DPDP Act penalties: the amounts in the Schedule
The Data Protection Board may impose a monetary penalty when, after an inquiry and a hearing, it finds a breach of the Act or the Rules significant (section 33(1)). The Schedule sets the most it can be for each kind of breach. Penalties apply from 13 May 2027.
The Schedule
| Breach | Section | Penalty up to |
|---|---|---|
| Not taking reasonable security safeguards to prevent a personal data breach | 8(5) | ₹250 crore |
| Not giving the Board and each affected Data Principal intimation of a personal data breach | 8(6) | ₹200 crore |
| Not meeting the additional obligations for children's data | 9 | ₹200 crore |
| Not meeting the additional obligations of a Significant Data Fiduciary | 10 | ₹150 crore |
| A Data Principal not performing her duties, such as filing a false or frivolous complaint | 15 | ₹10,000 |
| Breaking a voluntary undertaking accepted by the Board | 32 | The penalty for the breach the proceedings were about |
| Any other breach of the Act or the Rules | – | ₹50 crore |
How the Board sets the amount (section 33(2))
- The nature, gravity and duration of the breach.
- The type and nature of the personal data affected.
- Whether the breach was repeated.
- Whether the business gained, or avoided a loss, by the breach.
- Whether it acted to reduce the effects of the breach, and how quickly and effectively.
- Whether the penalty is proportionate and effective to deter breaches.
- The likely impact of the penalty on the business.
Also good to know
- The amounts are maximums: the Schedule says the penalty may extend to them.
- At any stage of an inquiry the Board may accept a voluntary undertaking; that bars proceedings on what it covers, unless the undertaking is broken (section 32).
- An order of the Board can be appealed to the Appellate Tribunal within sixty days (section 29).
- Penalties go to the Consolidated Fund of India (section 34).
Questions
Who pays the ₹10,000 penalty?
The Data Principal, the person the data is about. Section 15 lists her duties, such as not impersonating anyone and not filing a false or frivolous grievance or complaint.
Does acting fast after a breach lower the penalty?
The Board must consider whether you acted to reduce the effects and consequences of the breach, and how timely and effective that was (section 33(2)).
When can penalties be imposed?
Sections 27 to 34, which include the penalties, apply from 13 May 2027 (G.S.R. 843(E)).
Read in the Act and G.S.R. 843(E) on 28 October 2026. This is not legal advice.