10 everyday DPDP mistakes employees make, and how to stop them

Under India’s Digital Personal Data Protection Act, 2023, the legal duties sit with the organisation, but whether they are met is decided at employees’ desks: in WhatsApp chats, spreadsheets, shared drives and phone calls. Below are 10 everyday mistakes, the provision of the Act or the DPDP Rules, 2025 that each one puts at risk, and a practical fix, ready to use as a team checklist.

The DPDP duties cited below come into force in May 2027, eighteen months after the Rules were notified on 13 November 2025. CERT-In’s directions of 28 April 2022, which require listed cyber incidents, including data breaches and data leaks, to be reported within six hours, already apply. DPDP penalties fall on the organisation, not individual employees: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or breaching the duties on children’s data.

The scenarios are illustrative, not real incidents.

1. Forwarding customer documents on personal WhatsApp

Why it’s risky: A customer’s PAN card, a patient’s lab report or a candidate’s offer letter forwarded from a personal phone leaves the organisation’s control. It cannot be logged or recalled, may be backed up to a personal cloud, and one wrong tap sends it to a family group.

What the law says: Section 8(5) requires reasonable security safeguards to prevent a breach; Rule 6(1)(b) and (c) call for access control and logs of who accessed personal data.

The fix:

• Use only channels your organisation has approved, such as the CRM, the helpdesk or a business messaging account it manages.
• If a customer sends documents to your personal number, move them to the official system and delete the chat copy as your policy says.
• Managers: stop asking the team to “just WhatsApp it to me”.

2. Exporting CRM lists to personal Google Sheets and Downloads folders

Why it’s risky: A lead list copied into a personal Google Sheet, a pen drive or the Downloads folder escapes access control, logging and backup. Nobody deletes it, so it is still there when the laptop is lost or the employee joins a competitor.

What the law says: Section 8(5) and Rule 6(1)(a) to (c) (masking, access control, logs) apply; section 8(7) requires erasure once the purpose is served, unless a law requires retention.

The fix:

• Work inside the CRM and use its reports. If you must export, get approval, take only the columns you need and keep the file in the approved company drive.
• Delete working copies from Downloads, the desktop and email once the task is done. The official record stays in the system.

3. Sharing one login, password or OTP across the team

Why it’s risky: When the whole front desk uses one “reception” account, or a colleague reads out an OTP over the phone, the access log can only say that the shared account did it. Former staff who know the password keep their access.

What the law says: Rule 6(1)(b) requires access control, and Rule 6(1)(c) requires logs, monitoring and review so that unauthorised access can be detected and investigated.

The fix:

• One person, one account, with multi-factor authentication wherever it is offered.
• Never share a password or OTP, even with a colleague covering your shift or a vendor’s engineer.
• For shared mailboxes, ask IT for delegated access so each person signs in as themselves.

4. Giving out records to callers you haven’t verified

Why it’s risky: “I’m calling from the bank, please confirm the customer’s address.” “I’m her husband, just tell me the appointment time.” Confident, urgent callers are hard to refuse. If they are not who they claim to be, your helpful answer has disclosed personal data to an outsider.

What the law says: Section 8(5) requires safeguards against a breach, and section 2(u) counts accidental disclosure as a personal data breach, which triggers the reporting duty in section 8(6).

The fix:

• Verify callers against details on record, and call back on the registered number, not one the caller gives.
• Send requests from police, courts or regulators to your legal or compliance team, in writing.
• Never read out full ID, card or account numbers. Share only what a verified caller needs.

5. Collecting full Aadhaar copies and leaving them lying around

Why it’s risky: Front desks and HR teams often collect Aadhaar photocopies or phone photos “for records”, then leave them in trays, on shared desktops or in chat threads. A full Aadhaar number with a name, photo and address is valuable to fraudsters. Scans and phone photos are digital data, so the Act applies (section 3).

What the law says: Section 8(5) and Rule 6(1)(a), which names masking as a safeguard, apply; where consent is the basis, section 6(1) limits it to necessary data. The Aadhaar Act, 2016 adds its own restrictions.

The fix:

• Ask for ID only where the process needs it, and accept a masked Aadhaar, which shows only the last four digits, where the full number is not required.
• Store scans in the approved system with restricted access, not on phones, desktops or chats.
• Clear counters and printer trays, and dispose of paper copies as your retention schedule says.

6. Pasting customer data into public AI chatbots

Why it’s risky: Pasting a complaint email, a CV or a customer spreadsheet into a free AI chatbot hands the data to a third party your organisation has no agreement with. Depending on the service and its settings, the provider may store what you paste and, in some cases, use it to improve its models.

What the law says: Section 8(2) allows a Data Processor to handle personal data on your behalf only under a valid contract, with security safeguards written in (Rule 6(1)(f)); section 8(1) keeps you responsible either way.

The fix:

• Use only AI tools your organisation has approved under a business agreement.
• Remove names, phone numbers, IDs and account details before pasting text into any AI tool, unless the task genuinely needs them.
• If personal data has already gone into an unapproved tool, report it like any other incident.

7. Sharing drive folders with “anyone with the link”

Why it’s risky: Link sharing is the quickest way to send a folder to a vendor or candidate. But the link works for whoever has it, can be forwarded endlessly and often stays live long after the work ends.

What the law says: Rule 6(1)(b) requires appropriate control over access to the organisation’s computer resources, as part of the section 8(5) security duty.

The fix:

• Share with named people or email addresses, not “anyone with the link”.
• Set an expiry date on external shares, and review shared folders every quarter.
• IT: switch off public link sharing by default for folders that hold personal data.

8. Using bought contact lists for campaigns

Why it’s risky: Bought or scraped lists arrive with no record that the people on them saw your notice or agreed to your purpose. They may also include under-18s.

What the law says: Section 4 allows processing only with consent or for a listed legitimate use, sections 5 and 6 and Rule 3 require a clear notice and specific consent, and section 9(3) bars targeted advertising directed at children.

The fix:

• Market to people who opted in after seeing your notice, and keep proof: section 6(10) puts the burden of proving notice and consent on you.
• Ask any list vendor for evidence of notice and consent that covers your purpose. If they cannot show it, do not use the list.
• Follow TRAI’s commercial communication regulations for promotional calls and SMS as well.

9. Ignoring “stop messaging me” and “delete my data” requests

Why it’s risky: A customer replies “STOP” on WhatsApp or asks a call-centre agent to delete their details. The agent says “that’s not my department”, nothing is logged, and the campaign team and its vendor keep messaging.

What the law says: Under section 6(4) and (6), withdrawal must be as easy as giving consent, and processing, including by vendors, must stop within a reasonable time. Section 8(7) covers erasure; Rule 14(3) caps grievance responses at 90 days.

The fix:

• Log every opt-out or deletion request in the official system, whichever channel it arrives on.
• Pass it the same day to the team that owns the data, so campaigns and vendors stop too. Don’t promise instant deletion; some records must be kept by law.
• Know your organisation’s published contact for data questions (section 8(9) and Rule 9) and share it with the customer.

10. Sitting on a misdirected email instead of reporting it

Why it’s risky: Autocomplete picks the wrong “Ramesh” and a salary sheet goes to an outside vendor. Out of embarrassment, the sender asks the recipient to delete it and tells nobody. That accidental disclosure is a personal data breach under section 2(u), and every hour of silence eats into the reporting deadlines.

What the law says: Section 8(6) and Rule 7 require the organisation to inform affected people and the Board without delay, then send the Board a detailed report within 72 hours of becoming aware; CERT-In’s six-hour rule covers data leaks, which its FAQs say can result from user error.

The fix:

• Report it at once through the agreed channel, even if you made the mistake, noting the time and exactly what was sent.
• Ask the recipient in writing to delete it, but report first, not instead.
• Managers: thank people who report quickly. Blame teaches the next person to stay quiet.

Summary: the 10 mistakes at a glance

How do you build these habits in a team?

Policies alone rarely change behaviour. These steps help:

• Make the safe way the easy way. Approved channels, masked views, limited export rights and public links switched off remove much of the temptation.
• Use examples from each team’s own tools. Sales hears about CRM exports, HR about payroll files, the front desk about ID copies.
• Cover one mistake a week. A five-minute slot in your weekly meeting covers this list in ten weeks.
• Publish one reporting channel and make clear that prompt reporting is welcome, even of your own mistakes.
• Let managers go first. If the team lead asks for files on WhatsApp, no training will undo it.

Where should you start?

Most of these fixes are habits and default settings, not new software. To see where your organisation stands, try our free DPDP readiness test, or read our guides to Rule 6 security safeguards and the 72-hour breach reporting rule.

AuditDPDP is an independent DPDP awareness training provider operated by Xcodefix Global, Coimbatore. We are not affiliated with MeitY or the Data Protection Board, and our training carries no official certification. If role-based sessions built on scenarios like these would help, get in touch. This article is general information, not legal advice.