DPDP Act penalties: the amounts, how the Board decides and how to reduce your exposure

Quick answer

Under the Digital Personal Data Protection Act, 2023, the Data Protection Board of India can impose penalties of up to INR 250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach, or breaching the duties on children's data, can cost up to INR 200 crore each. Significant Data Fiduciaries face up to INR 150 crore for their additional duties, and most other breaches carry up to INR 50 crore. The amounts are maximums per breach, set after an inquiry. This is a summary of the law and is no substitute for legal advice.

The schedule of penalties

The Schedule to the Act sets these maximum amounts:

• Reasonable security safeguards (section 8(5)): up to INR 250 crore for failing to take reasonable security safeguards to prevent a personal data breach.
• Breach notification (section 8(6)): up to INR 200 crore for failing to inform the Board or the affected Data Principals of a personal data breach.
• Children (section 9): up to INR 200 crore for breaching the additional duties on children's personal data, such as verifiable parental consent and the bar on tracking and targeted advertising aimed at children.
• Significant Data Fiduciaries (section 10): up to INR 150 crore for breaching their additional duties, such as appointing a Data Protection Officer, independent audits and periodic data protection impact assessments.
• Duties of Data Principals (section 15): up to INR 10,000, for example for filing a false or frivolous complaint.
• Voluntary undertakings (section 32): a breach of an undertaking accepted by the Board can attract the penalty that applied to the original breach.
• Any other provision of the Act or Rules: up to INR 50 crore.

How the Board decides

The Board is a digital office. It can act on a complaint from a Data Principal, a reference from the Central Government or a direction from a court, and it receives the breach intimations Data Fiduciaries must send. If it finds sufficient grounds, it holds an inquiry and gives the organisation a chance to be heard.

Before setting an amount, the Board must consider, under section 33(2):

• the nature, gravity and duration of the breach;
• the type and nature of the personal data affected;
• whether the breach is repeated;
• whether the organisation gained or avoided a loss through it;
• whether it acted to mitigate the effects, and how quickly and effectively;
• whether the penalty is proportionate and effective; and
• the likely impact of the penalty on the organisation.

At any stage, the Board may accept a voluntary undertaking from the organisation, such as a commitment to take specific steps within a set time. An accepted undertaking bars proceedings on the matters it covers, unless its terms are breached.

Appeals and further consequences

An organisation can appeal a Board order to the Appellate Tribunal, the Telecom Disputes Settlement and Appellate Tribunal, within 60 days. Penalties are paid into the Consolidated Fund of India, so they do not compensate affected individuals.

Where penalties have been imposed on a Data Fiduciary in two or more cases, the Central Government may, on a reference from the Board and after a hearing, direct that public access to its platform be blocked in India.

Timing

The DPDP Rules were notified on 13 November 2025 and take effect in phases. Consent Manager provisions apply from about 13 November 2026, and most Data Fiduciary duties, including security safeguards and breach notification, from about 13 May 2027, unless the government amends the timeline. See the DPDP Act first 90 days for a plan.

How to reduce your exposure

1. Document your security safeguards. Encryption or masking of personal data, access controls, logging and monitoring, and backups, with the evidence kept where an auditor can find it.
2. Test your breach process. Who decides that an event is a personal data breach, who tells the Board and the affected people, and who writes the detailed report due within 72 hours.
3. Map children's data. Find every place a person under 18 can sign up, and put verifiable parental consent in front of it.
4. Keep consent records you can prove. Each consent needs its notice, purpose, time and withdrawal history.
5. Train the teams who handle requests. Mistakes in rights requests and grievances are the most common route to a complaint.

TrustOS keeps consent records, rights requests, breach handling and audit evidence in one place, and the DPDP Readiness Check shows where you stand in ten questions.

Questions and answers

Is the INR 250 crore penalty per breach or per year?

The Schedule sets a maximum per breach, decided after an inquiry. The Board sets the actual amount using the factors in section 33(2).

Can individuals claim compensation under the DPDP Act?

The Act does not provide compensation to individuals. Penalties go to the Consolidated Fund of India. Other laws or contracts may give separate remedies.

Does the Act apply to companies outside India?

Yes, when they process the personal data of people in India in connection with offering goods or services to them.

Sources

• Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, published in the Gazette of India on 11 August 2023: sections 8, 9, 10, 15, 27 to 34 and 37, and the Schedule.
• Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology on 13 November 2025.