\n\n| Personal data inventory<\/td>\n | All personal data categories and locations identified<\/td>\n | Data inventory register, discovery scan results<\/td>\n | IT \/ Security, with business units<\/td>\n | Relying on interviews instead of verified discovery<\/td>\n<\/tr>\n |
\n| Data flow and mapping<\/td>\n | Flows between systems, teams and vendors<\/td>\n | Data flow diagrams, system register<\/td>\n | IT \/ Enterprise architecture<\/td>\n | Maps created once and never updated<\/td>\n<\/tr>\n |
\n| Purpose and processing<\/td>\n | Documented purpose and basis for each activity<\/td>\n | Processing records, legal assessments<\/td>\n | Compliance \/ Legal<\/td>\n | Purposes too vague to enforce<\/td>\n<\/tr>\n |
\n| Consent and notice<\/td>\n | Clear notices, recorded consent, working withdrawal<\/td>\n | Consent logs, notice versions<\/td>\n | Marketing, Product, Legal<\/td>\n | Withdrawal not reaching vendors<\/td>\n<\/tr>\n |
\n| Data Principal requests<\/td>\n | Channel, authentication, tracking, timelines<\/td>\n | Request log, response records<\/td>\n | Privacy lead, Customer service<\/td>\n | Email-only handling with no tracking<\/td>\n<\/tr>\n |
\n| Processor and vendor management<\/td>\n | Contracts, security, access, sub-processors<\/td>\n | Vendor register, DPAs, assessments<\/td>\n | Procurement, Security<\/td>\n | Unknown vendors with data access<\/td>\n<\/tr>\n |
\n| Access control<\/td>\n | Least-privilege access to personal data<\/td>\n | Access reviews, role matrices<\/td>\n | IT \/ Security<\/td>\n | Leavers and movers keeping access<\/td>\n<\/tr>\n |
\n| Data retention<\/td>\n | Retention period per data category<\/td>\n | Retention schedule, approvals<\/td>\n | Compliance, Business owners<\/td>\n | “Keep everything” as the default<\/td>\n<\/tr>\n |
\n| Secure deletion<\/td>\n | Deletion across systems, backups and vendors<\/td>\n | Deletion logs, certificates<\/td>\n | IT Operations<\/td>\n | Deleted in the app but not in backups<\/td>\n<\/tr>\n |
\n| Incident and breach response<\/td>\n | Tested workflow and notification decisions<\/td>\n | Incident plan, exercise reports<\/td>\n | Security, Legal, Leadership<\/td>\n | Plan never rehearsed<\/td>\n<\/tr>\n |
\n| Documentation and evidence<\/td>\n | Central, current evidence repository<\/td>\n | Evidence index, audit trails<\/td>\n | Privacy lead<\/td>\n | Evidence scattered or outdated<\/td>\n<\/tr>\n |
\n| Awareness and training<\/td>\n | Role-based training for staff handling data<\/td>\n | Training records, completion rates<\/td>\n | HR, Security<\/td>\n | Generic annual training only<\/td>\n<\/tr>\n |
\n| Periodic reviews and governance<\/td>\n | Scheduled reviews and management reporting<\/td>\n | Review minutes, dashboards<\/td>\n | Leadership, Privacy lead<\/td>\n | No owner once the project ends<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/span>Common Mistakes Indian Mid-Sized Enterprises Should Avoid<\/span><\/h2>\n\n- Starting with policies instead of data.<\/strong>\u00a0Well-written policies cannot be evidenced without a verified inventory.<\/li>\n
- Treating DPDP as an IT-only project.<\/strong>\u00a0HR, marketing, sales, finance and procurement all handle personal data.<\/li>\n
- Overlooking unstructured data.<\/strong>\u00a0Spreadsheets, email attachments, WhatsApp exports and scanned documents often hold the most sensitive data.<\/li>\n
- Ignoring legacy vendors.<\/strong>\u00a0Old contracts rarely include adequate data protection clauses.<\/li>\n
|