DPDP Act penalties: fines up to ₹250 crore explained

How DPDP Act penalties work

DPDP penalties are fixed-amount and assessed per instance of non-compliance — not linked to turnover like GDPR fines. They are imposed by the Data Protection Board of India after an inquiry, and a single incident can trigger more than one penalty category, which compounds the exposure.

The DPDP Act penalty schedule

The Act sets maximum penalties by type of violation:

• Failure to take reasonable security safeguards to prevent a personal data breach — up to ₹250 crore.
• Failure to notify a breach to the Board and affected Data Principals — up to ₹200 crore.
• Non-compliance with children's-data obligations — up to ₹200 crore.
• Breach of Significant Data Fiduciary obligations — up to ₹150 crore.
• Non-compliance with the Data Protection Board's directions — up to ₹50 crore.
• Breach of a Data Principal's duties — up to ₹10,000.

Who imposes penalties, and how

The Data Protection Board of India adjudicates. It can act on a complaint or on its own motion, conduct an inquiry, and impose a penalty from the schedule. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), with a further appeal to the Supreme Court on questions of law.

What the Board considers before fixing an amount

Penalties are maximums, not automatic. The Board weighs mitigating factors — the nature and gravity of the breach, whether you self-disclosed, the corrective action you took, your cooperation, and your prior compliance history. A prepared organisation with a breach runbook and evidence of good-faith compliance is treated very differently from one that ignored its obligations.

Why the real exposure is bigger than the headline

Two features make DPDP penalties sharper than the top-line number suggests: they're per instance, so a breach affecting many records can multiply, and a single failure can breach several categories at once (for example, a breach you failed to prevent and failed to notify). Add the reputational cost of a public Board order, and the case for getting ahead of compliance is clear.

How to reduce your penalty exposure

• Implement genuine, documented security safeguards — the ₹250 crore category is the one to design out first.
• Build and test a breach-notification runbook so you can meet the timelines.
• Keep auditable evidence of consent, controls and decisions.
• If a breach happens, self-disclose and act fast — cooperation and remediation are explicit mitigating factors.

How AramGRC helps

AramGRC helps you close the gaps that lead to the largest penalties — security safeguards, breach response and evidence — with a DPDP readiness assessment mapped to the specific obligations the Board enforces. See the compliance checklist.