A database left open
An unencrypted customer database is exposed and copied. The safeguard duty (up to ₹250 crore) is in play, and if the breach is not reported, the notification duty (up to ₹200 crore) as well.
India · DPDP Act 2023 · Section 33 · Schedule
DPDP Act penalties: up to ₹250 crore per breach.
The Digital Personal Data Protection Act, 2023 sets maximum penalties in its Schedule. The Data Protection Board of India decides the amount case by case, and more than one line can apply to the same incident.
Highest penalty₹250 crore for failing to take reasonable security safeguards (s. 8(5)).
Who decidesThe Data Protection Board of India, after an inquiry.
When it appliesMost duties and penalties apply from May 2027.
Under the DPDP Act, the Data Protection Board of India can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, up to ₹200 crore for failing to notify a breach or for breaching the duties on children’s data, up to ₹150 crore for breaching the duties of a Significant Data Fiduciary, and up to ₹50 crore for breaching any other provision. The amounts are maximums set in the Schedule to the Act under section 33.
The DPDP penalty schedule
| Breach | Section | Maximum penalty |
|---|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | s. 8(5) | ₹250 crore |
| Failing to notify the Board and affected Data Principals of a breach | s. 8(6) | ₹200 crore |
| Breaching the additional obligations for children’s data | s. 9 | ₹200 crore |
| Breaching the additional obligations of a Significant Data Fiduciary | s. 10 | ₹150 crore |
| Breaching a Data Principal’s own duties | s. 15 | ₹10,000 |
| Breaching a voluntary undertaking accepted by the Board | s. 32 | The penalty for the original breach |
| Breaching any other provision of the Act or the Rules | Residual | ₹50 crore |
Source: the Schedule to the Digital Personal Data Protection Act, 2023, read with section 33.
How the Data Protection Board decides the amount
Section 33 asks the Board to consider the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether the breach was repetitive, any gain made or loss avoided, the steps taken to mitigate the effects and their timeliness and effectiveness, whether the penalty is proportionate, and its likely impact on the person penalised.
Worked examples
A late breach report
A breach is found but the Board and affected people are not told in the form and time the Rules require. That alone can attract up to ₹200 crore.
Children’s data
An edtech app processes children’s data without verifiable parental consent. The children’s data duties carry up to ₹200 crore.
How to lower your exposure
- Find the personal data. You cannot protect what you have not found. Start with a PII inventory.
- Test the safeguards. Penetration testing shows whether encryption, access control and monitoring hold up, and documents that you checked.
- Rehearse breach reporting. Build the workflow for the Board and affected people before you need it.
- Keep the evidence. Mitigation steps and their timeliness are factors the Board weighs.
Frequently asked questions
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Several lines can apply to one incident.
When do DPDP penalties apply?
The DPDP Rules were notified on 13 November 2025. Most obligations on Data Fiduciaries, and the penalties for breaching them, apply from May 2027.
Who imposes DPDP penalties?
The Data Protection Board of India, after an inquiry. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal.
More on the DPDP Act
DPDP Act complianceDPDP Rules 2025 timelinePII data discoveryConsent manager vs CMPFree PII discovery tool
Know where your personal data is before the Board asks
Start with the free PII discovery tool, then test the safeguards with Sumrite.