DPDP Act Penalties
Complete Guide to Fines Up to Rs.250 Crore
The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces India’s most consequential data protection penalty regime. With fines reaching Rs.250 crore for security failures and Rs.200 crore for breach notification failures, the DPDP Act penalty schedule demands attention from every Indian company that processes personal data — which is effectively every company with a digital footprint.
This guide breaks down all seven penalty tiers prescribed in the DPDP Act Schedule, with the exact section reference, what triggers each penalty, who is at risk, and a realistic scenario illustrating how each violation materialises in practice. By Advocate Subodh Bajpai, Senior Partner at Unified Chambers and Associates.
All 7 DPDP Penalty Tiers — Quick Reference
Penalty Tiers — Triggers, Risk Profiles, and Scenarios
Tier 1: Section 8(5)
Up to Rs.250 CroreWho’s at Risk: Every Data Fiduciary processing personal data without adequate encryption, access controls, or breach detection systems
Scenario: A fintech company stores customer Aadhaar numbers and bank details in an unencrypted database. A SQL injection attack exposes 5 million records. The company had no web application firewall, no intrusion detection system, and no encryption at rest. The Data Protection Board finds the security safeguards were not "reasonable" given the sensitivity and volume of data processed.
Tier 2: Section 8(6)
Up to Rs.200 CroreWho’s at Risk: Any Data Fiduciary that discovers a breach but conceals it or delays notification beyond the prescribed timeline
Scenario: An e-commerce platform discovers that a third-party vendor had unauthorised access to 2 million customer profiles for 6 months. The platform quietly patches the vulnerability but does not notify the Data Protection Board or the affected customers. A whistleblower reports the breach 3 months later. The Board imposes penalty for non-notification.
Tier 3: Section 9
Up to Rs.200 CroreWho’s at Risk: EdTech platforms, gaming apps, social media companies, and any Data Fiduciary processing data of persons under 18
Scenario: A popular gaming app collects location data, device identifiers, and behavioural profiles of users under 14 without verifiable parental consent. The app uses this data for targeted advertising. The Board finds violations of Section 9(1) (no verifiable consent of parent/guardian) and Section 9(2) (tracking and behavioural monitoring of children).
Tier 4: Section 10
Up to Rs.150 CroreWho’s at Risk: Large technology companies, social media platforms, and enterprises designated as SDFs by the Central Government based on volume and sensitivity of data processed
Scenario: A social media platform designated as a Significant Data Fiduciary fails to appoint a Data Protection Officer based in India, does not conduct the mandatory Data Protection Impact Assessment before launching a new AI-driven content recommendation feature, and fails to submit the periodic audit report to the Board.
Tier 5: Section 15
Up to Rs.10,000Who’s at Risk: Individuals who misuse the complaint mechanism — filing false breach complaints or providing fabricated evidence to the Board
Scenario: An individual files a complaint with the Data Protection Board claiming a bank processed their data without consent. During the inquiry, it is established that the individual had explicitly consented to the processing through a signed loan agreement and knowingly filed a false complaint to pressure the bank into waiving a loan obligation.
Tier 6: Section 32
VariableWho’s at Risk: Any Data Fiduciary that offers a voluntary undertaking to the Board during proceedings but fails to comply with the committed actions
Scenario: A social media company facing a complaint for children's data violation offers a voluntary undertaking to implement verifiable parental consent within 90 days. The Board accepts the undertaking and defers penalty. The company fails to implement the system within the committed timeline. The Board can now impose the penalty applicable for the underlying Section 9 breach — up to Rs.200 crore.
Tier 7: Any other provision
Up to Rs.50 CroreWho’s at Risk: Any Data Fiduciary that collects data without valid consent, uses data beyond stated purpose, retains data longer than necessary, fails to establish a grievance mechanism, or transfers data to restricted countries
Scenario: A hospital collects patient health records for treatment (legitimate purpose) but shares the data with a pharmaceutical marketing company without separate consent. The hospital also retains records of discharged patients indefinitely without a retention policy, and has no grievance redressal officer. Multiple violations established under this catch-all tier.
How the Data Protection Board Enforces Penalties
The Data Protection Board of India (DPB) is the sole adjudicatory body for DPDP Act penalties. Established under Section 18, the Board functions as an independent tribunal with the power to conduct inquiries, issue directions, and impose monetary penalties up to the Schedule ceilings. Unlike courts, the Board is designed for digital-first adjudication — Section 20 mandates that proceedings be conducted through a digital office with virtual hearings as the default.
Penalty proceedings can be initiated upon a complaint by a Data Principal, a reference from the Central or State Government, or suo motu by the Board when it has reason to believe a breach has occurred. The Board must follow principles of natural justice — the data fiduciary must be given notice, an opportunity to present its case, and the right to examine evidence before any penalty is imposed. The Board is required to dispose of complaints within a reasonable time, though the Act does not prescribe a specific timeline.
Appeals against Board orders lie with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) under Section 29, which must be filed within 60 days. TDSAT is an established appellate body with experience in regulatory penalty adjudication. A further appeal on questions of law can be preferred to the Supreme Court of India. This appellate structure ensures that Board penalty decisions are subject to adequate judicial review.
The Board also has the power to accept voluntary undertakings from data fiduciaries, potentially offering a mechanism for companies to avoid full penalty exposure through proactive remediation. However, the specifics of this mechanism will depend on the rules framed under the Act and the Board’s practice directions once it becomes operational.
DPDP vs GDPR — Penalty Comparison
The key difference: GDPR’s turnover-based penalty means a company like Meta can face fines exceeding EUR 1 billion, while the DPDP Act caps penalties at Rs.250 crore regardless of company size. For large multinationals, the DPDP ceiling may be less deterrent than GDPR. For Indian SMEs, however, Rs.250 crore is an existential threat. The penalty regime is designed to be proportionate to the Indian market context.
Immediate Action Items for Companies
Map Your Data
Conduct a comprehensive data mapping exercise. Identify every category of personal data your organisation collects, the purpose of collection, legal basis (consent or legitimate use), storage location, retention period, and third parties with whom it is shared. Without a data map, compliance is impossible and breach response is blind.
Implement Security Safeguards
The Rs.250 crore penalty targets security failures. Deploy encryption at rest and in transit, implement role-based access controls, conduct regular vulnerability assessments, deploy intrusion detection systems, and establish a Security Operations Centre (SOC) or contract with a managed security service provider. Document everything — the Board will evaluate whether your safeguards were "reasonable" relative to the sensitivity and volume of data processed.
Build Breach Notification Infrastructure
The Rs.200 crore penalty targets notification failures. Establish a breach response team, define notification templates for the Board and affected individuals, establish escalation workflows, and conduct tabletop exercises simulating breach scenarios. When a breach occurs, you need to notify within the prescribed timeline — not scramble to figure out who to call.
Operationalise Consent Management
The Rs.50 crore penalty covers consent violations. Implement a consent management platform that records granular, specific, informed consent with timestamps. Ensure users can withdraw consent as easily as they gave it. Map consent records to data processing activities so you can demonstrate compliance on demand.
Engage Specialised Legal Counsel
DPDP compliance is not a checkbox exercise. Engage lawyers experienced in Indian data protection law to audit your current practices, draft compliant privacy policies, establish data processing agreements with vendors, and prepare for Board inquiries. The cost of compliance is a fraction of the cost of a Rs.250 crore penalty.
DPDP Act Penalties — Questions Answered
What is the maximum penalty under the DPDP Act 2023?
Can individuals be personally penalised under the DPDP Act?
How does the Data Protection Board decide the penalty amount?
Are DPDP penalties per-incident or cumulative?
When will DPDP Act penalties actually be enforced?
Can a company appeal a DPDP penalty order?
Facing DPDP Compliance Pressure?
Penalties up to Rs.250 crore demand proactive compliance. Unified Chambers advises corporates on DPDP readiness, breach response, and Data Protection Board proceedings. Advocate Subodh Bajpai available directly.