DPDP Act penalties: what the ₹250 crore figure covers
Reviewed against the law as of 28 September 2026
The DPDP Act Schedule sets penalties from ₹10,000 to ₹250 crore. Which failures attract which maximum, and how the Data Protection Board decides.
The DPDP Act does not use percentages of turnover as GDPR does. Instead, its Schedule sets a maximum penalty for each type of failure, and the Data Protection Board decides the amount after an inquiry.
The Schedule
| Failure | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach (section 8(5)) | ₹250 crore |
| Failing to notify the Board or affected Data Principals of a breach (section 8(6)) | ₹200 crore |
| Breaching the additional obligations for children's data (section 9) | ₹200 crore |
| Breaching the additional obligations of a Significant Data Fiduciary (section 10) | ₹150 crore |
| Breaching a voluntary undertaking accepted by the Board | Up to the penalty for the underlying breach |
| Any other breach of the Act or Rules by a Data Fiduciary | ₹50 crore |
| A Data Principal breaching their duties (section 15) | ₹10,000 |
How the Board decides the amount
The Board must consider, among other things:
- the nature, gravity and duration of the breach;
- the type and nature of the personal data affected;
- whether it was repetitive;
- whether the organisation gained or avoided a loss because of it;
- whether it took action to mitigate the effects, and how timely and effective that was;
- whether the penalty is proportionate and would deter;
- the likely impact of the penalty on the organisation.
Mitigation counts. An organisation that detected a breach quickly, contained it, notified on time and can show its safeguards were reasonable is in a very different position from one that learned about the breach from the news.
Why security is the biggest exposure
The largest figure attaches not to the breach itself but to the failure to take reasonable security safeguards to prevent it. The Rules describe what reasonable safeguards include: encryption, obfuscation or masking; access control; visibility of access through logs, monitoring and review; backups for continuity; keeping logs for a year; contracts with processors; and appropriate technical and organisational measures.
If an incident happens, the questions will be: did you have these measures, did they work, and can you prove it on the date of the breach? Evidence collected continuously, with timestamps and hashes, answers that far better than a policy document.
One incident, several penalties
Take a publicly exposed backup of customer data found by a researcher. The same facts could raise:
- failure of reasonable security safeguards (the exposure itself);
- failure to notify, if the Board and customers were not told;
- children's data obligations, if the backup included minors' data processed without verifiable parental consent.
Voluntary undertakings
The Board can accept a voluntary undertaking from an organisation, for example to take specified steps within a time, which can end proceedings. Breaching an accepted undertaking is itself penalised.
What to do now
- Fix the controls that prevent the most common breaches: public storage, missing MFA, unencrypted stores, missing logs.
- Build a breach process that can meet the notification timelines. See breach notification.
- Keep evidence of your safeguards over time, not just today.
TrustNiq tests these safeguards daily and keeps hashed evidence of each result. Start a free trial.
Frequently asked questions
Is the ₹250 crore penalty per breach?
The Schedule sets a maximum for each instance of each type of failure. The Board decides the amount for each case, and a single incident can involve more than one type of failure, such as weak safeguards and late notification.
Can individuals claim compensation under the DPDP Act?
The Act does not provide compensation to affected individuals. Penalties are paid to the government. Individuals may have remedies under other laws.
Can Data Principals be penalised?
Yes. A Data Principal who breaches their duties, for example by filing a false or frivolous complaint, can be fined up to ₹10,000.
Sources
- Digital Personal Data Protection Act, 2023, section 33 and the Schedulemeity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.