Key points
- Maximum penalty: ₹250 crore for failing to take reasonable security safeguards.
- Up to ₹200 crore each for failing to report a breach and for breaching children's data obligations.
- Up to ₹150 crore for Significant Data Fiduciary obligations; ₹50 crore for other breaches.
- The Data Protection Board sets the amount based on gravity, duration, data affected and mitigation (Section 33).
- Orders can be appealed to TDSAT within 60 days.
Penalty schedule under the DPDP Act
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)) | ₹250 crore |
| Failure to inform the Board or affected Data Principals of a personal data breach (Section 8(6)) | ₹200 crore |
| Breach of additional obligations for children's data (Section 9) | ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary (Section 10) | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of duties by a Data Principal (Section 15) | ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board (Section 32) | Up to the penalty for the original breach |
How the Data Protection Board decides the amount
The Board inquires into the breach and, if it finds a significant breach, decides a penalty up to the maximum. Under Section 33 it must consider:
- the nature, gravity and duration of the breach;
- the type and nature of the personal data affected;
- whether the breach was repeated;
- whether the organisation gained or avoided a loss from it;
- what the organisation did to reduce the harm, and how quickly and effectively;
- whether the penalty is proportionate and effective, and its likely impact on the organisation.
That means good records, fast breach response and visible remediation directly reduce the penalty you are likely to face.
Voluntary undertakings and appeals
During proceedings, an organisation can offer a voluntary undertaking to the Board, for example to take specific corrective steps. If the Board accepts it, proceedings on that matter can end; breaking the undertaking is itself penalised (Section 32). Board decisions can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (Section 29).
How to reduce your exposure
- Apply the Rule 6 security safeguards and keep evidence that you did.
- Have a tested breach plan so you can report within 72 hours.
- Handle children's data with verifiable parental consent and no tracking or targeted ads.
- Keep records: data inventory, consent logs, rights requests, training and erasure logs.
Not sure where you stand? Take the free DPDP Readiness Check.
Frequently asked questions
What is the highest penalty under the DPDP Act?
₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach.
Is the DPDP penalty per breach?
Penalties are imposed per instance of breach found by the Data Protection Board, up to the maximum in the Schedule for that type of breach. The Board considers gravity, duration, data affected and mitigation when deciding the amount.
Can individuals be fined under DPDP?
Yes, a Data Principal who breaches their duties under Section 15, for example by filing a false or frivolous complaint or impersonating someone, can be fined up to ₹10,000.
Can DPDP penalties be appealed?
Yes. Orders of the Data Protection Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.