The most a company can be fined under India’s DPDP Act is ₹250 crore, and that ceiling applies when it fails to maintain reasonable security safeguards and personal data is breached. It is a maximum, not a fixed fine: the Data Protection Board sets the amount after an inquiry, and not every duty is in force yet.
This guide lays out every penalty tier in the Act’s Schedule, explains how the Board decides an amount, and shows what organisations and individuals can do today. It is general information, not legal advice.
DPDP Act penalty amounts at a glance
The Schedule to the Digital Personal Data Protection Act, 2023 lists seven rows. Each states the highest penalty the Board may impose for that type of failure.
| Failure | Section | Maximum penalty |
|---|---|---|
| No reasonable security safeguards against a personal data breach | 8(5) | ₹250 crore |
| Not notifying the Board and affected individuals of a breach | 8(6) | ₹200 crore |
| Breaching children’s data obligations | 9 | ₹200 crore |
| Breaching extra duties of a Significant Data Fiduciary | 10 | ₹150 crore |
| Any other provision of the Act or Rules | Other | ₹50 crore |
| A data principal breaching their own duties | 15 | ₹10,000 |
| Breaching a voluntary undertaking accepted by the Board | 32 | Up to the amount applicable to the original breach |
Why ₹250 crore is a ceiling, not a fixed fine
The Schedule uses “may extend to” wording, so each figure is an upper limit. The Board imposes a penalty only after an inquiry and after giving the person a chance to be heard. When deciding the amount, Section 33(2) points the Board to factors such as:
- the nature, gravity and duration of the breach;
- the type and sensitivity of the personal data affected;
- whether the failure was repeated;
- any gain made or loss avoided;
- steps taken to reduce the harm, and how quickly;
- whether the penalty is proportionate and deters future breaches, including its financial impact on the person.
In practice, a small firm that had sensible controls and reacted fast is in a very different position from one that ignored warnings and hid an incident.
The penalties that matter most for businesses
₹250 crore: security safeguards
This is the top tier. Rule 6 sets out minimum safeguards, including encryption, masking or tokenisation, access control, logs and monitoring, backups, one-year retention of logs and data, and security terms in processor contracts. Our guide to AI agents under the DPDP Act shows how these controls look when software acts on personal data.
₹200 crore: breach notification and children’s data
Failing to inform the Board and affected people of a breach, or breaching children’s data duties, can each reach ₹200 crore. See DPDP breach notification and the 72-hour clock and DPDP parental consent for children’s data for the detail.
₹150 crore and ₹50 crore
Significant Data Fiduciaries, which are designated based on factors such as data volume and sensitivity, face extra duties such as audits and impact assessments, with penalties up to ₹150 crore. Everything else falls under the ₹50 crore catch-all.
Think about harm before the fine
A maximum penalty is a poor way to size a risk. A better board discussion starts with the harm to people if data is exposed. Leaked identity documents, health records and account details have different consequences and need different containment steps. For each scenario, name who owns the control, who runs the response, and when it was last rehearsed. That turns the fine into one input among several and points investment at the controls that actually reduce harm.
When do these penalties apply?
The DPDP Rules were notified in November 2025 with an 18-month phased timeline. The Data Protection Board framework started first, consent manager rules follow in mid-November 2026, and the remaining substantive duties, including security safeguards and breach intimation, begin in mid-May 2027. Sources report these dates with a one-day variation, so check the official notification. For a practical starting plan, read a beginner’s guide to implementing DPDP strategies.
What you can do today
If you run an organisation
- Map where personal data lives, including logs, backups and vendors.
- Check your controls against the Rule 6 list.
- Write and rehearse a breach response plan with named owners.
- Review processor contracts for security and incident-notice terms.
If you are an individual
- Ask apps that hold your data how they protect it.
- Keep a screenshot of what you consented to.
- Remember your own duty not to file false or frivolous complaints.
Frequently asked questions
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach. This is a ceiling set in the Act’s Schedule, not an automatic fine.
Is the DPDP penalty fixed at ₹250 crore?
No. The Schedule sets maximums. The Data Protection Board decides the actual amount after an inquiry, weighing factors such as the seriousness and duration of the breach, the type of data, repetition, mitigation and proportionality.
What is the penalty for not reporting a data breach?
Up to ₹200 crore for failing to notify the Data Protection Board and affected individuals, and up to ₹200 crore for breaching the children’s data obligations in Section 9.
Can an individual be penalised under the DPDP Act?
Yes, but only lightly. A data principal who breaches their own duties, for example by filing a false or frivolous complaint, can face a penalty of up to ₹10,000.
Are all DPDP penalties enforceable now?
Not yet. The Rules were notified in November 2025 with an 18-month phased timeline, and most substantive duties start in mid-May 2027. Sources differ by a day on the exact dates, so confirm against the official notification.
Conclusion
The DPDP Act’s headline number is ₹250 crore, but the real lesson is about preparation. Penalties are ceilings decided case by case, and the factors the Board weighs reward organisations that secure data, act quickly and cooperate. Build the controls and rehearse the response before the main duties begin in 2027.
Disclaimer: this article is general information, not legal advice. Consult a qualified lawyer for your specific situation.