Call +1 943 270 2421
Data protection

What are the penalties under the DPDP Act, 2023?

Last reviewed

Up to ₹250 cr
Short answer

The DPDP Act, 2023 sets monetary penalties, not criminal punishment. The Schedule allows the Data Protection Board to impose up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to report a breach or breaching children’s-data duties, up to ₹150 crore for Significant Data Fiduciary lapses, and up to ₹50 crore for other breaches.

The law this relies on

Digital Personal Data Protection Act, 2023

Section 33 and Schedule

Penalty ceilings by type of breach and factors the Board must consider.

Digital Personal Data Protection Act, 2023

Section 32

Voluntary undertakings accepted by the Board.

Digital Personal Data Protection Act, 2023

Section 29

Appeal to TDSAT within 60 days of the Board’s order.

Digital Personal Data Protection Act, 2023

Sections 37 and 44

Power to advise blocking of repeat offenders; omission of IT Act Section 43A.

Explained

What does the penalty Schedule say?

Section 33 read with the Schedule to the Act fixes maximum penalties by type of breach. Failure to take reasonable security safeguards to prevent a personal data breach: up to ₹250 crore. Failure to notify the Board or affected individuals of a breach: up to ₹200 crore. Breach of the additional obligations for children’s data: up to ₹200 crore. Breach of Significant Data Fiduciary obligations: up to ₹150 crore. Breach of a Data Principal’s own duties: up to ₹10,000. Any other breach of the Act or Rules: up to ₹50 crore.

How does the Data Protection Board decide the amount?

The figures are ceilings. After an inquiry, the Board must weigh the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether the breach is repetitive, any gain made or loss avoided, the steps taken to mitigate it and their timeliness, and whether the penalty is proportionate and effective. The Board works as a digital office, so proceedings can run without physical hearings.

Can a business settle or appeal?

Under Section 32 the Board may accept a voluntary undertaking — for example to take specific remedial steps — at any stage of proceedings, which bars further proceedings on the same matter unless the undertaking is breached. An order of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days under Section 29, and from there to the Supreme Court.

Are there other consequences beyond penalties?

Yes. Under Section 37, after penalties have been imposed on a fiduciary in two or more cases, the Board may advise the Central Government to block public access to that fiduciary’s platform in the interest of the general public. Separately, the DPDP Act omitted Section 43A of the IT Act, which had allowed compensation claims for negligent handling of sensitive data, so the remedy now runs through the Board.

Frequently asked questions

What is the maximum penalty under the DPDP Act?

Up to ₹250 crore for each instance of failing to take reasonable security safeguards to prevent a personal data breach. Other breaches carry lower ceilings set out in the Schedule.

Can directors go to jail under the DPDP Act?

The DPDP Act itself provides only monetary penalties, not imprisonment. Other laws, such as the IT Act or the Bharatiya Nyaya Sanhita, 2023, may still apply to criminal conduct like unauthorised access or data theft.

Can individuals be fined under the DPDP Act?

Yes, but only modestly. A Data Principal who breaches their duties under Section 15 — for example by filing a false or frivolous complaint or impersonating someone — can face a penalty of up to ₹10,000.

Where do DPDP penalties go?

Penalties imposed by the Board are credited to the Consolidated Fund of India. They are not paid to the affected individuals as compensation.

This guide is general information about Indian law, not legal advice for a specific dispute, document or jurisdiction. Laws and rules change by notification; for a decision with legal or financial consequences, consult a qualified advocate.

Put this into practice

CaseDocker keeps contracts, signatures, stamp papers, notices and compliance deadlines in one place, with reminders before anything lapses.

Explore Compliance ManagementAll legal guides