The DPDP Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for not notifying a breach or for breaching children’s-data obligations, and lower caps for other failures. These are ceilings: the Data Protection Board decides the actual amount after an inquiry.
- Penalties are maximums, not fixed fines.
- The largest caps relate to security safeguards and breach notification.
- Most business duties are scheduled from 13 May 2027; verify current dates.
What the penalty schedule says
| Breach (Act section) | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach (s.8(5)) | Up to ₹250 crore |
| Failure to notify the Board and affected individuals of a breach (s.8(6)) | Up to ₹200 crore |
| Failure to observe additional obligations for children’s data (s.9) | Up to ₹200 crore |
| Breach of additional obligations of a Significant Data Fiduciary (s.10) | Up to ₹150 crore |
| Breach of duties by a Data Principal (s.15) | Up to ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board (s.32) | Up to the amount applicable to the original breach |
| Breach of any other provision of the Act or Rules | Up to ₹50 crore |
This is a summary of the Schedule to the Act. Read the official text for the exact wording.
How the Board decides an amount
The Board does not simply apply the maximum. Before imposing a penalty it holds an inquiry and gives the organisation a chance to be heard. As we read section 33, it considers factors such as:
- the nature, gravity and duration of the breach
- the type and nature of the personal data affected
- whether the failure was repeated
- any gain made or loss avoided
- steps taken to reduce the harm
- whether the penalty is proportionate and likely to be effective
The Board can also accept a voluntary undertaking from an organisation. Always read the section text or take legal advice for how these factors apply to you.
What drives the largest penalties
The two largest caps both concern what happens when personal data is exposed: not protecting it, and not telling people. For a small organisation, that usually comes down to everyday practices:
- who has access to spreadsheets, shared drives and admin panels
- whether former staff and old vendors still have access
- whether data is backed up and logs are kept
- whether you know who to call and what to do within the first hours of an incident
See our breach response guide for a simple plan.
Do penalties apply to small businesses?
The Schedule has no size-based carve-out. The Act does let the Central Government notify certain classes of Data Fiduciary, including startups, for relaxed treatment of some provisions. Check whether any notification covers you before assuming a reduced burden.
The Act and Rules come into force in phases. Under the 13 November 2025 notifications, the provisions that set up the Data Protection Board took effect on publication, consent-manager registration (Rule 4) follows after one year (around 13 November 2026), and most substantive duties for businesses are scheduled for eighteen months after publication, which is 13 May 2027. In January 2026 MeitY discussed shortening the 18-month period for some obligations. In the sources we checked on 3 November 2026 we found no notification doing so, but dates can change, so confirm against the Gazette before relying on one.
A sensible response for a small organisation
- Map the personal data you hold and where it sits.
- Lock down access: remove unused accounts, use unique logins and limit exports.
- Agree a simple incident plan with named contacts.
- Write and publish a clear notice and a contact for requests.
- Review vendors that touch personal data and note what each does.
Frequently asked questions
Are the penalties charged per breach or per year?
The Schedule sets the maximum for each listed type of failure. How the Board treats several failures at once is a matter for the Board and for legal interpretation.
Is there a penalty for individuals?
Yes, but small. Data Principals have duties, such as not filing false complaints, and a breach of those duties can attract a penalty of up to ₹10,000.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 843(E), Act commencement notification, 13 November 2025
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.