Short answer: The DPDP Act sets maximum monetary penalties for each type of breach, from up to ₹250 crore for failing to take reasonable security safeguards to up to ₹50 crore for breaches of any other provision (Schedule). The Board imposes them after an inquiry finds a breach significant (s.33(1)). The penalty provisions take effect on 13 May 2027.
How do penalties work under the DPDP Act?
Penalties under the DPDP Act are monetary amounts the Data Protection Board may impose, up to the maximums in the Schedule, after an inquiry finds that a breach of the Act or Rules by a person is significant and after giving that person a hearing (s.33(1), Schedule).
- Schedule: the table at the end of the Act listing the maximum penalty for each type of breach.
- Data Protection Board of India: the body that inquires and imposes penalties, established on 13 November 2025 (G.S.R. 844(E)).
What are the maximum penalties under the DPDP Act?
The maximum penalties range from ₹10,000 for a Data Principal's breach of her duties to ₹250 crore for a Data Fiduciary's failure to take reasonable security safeguards (Schedule).
| Item | Breach | Maximum penalty |
|---|---|---|
| 1 | Failure to take reasonable security safeguards to prevent a personal data breach (s.8(5)) | ₹250 crore |
| 2 | Failure to notify the Board or affected Data Principals of a personal data breach (s.8(6)) | ₹200 crore |
| 3 | Breach of additional obligations relating to children (s.9) | ₹200 crore |
| 4 | Breach of additional obligations of Significant Data Fiduciaries (s.10) | ₹150 crore |
| 5 | Breach of duties of Data Principals (s.15) | ₹10,000 |
| 6 | Breach of a voluntary undertaking accepted by the Board (s.32) | Up to the amount applicable to the breach for which proceedings under s.28 were instituted |
| 7 | Breach of any other provision of the Act or Rules | ₹50 crore |
Item 7 is the catch-all. Interpretation: it would cover obligations that have no item of their own, such as notice, consent, rights and grievance handling.
How does the Board decide the amount?
The Board must consider the factors in s.33(2) when deciding the amount:
- the nature, gravity and duration of the breach
- the type of personal data affected
- whether the breach is repetitive
- any gain realised or loss avoided as a result of the breach
- any action taken to mitigate its effects, and how timely it was
- whether the penalty is proportionate and acts as a deterrent
- the likely impact of the penalty on the person
Penalties are paid into the Consolidated Fund of India (s.34).
How long does a Board inquiry take?
The Board must complete an inquiry within six months of receiving the intimation or complaint, extendable by up to three months at a time (Rule 19(9)). Appeals against Board orders lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) (s.29, Rule 22).
Can the penalty amounts change?
Yes, within a limit. The Central Government may amend the Schedule by notification, but cannot raise any penalty to more than twice the amount specified when the Act was enacted (s.42(1)).
Are there criminal penalties?
Interpretation: the Act contains no criminal offences. Chapter VIII provides only monetary penalties, so penalties under the DPDP Act are civil.
When can penalties first be imposed?
Sections 28 to 34, covering Board procedure, appeals and penalties, take effect on 13 May 2027 (G.S.R. 843(E)).
- Interpretation: until 13 May 2027, s.43A of the IT Act and its 2011 rules on sensitive personal data continue to apply, because s.44(2) of the DPDP Act, which omits s.43A, has not yet commenced.
- Whether any Board enforcement is possible before 13 May 2027 is listed as an open question in our research.
- As of MeitY's Lok Sabha answer of 12 August 2026, no Board member appointment had been reported. See the timeline.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider prioritising the highest-penalty items first: security safeguards, breach notification and, if you have users under 18, children's data.
- A common approach is to keep evidence of mitigation and response, since s.33(2) weighs mitigation and its timeliness.
- Consider documenting decisions and remediation, which can help show proportionality if an inquiry arises.
- Note that a single incident can engage more than one item, such as weak security (item 1) and late notification (item 2).
- Track readiness across all obligations in the readiness checklist.