Free tool
DPDP penalty explainer
Pick what went wrong and see the duty it touches, the maximum penalty in the Schedule to the Act, and the controls that help prevent it.
Short answer
The Schedule to the DPDP Act sets maximum penalties per instance, from up to ₹10,000 for a Data Principal's breach of the s.15 duties to up to ₹250 crore for failing to take reasonable security safeguards under s.8(5). The Board decides any penalty after an inquiry, weighing factors such as the nature, gravity and duration of the breach (s.33(2)). No Board members have been appointed yet, and this explainer does not predict any amount.
Pick a scenario to see the duty it touches, the maximum penalty in the Schedule to the Act and the controls that help prevent it. The Board decides any penalty after an inquiry (s.33). These are maximums per instance, not predictions.
How the explainer works
Choose a scenario. The explainer shows the duty involved, where it sits in the Act, the maximum in the Schedule, and the controls that help prevent it, with links to read more.
The amounts are maximums per instance. They are not estimates, and the explainer is not a fine calculator.
How the Board decides a penalty
Under s.33, the Board imposes a penalty only after an inquiry. Section 33(2) asks it to consider these factors.
- The nature, gravity and duration of the breach
- The type of personal data affected
- Whether the breach was repeated
- Whether the breach brought a gain or avoided a loss
- Steps taken to mitigate the effects
- Whether the penalty is proportionate
- The likely impact of the penalty
For the full picture, read the penalties guide and the penalties FAQ.
What the explainer does not do
This explainer is educational information, not legal advice and not a certification. It does not predict a penalty, and no Board members have been appointed yet, so there are no Board orders to learn from. Check your specific exposure with counsel.
How TruePrivacy helps
Most of the controls in the explainer are records TruePrivacy keeps: data security posture issues and remediation, breach notification clocks, parental consent with evidence, and the SDF workspace with yearly clocks for the DPIA and data audit.
What is the highest penalty under the DPDP Act?
Up to ₹250 crore per instance, for failing to take reasonable security safeguards to prevent a personal data breach (s.8(5)). The Board decides any amount after an inquiry.
What is the penalty for not reporting a personal data breach?
Up to ₹200 crore for failing to intimate the Board or affected Data Principals of a breach under s.8(6).
Has the Board imposed any DPDP penalties?
No Board members have been appointed yet (as of 4 November 2026). We do not report invented fines or cases.
Can an individual be penalised under the DPDP Act?
Yes. A Data Principal who breaches the duties in s.15 can face a penalty of up to ₹10,000.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin