The headline number everyone remembers is ₹250 crore. But the DPDP Act's penalty structure is broader than a single figure, and understanding it helps you focus your compliance effort where the risk is greatest.
What the Act penalises
The Schedule to the DPDP Act sets maximum penalties for different failures. In broad terms:
- Failing to take reasonable security safeguards to prevent a breach — up to ₹250 crore.
- Failing to notify a personal-data breach — up to ₹200 crore.
- Breaching obligations relating to children's data — up to ₹200 crore.
- Failing to meet the extra duties of a Significant Data Fiduciary — up to ₹150 crore.
- Other breaches of the Act or Rules — up to ₹50 crore.
These are maximums; the actual penalty depends on the facts.
How the Board decides
The Data Protection Board of India determines penalties after an inquiry, weighing factors such as the nature and gravity of the breach, its duration, the type of data involved, whether it was repetitive, and what the organisation did to mitigate it. Cooperation and genuine remediation matter.
The cost beyond the fine
A penalty is only part of the exposure. A breach or a public finding damages customer trust, invites scrutiny of your other practices, and can disrupt contracts that now require DPDP compliance from their vendors.
How to reduce your exposure
The failures that attract the largest penalties — weak security and missing breach processes — are also the most preventable. Encrypting sensitive data, keeping audit-ready evidence that your safeguards work, and having a breach-response process that triggers reliably all materially reduce both the chance of a penalty and its size. A short assessment will show you exactly where your gaps are.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.