Quick Answer
The DPDP Act 2023 penalty schedule ranges from ₹10 crore (failure to notify a breach to Data Principals) to ₹250 crore (failure to implement adequate security safeguards). The Data Protection Board adjudicates complaints and investigations — it can impose penalties on both Data Fiduciaries and Consent Managers. Penalties are cumulative per violation, meaning a single breach incident can attract multiple fines across different sections.
Quick AnswerDPDP penalties range from ₹10,000 to ₹250 crore depending on the violation. The Data Protection Board considers severity, volume of affected individuals, and remediation taken before imposing fines.
DPDP Compliance Checklist
- ₹250 crore: Failure to implement adequate security safeguards (most common risk)
- ₹200 crore: Failure to notify Data Protection Board and affected individuals of a breach
- ₹200 crore: Failure to fulfil Significant Data Fiduciary obligations
- ₹150 crore: Failure to notify affected data principals of a breach
- ₹50 crore: Violation of data processing obligations for children
- ₹10,000: Individual grievance resolution failures by grievance officer
- Penalties are per-incident — multiple violations can compound
- Board considers: severity, volume affected, intent, cooperation, remediation
- No criminal liability in DPDP — all penalties are financial
- Penalties go to Consolidated Fund of India — no private right of action for damages
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Can DPDP penalties bankrupt a small business?+
The Data Protection Board has discretion on penalty quantum. Small businesses with limited data processing may receive proportionally smaller penalties. Document good-faith compliance efforts.
Is there a way to appeal DPDP penalties?+
Yes. Board orders can be appealed to the Telecom Disputes Settlement Appellate Tribunal (TDSAT), then to the High Court and Supreme Court.
Does cooperating with the Board reduce penalties?+
Yes. The Board considers the entity's cooperation and remediation measures as mitigating factors in penalty determination.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
