Short Answer
DPDP penalties are tiered by violation: up to ₹250 crore for failing to prevent breaches, ₹200 crore for not notifying breaches, ₹200 crore for child-data violations, ₹150 crore for SDF obligations, and ₹50 crore for general non-compliance.
The Schedule to the DPDP Act lays out a tiered penalty framework administered by the Data Protection Board:
Up to ₹250 crore — failure to take reasonable security safeguards to prevent a personal data breach.
Up to ₹200 crore — failure to notify the Board and affected Data Principals about a breach.
Up to ₹200 crore — non-fulfilment of obligations toward children's data.
Up to ₹150 crore — non-fulfilment of Significant Data Fiduciary obligations.
Up to ₹50 crore — breach of any other DPDP provision.
Up to ₹10,000 — penalties on Data Principals who file false complaints or misuse rights.
Penalties are decided after inquiry and consider the nature, gravity, duration, repetitiveness, and gain or loss caused. Beyond financial impact, listed companies face reporting obligations, and brand trust damage can outweigh the fine itself.
Law Reference
Schedule to the DPDP Act, 2023
Section 33 – Penalties
Penalty exposure is per violation, not per organisation. Multiple parallel failures can compound rapidly. Boards now treat DPDP risk as a material disclosure item.
A fintech suffering a breach that affected 1M users could face the ₹250 crore (safeguards) and ₹200 crore (notification failure) tiers simultaneously if both obligations were missed.
Was this answer helpful?
Our team is here to help you with any questions about DPDP compliance.