Under section 33 and the Schedule of the DPDP Act, the Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to report a breach or for breaching children's obligations, ₹150 crore for SDF obligations and ₹50 crore for anything else. The penalty provisions apply from 13 May 2027.
Key takeaways
- The highest ceiling, ₹250 crore, is for failing to take reasonable security safeguards (section 8(5)).
- The Board fixes the amount after an inquiry and hearing, weighing the seven factors in section 33(2).
- Penalties go to the Consolidated Fund of India; individuals get no compensation under the Act.
- Appeals lie to TDSAT within 60 days, then to the Supreme Court.
- Fast mitigation, good evidence and a voluntary undertaking are your main levers to reduce exposure.
Penalties are usually the first thing a board asks about, and the DPDP numbers are large enough to get attention. They are also easy to misread. The amounts in the Schedule are ceilings, not tariffs; the Board must find a breach "significant" before it imposes anything; and the way you respond to an incident has a direct bearing on the outcome.
This guide sets out the amounts, how the Board decides them, the process from inquiry to appeal, and what you can do now to keep your exposure low.
How much are the penalties under the DPDP Act?
Section 33(1) lets the Board impose the monetary penalty specified in the Schedule. The Schedule ties each amount to a category of breach.
| Breach | Provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | s.8(5), Rule 6 | ₹250 crore |
| Failure to intimate a breach to the Board or affected Data Principals | s.8(6), Rule 7 | ₹200 crore |
| Breach of additional obligations for children | s.9, Rules 10 to 12 | ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary | s.10, Rule 13 | ₹150 crore |
| Breach of the duties of a Data Principal | s.15 | ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board | s.32 | Up to the penalty for the underlying breach |
| Breach of any other provision of the Act or Rules | Residuary | ₹50 crore |
The residuary ₹50 crore head is wider than it looks. It covers notice, consent, accuracy, erasure, rights, grievance redressal, processor contracts and cross-border conditions: everything not listed separately. Section 42 lets the government amend the Schedule by notification, but it cannot raise any penalty above twice the amount originally enacted.
A ceiling per breach
Each amount is a ceiling for a breach of that kind. A single incident can engage more than one head: weak access control (security, up to ₹250 crore) followed by a late or incomplete report (breach intimation, up to ₹200 crore). Whether the Board can add amounts for several breaches in one proceeding is not settled, and the Board will decide. For planning, do not assume it cannot.
An illustration
Suppose an exposed storage bucket leaks customer records, the team notices a week later, and nobody tells the affected customers. Three heads are potentially engaged: security safeguards (no access control or monitoring on the bucket, up to ₹250 crore), breach intimation (no notice to the Board or to individuals, up to ₹200 crore) and, if the records included children's data processed without parental consent, children's obligations (up to ₹200 crore). The Board would then apply the section 33(2) factors. Each figure is a ceiling, not an expected amount, and whether amounts under different heads can be added together is not settled. The same leak, caught by monitoring within hours, contained quickly and reported in line with Rule 7, presents a very different picture on gravity, duration and mitigation.
How does the Board decide the amount?
Section 33(1) requires two things before any penalty: an inquiry that concludes the breach is significant, and an opportunity for the person to be heard. Section 33(2) then lists what the Board must weigh when fixing the amount.
How serious the breach was and how long it lasted
Financial, health or children's data is likely to weigh more than a mailing list
Whether this has happened before
Whether the organisation benefited from the breach
Action taken to limit the effects, and how timely and effective it was
Whether the amount is proportionate and effective in securing compliance
The likely effect of the penalty on the person paying it
Several of these factors are within your control after an incident. Mitigation and its timeliness (factor 5) and repetition (factor 3) depend directly on how well your security and incident response work. The proportionality factor (6) and impact factor (7) mean the Board must look at the organisation in front of it, so, in our reading, a small company is unlikely to face the same amount as a large platform for a similar breach.
What does the penalty process look like?
A matter reaches the Board through a breach intimation, a complaint from a Data Principal (after she has used your grievance process), a reference from the Central or a State Government, or a court direction (section 27). From there:
Intimation, complaint, reference or direction
Six months, extendable by three
Settle on agreed terms
Penalty up to the Schedule limit
TDSAT, then Supreme Court
Voluntary undertakings
Section 32 lets the Board accept a voluntary undertaking from any person at any stage of a proceeding. An undertaking can commit you to take, or stop taking, specific action within a set time, and can include publicising it. Once accepted, it bars further proceedings on its contents. If you then fail to keep it, that failure is itself a breach, punishable up to the amount for the underlying breach. Treat an undertaking as a serious commitment, not a way out.
Appeals
Anyone aggrieved by a Board order can appeal to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (section 29). TDSAT aims to dispose of appeals within six months, and its orders can be appealed to the Supreme Court. Rule 22 requires appeals to be filed digitally.
Blocking under section 37
The heaviest sanction is not a penalty. If the Board has imposed penalties on a Data Fiduciary in two or more instances, it can advise the government, in the interests of the general public, to block public access to the platform that the fiduciary uses to offer goods or services in India. The government must give the fiduciary a hearing first. For a consumer app, this is a bigger risk than any single penalty.
Can individuals claim compensation?
No. Penalties under the Act are credited to the Consolidated Fund of India (section 34), and there is no route for an affected individual to claim compensation under the DPDP Act. Section 43A of the Information Technology Act, which allowed compensation claims, is omitted by section 44(2) from 13 May 2027. Until that date it still applies. After it, individuals' remedy is a complaint to the Board, after first using your grievance process. Other laws, such as contract or consumer law, are outside the scope of this guide; your counsel can advise on them.
When do the penalties start?
Sections 28 to 34, including section 33, commence on 13 May 2027, together with the obligations they enforce. The Board was established on 13 November 2025 but, as of early November 2026, has no Chairperson or Members. A proposal to bring the date forward to 12 months after notification has not been adopted. See the enforcement date guide for the full timeline.
That gives you about six months. Remember that CERT-In's six-hour cyber incident reporting and sectoral regulators' rules apply now and continue after 13 May 2027.
How can you reduce your exposure?
Read the section 33(2) factors as a design brief. Each one points to a control you can build now.
- Close the ₹250 crore gap first. Rule 6 sets the minimum: encryption or masking, access control, logging and monitoring, backups, one-year log retention, processor contract clauses. Being able to show these were in place before an incident is likely to be your strongest position. See security safeguards.
- Make breach intimation routine. Every breach is reportable, so build a runbook that produces the Rule 7 content for the Board and for individuals without debate. See breach notification.
- Treat children's data as high risk. If minors use your service, get parental consent and remove tracking and targeted ads for them. See children's data.
- Keep evidence. Section 6(10) puts the burden of proving notice and consent on you. Logs, consent records and decision records speak to gravity, duration and mitigation.
- Fix root causes. Repetition is a listed factor and two penalties open the door to blocking.
- Handle grievances well. Complaints reach the Board only after your own process. A grievance resolved well within your published period is less likely to become a complaint to the Board.
Processors do not carry your risk
Under section 8(1) the Data Fiduciary is responsible for processing by its processors, whatever the contract says. An indemnity can move money after the fact, but the penalty is imposed on you.
What to do next
- Rank your processing by penalty head: security, breach intimation, children, then the residuary obligations.
- Run a Rule 6 gap assessment and fund the highest-risk fixes first.
- Write and rehearse a breach runbook that meets Rule 7 and CERT-In.
- Set up grievance handling with a published period of no more than 90 days.
- Track progress with the compliance checklist and the implementation roadmap.
We are an implementation team of engineers and security and privacy practitioners who work alongside your legal counsel. If you want help closing the high-penalty gaps before 13 May 2027, contact us.
Frequently asked questions
What is the maximum penalty under the DPDP Act?
₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach (section 8(5)). The Schedule sets this as a ceiling per breach; the Board decides the actual amount using the section 33(2) factors.
Which section of the DPDP Act deals with penalties?
Section 33 empowers the Board to impose penalties and lists the factors it must consider. The amounts are in the Schedule to the Act. Section 34 sends penalties to the Consolidated Fund of India, and section 42 lets the government amend the Schedule, but not above twice the original amounts.
When can DPDP penalties be imposed?
Sections 28 to 34, including the penalty provision, commence on 13 May 2027. Before that the Board cannot impose DPDP penalties on Data Fiduciaries, and as of 13 November 2026 it has no Chairperson or Members.
Do individuals get compensation under the DPDP Act?
No. Penalties go to the Consolidated Fund of India. Section 43A of the IT Act, which allowed compensation claims, is omitted from 13 May 2027.
Can the Board fine a company more than ₹250 crore?
The Schedule sets a ceiling for each breach. Whether the Board can add up amounts for several distinct breaches in one case is not settled. Plan on the basis that a serious incident could involve more than one head, for example security and breach intimation.
What is the penalty for a Data Principal under DPDP?
Up to ₹10,000 for breaching the duties in section 15, such as impersonating someone, suppressing material information or filing a false or frivolous complaint.
Can a DPDP penalty be appealed?
Yes. Any person aggrieved by a Board order can appeal to TDSAT within 60 days (section 29). TDSAT aims to dispose of appeals within six months, and a further appeal lies to the Supreme Court.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.