DPDP Act Penalty: The ₹250 Crore Fine Schedule Explained

The penalty structure at a glance

The DPDP Act is not a compliance exercise with paper-only consequences. Chapter VI of the Act establishes a financial penalty regime enforced by the Data Protection Board of India — a quasi-judicial body with the power to investigate violations and impose fines. Each category of breach has its own maximum penalty in the Schedule to the Act.

The DPDP Rules 2025 were notified on 13 November 2025. The provisions on the Data Protection Board came into force that day. Most obligations for businesses, including notice, consent, security and breach intimation, apply from 13 May 2027. Enforcement action is not theoretical — it is a matter of when, not if.

The complete penalty schedule

Section 33 of the DPDP Act links to a Schedule that sets a maximum penalty for seven categories of breach. Each category maps to a specific obligation and carries its own maximum:

Security safeguard failures — up to ₹250 crore

The highest penalty category applies to violations of Section 8(5) of the Act, which requires every Data Fiduciary to implement "reasonable security safeguards" to prevent personal data breaches. The Act does not prescribe a fixed technical standard — "reasonable" is assessed by the Board in light of the nature of the data processed, the scale of operations, and industry norms.

What constitutes reasonable security safeguards? The DPDP Rules 2025 and the Board's eventual guidance will elaborate this, but current benchmarks include:

• Encryption of personal data in transit and at rest
• Access controls limiting who can read or modify personal data
• Data minimisation — not retaining personal data longer than necessary
• Vendor and processor contracts that bind Data Processors to equivalent security standards
• Breach detection and incident response capabilities
• Regular vulnerability assessments and patching

ISO 27001 certification is not a legal shield — the Act does not equate certification with compliance — but it is strong evidence that your security programme is systematic and proportionate. Organisations with no documented security programme, or with known vulnerabilities that were not addressed, face the full force of this provision.

Breach notification failures — up to ₹200 crore

When a personal data breach occurs, Section 8(6) requires Data Fiduciaries to notify the Data Protection Board and affected Data Principals. Both arms of notification are mandatory — informing only the Board, or only individuals, does not satisfy the obligation.

What triggers the notification obligation?

Section 8(6) applies to every personal data breach. Unlike some other laws, the DPDP Act has no "likely to result in harm" threshold for intimating the Board and the affected Data Principals.

Timing of notification

Rule 7 of the DPDP Rules 2025 requires the Data Fiduciary to inform the Board and each affected Data Principal without delay, and to give the Board a detailed report within 72 hours of becoming aware of the breach (or a longer period the Board allows). Failing to notify falls under the ₹200 crore category.

Children's data violations — up to ₹200 crore

Section 9 of the DPDP Act imposes heightened obligations on Data Fiduciaries that process personal data of children (under 18) or persons with disabilities. Specific requirements include:

• Obtaining verifiable parental consent before processing a child's personal data
• Not processing children's data in a manner that is likely to cause harm to the child
• Not engaging in behavioural monitoring or targeted advertising directed at children
• Not tracking children's online activities, even with parental consent, if the tracking purpose is commercial profiling

Any platform that has users under 18 — gaming apps, edtech, social media, children's content, health apps used by minors — is exposed to this provision. The Board is expected to take an especially strict view of violations here, given the explicit legislative intent to protect children's digital rights.

Significant Data Fiduciary violations — up to ₹150 crore

Organisations designated as Significant Data Fiduciaries (SDFs) under Section 10 face a separate penalty for failing to comply with their additional obligations. These obligations include appointing an India-based Data Protection Officer, conducting periodic Data Protection Impact Assessments, undergoing independent data audits, and complying with any additional standards specified by the government.

All other violations — up to ₹50 crore

The last item in the Schedule is a catch-all for breaches of any other provision of the Act or the DPDP Rules 2025. Examples include:

• Failing to provide valid consent notice in the prescribed format
• Failing to honour Data Principal rights — access, correction, erasure, grievance
• Failing to appoint a Grievance Officer accessible to Data Principals
• Retaining personal data beyond the permitted retention period without a valid purpose
• Unlawfully transferring personal data to a restricted country
• Failure to comply with a Board order

A maximum of ₹50 crore may seem lower, but it is still a substantial figure for most Indian businesses.

How the Data Protection Board determines the penalty amount

The Board does not automatically impose the maximum penalty. Section 33 gives the Board discretion to impose a financial penalty up to the cap. In exercising this discretion, section 33(2) requires the Board to consider:

• Nature, gravity and duration of the breach
• Type and nature of the personal data affected
• Repetitive nature of the breach
• Gain made or loss avoided by the person as a result of the breach
• Mitigating action taken, and how quickly and effectively it was taken
• Whether the penalty is proportionate and effective, having regard to securing compliance and deterring breaches
• The likely impact of the penalty on the person

The Board's adjudication process

The Data Protection Board of India is constituted under Chapter V of the DPDP Act. It is a quasi-judicial body — meaning it operates like a court, with procedures for filing complaints, hearings, evidence, and binding orders. The process for a penalty proceeding generally follows these stages:

Step 1: What starts an inquiry

The Board may initiate an inquiry on receiving a personal data breach intimation, a complaint from a Data Principal, a reference from the Central or State Government, or a direction from a court. A Data Principal must first exhaust the Data Fiduciary's internal grievance process before approaching the Board.

Step 2: Notice to the Data Fiduciary

If the Board determines a complaint warrants investigation, it issues a formal notice to the Data Fiduciary, setting out the alleged violation and allowing the organisation to respond. This is the critical window for organisations to present their case — including evidence of compliance measures, remedial action taken, and mitigating factors.

Step 3: Hearing and decision

The Board conducts a hearing — which can be in-person or virtual — and may call for additional information or documents. After hearing both sides, the Board issues an order that may include a financial penalty, a direction to take remedial action, or both. Board orders can be appealed to the Appellate Tribunal (TDSAT) within 60 days under section 29.

Step 4: Enforcement

Under section 37, after penalties have been imposed on a Data Fiduciary in two or more cases, the Board may advise the Central Government, and the Central Government may then direct that public access to the relevant platform be blocked. Blocking is not automatic.

7 steps to reduce your DPDP penalty exposure

Penalty reduction is not about legal argumentation after the fact — it is about building a compliance posture that gives the Board little to find in the first place, and demonstrating responsiveness when issues arise.

• 1
  Document your security programme

  An undocumented security programme does not exist in the eyes of the Board. Map your technical controls, policies, and procedures. ISO 27001 certification provides structured evidence of a systematic approach and is the strongest documentary defence against Section 33(1) claims.

• 2
  Build a breach notification protocol now

  Define who is responsible for identifying a breach, who approves notification, and what the Board notification must contain. Rehearse this protocol — table-top breach simulations reveal gaps before they become penalty exposure. The goal is to be able to notify within 72 hours of becoming aware.

• 3
  Audit your consent and notice mechanisms

  Every collection point — web forms, app screens, verbal consent over phone — must present a consent notice that meets the DPDP Act's format requirements. Invalid consent notices fall under the Schedule's catch-all category (up to ₹50 crore). Conduct a full audit of all touch-points before enforcement begins.

• 4
  Implement a working grievance mechanism

  Data Principals must be able to reach a named Grievance Officer and receive a response within the prescribed timeline. An unresponsive or non-existent grievance mechanism is a Board complaint waiting to happen — and falls under the Schedule's catch-all category. Assign a real person, monitor the inbox, and respond.

• 5
  Treat children's data with a separate protocol

  If your product has any pathway for under-18 users, implement age verification and parental consent collection now. The maximum of up to ₹200 crore for children's data makes it one of the highest-risk areas. Disable behavioural advertising on all child-accessible flows.

• 6
  Conduct a Data Processor audit

  You remain liable for your Data Processors' handling of personal data. Review all vendor and cloud contracts to ensure they include DPDP-compliant data processing clauses, security obligations, and breach notification timelines. A breach at your cloud vendor that originates from inadequate contractual controls is your security-safeguards problem.

• 7
  Cooperate with the Board from day one

  If the Board sends a notice, respond promptly, transparently, and completely. Attempting to delay, obscure, or minimise will be noted and will increase the penalty. Present evidence of your compliance programme, remedial action, and cooperation — these are the strongest mitigating factors in the Board's discretion.

DPDP penalties vs. GDPR — key differences

Finance teams and boards used to GDPR will have a framing problem when reading DPDP Act penalties. The two regimes are structurally different in important ways:

For large multinationals, GDPR's turnover-linked penalties can dwarf DPDP caps. But for India-focused businesses — particularly mid-size companies processing data of millions of Indian users — the DPDP Act's maximum of up to ₹250 crore is a serious financial exposure, not a compliance checkbox.