What are the maximum penalties under the DPDP Act 2023?

The DPDP Act 2023 Schedule specifies per-instance caps: up to Rs 250 crore for security safeguard failures, Rs 200 crore for breach notification failures, Rs 200 crore for children's data violations, Rs 150 crore for Significant Data Fiduciary obligation failures, and Rs 50 crore for other violations including consent, purpose limitation, and data principal rights.

Are DPDP Act penalties revenue-based or fixed?

DPDP Act penalties are fixed per-instance caps, not a percentage of revenue. The Data Protection Board has discretion to impose amounts below the maximum based on the nature, gravity, and duration of the violation.

Who enforces DPDP Act penalties in India?

Penalties are adjudicated by the Data Protection Board of India (DPBI), established under Section 18 of the DPDP Act 2023. The Board operates as a digital-first, complaint-driven adjudicatory body.

Free Tool

DPDP Act Penalty Calculator

Estimate your organisation's maximum penalty exposure under the Digital Personal Data Protection Act, 2023. Select your violation categories for an instant calculation.

Company Size

Data Subjects

Industry

Select applicable violation categories

Security Safeguard FailureSchedule, Item 1

Rs 250 Cr

Breach Notification FailureSchedule, Item 2

Rs 200 Cr

Children's Data ObligationsSchedule, Item 3

Rs 200 Cr

Other ProvisionsSchedule, Item 4

Rs 50 Cr

Choose your company size and at least one violation category.

Section 33 Schedule

DPDP Act Penalty Tiers

Rs 250 Cr

Security Safeguard Failure

Section 8(5)

Failure to implement reasonable security safeguards resulting in a personal data breach.

Rs 200 Cr

Breach Notification Failure

Section 8(6)

Failure to notify the Data Protection Board and affected data principals of a breach.

Rs 200 Cr

Children's Data Obligations

Section 9

Non-compliance with verifiable parental consent or children's data processing safeguards.

Rs 150 Cr

Significant Data Fiduciary Obligations

Section 10

Failure to meet the additional obligations of a Significant Data Fiduciary, including DPO appointment, data protection impact assessment, and independent audit.

Rs 50 Cr

Other Provisions

Schedule, residual entry

Consent obligations, purpose limitation, retention limits, or data principal rights.

Penalties are per-instance maximums with a fixed-cap model. Unlike GDPR, which calculates fines as a percentage of global turnover, the DPDP Act applies the same ceiling regardless of company size. The Data Protection Board retains full discretion over the actual amount imposed.