FAQ
DPDP penalties FAQ
What the Schedule to the DPDP Act sets, how a penalty would be decided, and where the Board stands today.
Short answer
The Schedule to the DPDP Act, 2023 sets maximum penalties per instance, from up to ₹10,000 for breach of a Data Principal's duties to up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. The Board decides the amount after an inquiry, considering the factors in s.33(2). As of 4 November 2026, no Board members have been appointed, so no DPDP penalty has been imposed.
Maximum penalties in the Schedule
| Breach | Maximum per instance |
|---|---|
| s.8(5) failure to take reasonable security safeguards to prevent a personal data breach | Up to ₹250 crore |
| s.8(6) failure to intimate the Board or affected Data Principals of a breach | Up to ₹200 crore |
| s.9 additional obligations for children | Up to ₹200 crore |
| s.10 additional obligations of an SDF | Up to ₹150 crore |
| s.15 duties of a Data Principal | Up to ₹10,000 |
| Breach of a voluntary undertaking accepted under s.32 | Up to the amount applicable to the breach it covered |
| Any other provision of the Act or Rules | Up to ₹50 crore |
As of 4 November 2026, no Board members have been appointed, so there are no Board orders, fines or cases to cite. Treat any “average penalty” figure with suspicion.
All questions
Educational, not legal advice.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore per instance, for failing to take reasonable security safeguards to prevent a personal data breach (s.8(5)). See DPDP penalties.
What is the penalty for not reporting a breach?
Up to ₹200 crore for failing to intimate the Board or affected Data Principals of a breach (s.8(6)). Rule 7 sets the steps; see Rule 7.
What is the penalty for breaching children's data obligations?
Up to ₹200 crore for breach of the additional obligations in s.9. See children's data under section 9.
What can a Significant Data Fiduciary be fined?
Up to ₹150 crore for breach of the additional obligations of an SDF in s.10. See Significant Data Fiduciary.
Can a Data Principal be penalised?
Yes. Breach of the duties of a Data Principal in s.15 carries a maximum of ₹10,000.
What about other breaches of the Act or Rules?
Any other provision carries a maximum of up to ₹50 crore per instance. Breach of a voluntary undertaking accepted under s.32 can attract up to the amount applicable to the breach it covered.
How does the Board decide the amount?
After an inquiry, considering the nature, gravity and duration of the breach, the type of personal data, repetition, gain or loss, mitigation, proportionality and likely impact (s.33(2)). The Schedule figures are maximums, not fixed fines.
Have any DPDP penalties been imposed?
No. As of 4 November 2026, no Board members have been appointed, so there are no Board orders or fines.
Can a penalty be appealed?
Appeals go to the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (s.29, Rule 22).
Where should we start to reduce penalty risk?
Start with the duties that carry the highest maximums: reasonable security safeguards (s.8(5), Rule 6) and breach intimation (s.8(6), Rule 7). The penalty explainer maps each scenario to its duty, and breach management runs the Rule 7 clocks.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin