DPDP penalties
DPDP Act Penalties: Up to ₹250 Crore Explained
By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules
Short answer
Under the DPDP Act, 2023, the Data Protection Board of India can fine a business up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not reporting a personal data breach or for breaching children’s-data duties, up to ₹150 crore for Significant Data Fiduciary failures and up to ₹50 crore for any other breach of the Act or Rules.
- Highest penalty
- ₹250 crore, for failing to take reasonable security safeguards (Section 8(5))
- Who imposes it
- The Data Protection Board of India, after an inquiry and a hearing (Section 33)
- Where the money goes
- The Consolidated Fund of India (Section 34)
- When enforcement starts
- Most obligations apply from 13 May 2027
The DPDP penalty schedule
The Schedule to the Act sets a maximum for each type of breach. These are ceilings, not fixed fines: the Board decides the actual amount case by case.
| Breach | Provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | Section 8(5) | ₹250 crore |
| Failure to notify the Board or affected individuals of a personal data breach | Section 8(6) | ₹200 crore |
| Breach of additional obligations for children’s personal data | Section 9 | ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary | Section 10 | ₹150 crore |
| Breach of duties by a Data Principal (individual) | Section 15 | ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board | Section 32 | Up to the penalty for the original breach |
| Breach of any other provision of the Act or Rules | Any | ₹50 crore |
How the Data Protection Board decides the amount
Section 33(2) lists the factors the Board must consider before setting a penalty:
- The nature, gravity and duration of the breach
- The type and nature of the personal data affected
- Whether the breach is repeated
- Whether the business gained, or avoided a loss, because of the breach
- Whether it acted to mitigate the effects, and how quickly and effectively
- Whether the penalty is proportionate and effective as a deterrent
- The likely impact of the penalty on the business
In practice, documented safeguards, a tested breach-response plan and fast mitigation are what reduce exposure. The Act also lets the Board accept a voluntary undertaking from a business to settle proceedings (Section 32).
Which penalties are most likely for small and mid-sized businesses?
The two highest tiers are the ones that apply to almost every organisation, because every business that holds personal data must protect it and must report breaches. Weak access control, missing logs, unencrypted exports and shared passwords all go to Section 8(5). A breach discovered and not reported to the Board and to affected people goes to Section 8(6).
- Encrypt or mask personal data, and control who can access it (Rule 6)
- Keep access logs for at least one year so breaches can be detected and investigated (Rule 6)
- Write and rehearse a breach procedure that meets the 72-hour reporting window (Rule 7)
- Put DPDP clauses in contracts with vendors that process data for you
Need this done in your own systems?
Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.
See our DPDP compliance servicesFrequently asked questions
What is the maximum penalty under the DPDP Act?+
The maximum penalty is ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach under Section 8(5) of the DPDP Act, 2023.
Is the DPDP penalty per breach or per year?+
The Schedule sets the maximum penalty for a breach of each listed obligation. The Board fixes the actual amount for each case after considering factors such as gravity, duration, repetition and mitigation under Section 33(2).
Can individuals be fined under the DPDP Act?+
Yes. A Data Principal who breaches their duties under Section 15, for example by filing a false or frivolous grievance or impersonating someone, can be fined up to ₹10,000.
Is there imprisonment under the DPDP Act?+
No. The DPDP Act, 2023 provides for monetary penalties imposed by the Data Protection Board, not criminal imprisonment.
When can DPDP penalties be imposed?+
Most obligations, including security safeguards and breach intimation under the Rules, come into force on 13 May 2027. Penalties attach to obligations once they are in force.
Related DPDP guides
Sources
This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.