DPDP Penalties Explained

Question

Accepted Answer

The Schedule to the DPDP Act lays out a tiered penalty framework administered by the Data Protection Board:

Up to ₹250 crore — failure to take reasonable security safeguards to prevent a personal data breach.

Up to ₹200 crore — failure to notify the Board and affected Data Principals about a breach.

Up to ₹200 crore — non-fulfilment of obligations toward children's data.

Up to ₹150 crore — non-fulfilment of Significant Data Fiduciary obligations.

Up to ₹50 crore — breach of any other DPDP provision.

Up to ₹10,000 — penalties on Data Principals who file false complaints or misuse rights.

Penalties are decided after inquiry and consider the nature, gravity, duration, repetitiveness, and gain or loss caused. Beyond financial impact, listed companies face reporting obligations, and brand trust damage can outweigh the fine itself.