Under the DPDP Act, a business can be fined up to ₹250 crore for failing to take reasonable security safeguards that leads to a data breach, up to ₹200 crore for not reporting a breach or breaching children's data rules, up to ₹150 crore for breaching Significant Data Fiduciary duties, and up to ₹50 crore for any other breach. Penalties are civil and decided by the Data Protection Board of India.
- Highest penalty
- ₹250 crore
- Breach not reported
- Up to ₹200 crore
- Any other breach
- Up to ₹50 crore
- Appeal to
- TDSAT, within 60 days
Penalty schedule
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)) | ₹250 crore |
| Failure to notify the Board and affected individuals of a personal data breach (Section 8(6)) | ₹200 crore |
| Breach of obligations for children's data (Section 9) | ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary (Section 10) | ₹150 crore |
| Breach of a voluntary undertaking accepted by the Board (Section 32) | Up to the penalty for the underlying breach |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of duties by an individual (Section 15), e.g. a false complaint | ₹10,000 |
How the Board decides the amount
Under Section 33(2), the Data Protection Board considers:
- the nature, gravity and duration of the breach;
- the type and nature of the personal data affected;
- whether the breach is repetitive;
- any gain made or loss avoided by the business;
- action taken to mitigate the effects, and how timely and effective it was;
- whether the penalty is proportionate and effective; and
- the likely impact of the penalty on the business.
Ways to reduce exposure
- Voluntary undertaking (Section 32). A business can offer the Board an undertaking to take specific steps; if accepted, proceedings on that matter stop, unless the undertaking is breached.
- Prompt breach reporting. Failing to report can cost up to ₹200 crore on its own, on top of the security penalty.
- Documented safeguards. Evidence of reasonable security (Rule 6) is the main defence to the ₹250 crore head.
Penalties go to the government (the Consolidated Fund of India), not to affected individuals. Appeals against Board orders lie to TDSAT within 60 days.
Frequently asked questions
Is the ₹250 crore DPDP penalty per breach?
The Schedule sets a maximum per instance of breach of each provision. The Board decides the actual amount after an inquiry, using the factors in Section 33(2).
Is there jail time under the DPDP Act?
No. The DPDP Act provides only civil monetary penalties. Other laws, such as the IT Act or the Bharatiya Nyaya Sanhita, may apply to criminal acts like hacking or data theft.
Can directors be personally fined under the DPDP Act?
The penalties are imposed on the Data Fiduciary or Data Processor (the business). The Act does not have a separate head of penalty for directors.
Can individuals be fined under the DPDP Act?
Yes, up to ₹10,000, for breaching their duties under Section 15, such as filing a false or frivolous complaint or impersonating someone.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.