Third-Party API Risk: When One Integration Exposes Customer Data
An API-risk control covering credentials, scopes, data fields, authentication, rate limits, webhooks, logs, sandbox data, vendor changes and revocation.
One over-privileged API token can expose more data than a compromised employee account.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
DPDP safeguards apply according to phased commencement, while current CERT-In and contractual security duties can apply now.
API scopes should match the integration’s purpose and should not default to full read/write access.
Secrets must be stored, rotated and revoked through controlled systems rather than source code, spreadsheets or chat.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
- DPDP safeguards apply according to phased commencement, while current CERT-In and contractual security duties can apply now.
- API scopes should match the integration’s purpose and should not default to full read/write access.
- Secrets must be stored, rotated and revoked through controlled systems rather than source code, spreadsheets or chat.
- Webhook destinations, callback URLs and logs can leak data even when the core API is secure.
The five-point review
| Check | What to examine |
|---|---|
| Purpose | Business function and data required. |
| Identity | Service account, token and authentication. |
| Scope | Read, write, admin, user and environment. |
| Data | Fields, payload, logs and error messages. |
| Lifecycle | Testing, rotation, vendor change and revocation. |
Practical example
A marketing integration needs customer email and campaign status but receives full profile, address, order history and support notes through a broad token. A field-limited endpoint would reduce exposure.
How to apply the framework
Maintain an API inventory with owner, vendor, scopes, secret location, data classification and last review.
Test revocation and vendor offboarding. Deleting the app from a dashboard may not revoke all tokens or webhooks.
Operating workflow
Define the real process before selecting the legal label
Identify the people, data, systems, purpose, owner, processor, user journey and failure scenario. Review purpose, identity and scope together. A policy statement or vendor assurance cannot replace evidence of how the live product behaves.
Separate current obligations from scheduled DPDP controls
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative CERT-In, banking, telecom, insurance, employment, consumer, contract and criminal-law requirements. Build the scheduled DPDP workflow now, but do not describe a future provision as already enforceable.
Test and preserve evidence
Run the workflow in the live or controlled test environment. Preserve screenshots, approvals, logs, vendor responses, user communications, exceptions and remediation. Assign a named owner and completion date to every failed control so management can distinguish an operating safeguard from a policy intention.
Action checklist
- Inventory APIs and webhooks.
- Use least-privilege scopes.
- Protect and rotate secrets.
- Minimise payloads and logs.
- Monitor unusual calls.
- Test revocation and vendor exit.
Evidence to keep
- API and token register
- Scope approval
- Payload samples
- Monitoring logs
- Revocation and offboarding evidence
Warning signs
- Tokens in source code
- Production data in sandbox
- Admin scope for read-only use
- Verbose errors expose records
- Webhook remains after contract end
Finin2min takeaway
Privacy and cyber maturity are visible in operating behaviour: what the organisation collects, who can use it, how vendors are controlled, how users exercise choices, how incidents are handled and whether evidence survives scrutiny.