is where most of the money disappears.
Where to start this week
Pick one myth you recognise from your own organisation and test it. Ask where personal data actually sits, who owns the answer, and how you would prove it to a customer on Monday morning.
A sensible first ninety days looks like this. In the first month, name one accountable owner, put IT, HR, Marketing, Sales, Procurement and Legal around the table, and inventory every system holding personal data. In the second, build your Record of Processing Activities for the highest-volume activities, fix consent and notice at the points where data enters, and rank your vendors by how much personal data they touch. In the third, set retention periods and delete what has no purpose, rehearse a breach once, and start the evidence file you will keep for years. You will not be finished, but you will be defensible, and that is what 2026 actually demands.
If you want a structured path, our DPDP audit readiness checklist walks through ten steps in order.
Want to see where your own assumptions stand? Book a working demo and we will run a live scan on a sample of your schema, then leave you with the gap assessment generated during the call.
This article is general information based on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and is not legal advice. Confirm obligations for your sector with qualified counsel.
