Sections 27 to 33
DPDP penalty chapters in detail
A provision-by-provision walk-through for legal, compliance and DPO teams: each Schedule item, how a penalty is reached, voluntary undertakings and appeals.
Short answer
The Data Protection Board may impose a penalty only after an inquiry (s.27, s.28) and a hearing, up to the maximum the Schedule sets for each item, from ₹10,000 to ₹250 crore. In deciding the amount it weighs the s.33(2) factors, such as the nature, gravity and duration of the breach and any mitigation. Breaching a voluntary undertaking accepted under s.32 is itself penalised, and appeals go to the Appellate Tribunal (TDSAT) under s.29. No Board members have been appointed yet.
The Schedule, item by item
| Item | Provision | What the duty requires | Maximum |
|---|---|---|---|
| 1 | s.8(5) | Reasonable security safeguards to prevent a personal data breach, with the Rule 6 minimums | Up to ₹250 crore |
| 2 | s.8(6) | Intimating the Board and each affected Data Principal of a breach, as Rule 7 sets out | Up to ₹200 crore |
| 3 | s.9 | Verifiable consent of a parent or lawful guardian; no detrimental processing; no tracking, behavioural monitoring or targeted advertising directed at children | Up to ₹200 crore |
| 4 | s.10 | Additional obligations of a Significant Data Fiduciary: DPO, independent data auditor, DPIA, data audit | Up to ₹150 crore |
| 5 | s.15 | Duties of a Data Principal | Up to ₹10,000 |
| 6 | s.32 | Terms of a voluntary undertaking accepted by the Board | Up to the amount applicable to the breach it covered |
| 7 | Any other provision | Any other provision of the Act or the Rules, such as notice, consent or grievance redressal | Up to ₹50 crore |
Each figure is a maximum per instance. The Board sets the actual amount after an inquiry.
How a penalty is reached
- 01A matter reaches the Board
For example, through a Data Principal's complaint. A Data Principal must first exhaust the fiduciary's or Consent Manager's grievance redressal (s.13(3)).
- 02The Board inquires
The Board inquires into the matter (s.27, s.28).
- 03A hearing is given
The person concerned is given an opportunity to be heard before any penalty.
- 04The Board decides
The Board may impose a penalty up to the Schedule maximum, weighing the s.33(2) factors (s.33).
- 05Appeal
A person aggrieved by the Board's order may appeal to the Appellate Tribunal, TDSAT (s.29, Rule 22).
No Board members have been appointed yet. There are no DPDP penalty orders, cases or averages, and this page does not invent any.
The s.33(2) factors and the evidence that speaks to them
| Factor in s.33(2) | Evidence worth keeping |
|---|---|
| Nature, gravity and duration of the breach | An incident timeline from awareness to containment |
| Type of personal data affected | The data classes held in the affected systems |
| Whether the breach is repeated | Past incidents and the fixes made after each |
| Whether the person gained, or avoided a loss, from the breach | Records of what the processing was for |
| Mitigation, and how timely and effective it was | Intimation records, containment steps and remediation |
| Whether the penalty is proportionate and effective | The controls in place before the breach |
| Likely impact of the penalty on the person | Context about your organisation the Board may need |
The evidence column is practical guidance, not a statutory list.
Voluntary undertaking (s.32)
Section 32 provides for a voluntary undertaking that the Board may accept from a person. Once accepted, its terms matter: breaching them is item 6 of the Schedule, with a maximum equal to the amount applicable to the breach the undertaking covered.
Whether to offer an undertaking, and on what terms, is a decision to take with counsel.
Appeal to the Appellate Tribunal (s.29, Rule 22)
Appeals against Board orders go to the Appellate Tribunal, which under s.29 is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Rule 22, which deals with appeals, starts on 13 May 2027.
Rules 17 to 21 on the Board's appointment, meetings and digital office have applied since 13 November 2025, but no members have been appointed. The plain-English penalties page gives the executive summary.
How TruePrivacy helps
| Schedule item | Controls that reduce exposure | In TruePrivacy |
|---|---|---|
| 1: s.8(5) | Encryption or masking, access control, logs, backups (Rule 6) | Data security posture, DSPM endpoint agent |
| 2: s.8(6) | A Rule 7 runbook, both intimations, the 72-hour report | Breach management |
| 3: s.9 | Verifiable parental consent; no tracking of children | Children's data |
| 4: s.10 | DPO, auditor, yearly DPIA and data audit | SDF workspace |
| 7: other provisions | Notices, consent records, rights and grievances | Consent, rights requests, grievances |
The penalty explainer maps common failures to these items.
Is a DPDP penalty per breach or per company?
The Schedule sets a maximum for each instance of breach. The Board decides the amount after an inquiry, weighing the s.33(2) factors.
Does the Board have to give a hearing before a penalty?
Yes. The Board inquires into the matter and may impose a penalty only after giving the person an opportunity to be heard.
What is a voluntary undertaking under s.32?
An undertaking a person gives that the Board may accept. Breaching an accepted undertaking can attract a penalty up to the amount applicable to the breach it covered.
Where are Board orders appealed?
To the Appellate Tribunal, the Telecom Disputes Settlement and Appellate Tribunal (s.29, Rule 22).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin