The penalty schedule
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board and affected people of a breach | ₹200 crore |
| Breach of additional obligations for children’s data | ₹200 crore |
| Breach of additional obligations of Significant Data Fiduciaries | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Data Principal breaching their own duties (e.g. false complaints) | ₹10,000 |
These are maximums. The Board considers the nature, gravity and duration of the breach, the type of data, whether it was repeated, any gain or loss caused, and steps taken to mitigate it.
How small businesses get caught
- A staff phone with the customer WhatsApp list is lost, and nobody is told
- An Excel sheet of patient records is emailed to the wrong person
- Marketing SMS go to people who never agreed, and complaints reach the Board
- A customer asks for deletion and gets no reply for months
Five steps that reduce your risk the most
- Two-factor login and limited access for anyone handling customer data
- A written breach plan, so you report within 72 hours instead of hiding it
- Consent records for every marketing message
- A privacy centre where requests are logged and answered on time
- Deleting old data you don’t need: less data, less risk
Frequently asked questions
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach.
Who imposes DPDP penalties?
The Data Protection Board of India, after an inquiry. Its decisions can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Get DPDP-ready without a lawyer’s bill
ConsentKaro writes your privacy notice in English and Hindi, logs consent, and handles customer data requests. 14-day free trial, no card.
Start free trial → Take the free DPDP check