India DPDP Enforcement Tracker
DPDP Act enforcement begins May 2027. This tracker covers the precedent-setting cases under IT Act 2000, CERT-In, RBI/IRDAI regulatory notices, and equivalent GDPR decisions that frame the penalty norms Indian businesses will face.
15
Cases tracked
8
Indian cases
8
Penalties imposed
May 2027
DPDP enforcement
Pre-enforcement context
The DPDP Act 2023 creates enforceable obligations from May 2027. The cases below establish the regulatory landscape and penalty norms. Indian regulators (CERT-In, RBI, IRDAI, SEBI) have already taken enforcement action on data handling failures under existing frameworks. GDPR decisions provide the most comparable penalty scale and violation typology. Each case includes the equivalent DPDP Act section it would be prosecuted under once the Act is enforceable.
BigBasket
Investigation closed India2020
Customer database (20M accounts) exposed via unsecured MongoDB instance. Data included names, email addresses, delivery addresses, phone numbers, and hashed passwords.
DPDP Act equivalent
Section 8(5) — adequate security safeguards
JusPay
Investigation closed India2021
Payment processing infrastructure breach exposed masked card data and merchant transaction metadata for approximately 100 million users.
DPDP Act equivalent
Section 8(5) + Section 8(6) — security safeguards and breach notification
MobiKwik
Investigation closed India2021
8.2TB of user data including KYC documents, Aadhaar copies, PAN cards, and card details made available on darknet. CERT-In investigation launched. Company disputed scale of breach.
DPDP Act equivalent
Section 8(5) + Section 8(6) + Section 5 — security, breach notification, and purpose limitation
Domino's India (Jubilant Foodworks)
Investigation closed India2021
180 million order records including customer names, phone numbers, email addresses, delivery addresses, and approximately 1 million credit card records exposed and indexed on a searchable dark web portal.
DPDP Act equivalent
Section 8(5) — adequate security safeguards; Section 8(7) — data erasure obligations
Air India
Investigation closed India2021
Data breach via SITA passenger system compromised 4.5 million Air India frequent flyer records including passport numbers, credit card data, date of birth, and ticket information.
DPDP Act equivalent
Section 8(5) + Section 8(6) — security obligations and 72-hour breach notification
Upstox
Investigation closed India2021
KYC data of 2.5 million customers reportedly compromised via third-party data warehouse breach. CERT-In notice issued. Data included contact details, bank account information, and identity documents.
DPDP Act equivalent
Section 8(5) + Section 10 — processor obligations and sub-processor chain security
AIIMS Delhi
Investigation closed India2022
Ransomware attack on hospital servers affected an estimated 3-4 crore patient records. Hospital services were disrupted for over two weeks. CERT-In and NCIIPC investigated.
DPDP Act equivalent
Section 8(5) + Section 8(6) + Section 11 — security, breach notification, and health data obligations
Equitas Small Finance Bank
Penalty imposed India₹10,00,000
2023
RBI imposed monetary penalty for non-compliance with Know Your Customer (KYC) directions including deficiencies in data handling, customer record maintenance, and periodic KYC update procedures.
DPDP Act equivalent
Section 8(3) — data accuracy and completeness obligations
British Airways
Penalty imposed£20,000,000
2020
Attackers harvested payment card data and personal details of approximately 500,000 customers via a skimming script injected into the booking website. ICO investigation found inadequate security testing and authentication.
DPDP Act equivalent
Section 8(5) — analogous to Indian aviation data handlers such as IndiGo, SpiceJet, Vistara customer systems
H&M (Hennes & Mauritz)
Penalty imposed€35,258,708
2020
Extensive secret surveillance of employees' personal lives at service centre in Nuremberg. Records included health conditions, family circumstances, religious beliefs, and private life details. Records were accessible to 50+ managers.
DPDP Act equivalent
Section 4 + Section 9 — analogous to Indian HR platforms maintaining employee wellness, background verification, or performance records
Facebook / Meta
Penalty imposed€265,000,000
2022
Scraped personal data of 533 million Facebook users made available on a hacking forum. Data included phone numbers, full names, dates of birth, email addresses, and biographical information. DPC found inadequate technical and organisational measures.
DPDP Act equivalent
Section 8(5) — analogous to Indian social platforms and any data fiduciary maintaining large-scale public profile data
Amazon
Penalty imposed€746,000,000
2021
Processing of personal data for targeted advertising without sufficient legal basis or transparency. Decision held that Amazon tracked browsing and purchase behaviour for advertising without meeting the specificity and informed-consent requirements.
DPDP Act equivalent
Section 6 + Section 7 — analogous to Indian e-commerce and D2C platforms using behavioural advertising without specific per-purpose consent
Equifax (UK)
Penalty imposed£500,000
2018
Data of 15 million UK individuals processed by Equifax Inc. without adequate oversight of its US-based data processor. ICO found failures in security controls and data governance of cross-border transfers.
DPDP Act equivalent
Section 10 + Section 16 — analogous to Indian credit bureaus (CIBIL, Experian India, CRIF High Mark) and their cross-border data processing arrangements
Clearview AI
Penalty imposed€20,000,000 (Italy) + £7.5M (UK)
2022
Scraped biometric data of billions of individuals from public sources to build facial recognition database, without consent and without lawful basis. Multiple national DPAs imposed parallel penalties.
DPDP Act equivalent
Section 4 + Section 6 — analogous to any Indian entity processing biometric data at scale, relevant for financial sector KYC and attendance systems
Marriott International
Penalty imposed£18,400,000
2020
Starwood guest reservation database breach affecting up to 339 million guest records including passport numbers, payment card data, and contact details. Breach began pre-merger with Marriott and was undetected for four years.
DPDP Act equivalent
Section 8(5) + Section 8(6) + Section 12(3) — analogous to Indian hotel chains, OTAs (MakeMyTrip, Goibibo), and travel platforms
No cases match the selected filters.
Upcoming DPDP Enforcement Milestones
November 2026
Consent Manager registration window opens
The Data Protection Board of India begins accepting registrations from Consent Manager applicants. Only India-incorporated entities qualify. Foreign platforms (OneTrust, TrustArc, CookieYes) are ineligible.
Q1 2027
First batch of CM registrations expected
Registered Consent Managers will be published on the DPBI portal. Organisations appointing unregistered consent managers post-enforcement will face Section 33 exposure.
May 2027
DPDP Act enforcement begins
The Data Protection Board begins accepting complaints and initiating suo motu actions. Penalties under Section 33 range from Rs. 50 crore (data principal rights violations) to Rs. 250 crore (Significant Data Fiduciary failures). No maximum on aggregate penalties for systemic violations.
Ensure your organisation is not on the next version of this tracker.
ConsentOS deploys the five compliance modules required under the DPDP Act in 30 days. Data inventory, signed consent records, privacy notice, DSR portal, and Legal Obligation Override for regulated-sector conflicts.