The DPDP Act penalties are set by a seven-entry Schedule to Sec. 33(1), and each figure is a ceiling the Board may impose after an inquiry, not a tariff. The highest, 250 crore rupees, attaches to failing to take reasonable security safeguards. The Schedule to Sec. 33(1) has seven entries; the other ceilings are 200, 200, 150 and 50 crore rupees, plus ten thousand rupees for a Data Principal and a special rule for broken undertakings.
Nothing in the Act fines you automatically. A penalty follows a complaint or intimation, an inquiry, and a decision with reasons. This page covers the amounts, the factors that move them, and the route from breach to penalty and back through an appeal.
The Schedule, entry by entry
Sec. 33(1) allows the Board to impose "such monetary penalty specified in the Schedule". The Schedule has seven entries:
- Up to 250 crore rupees: breach in observance of the duty to take reasonable security safeguards to prevent a personal data breach, Sec. 8(5).
- Up to 200 crore rupees: breach in observance of the duty to give the Board and affected Data Principals notice of a personal data breach, Sec. 8(6).
- Up to 200 crore rupees: breach in observance of the additional obligations in relation to children, Sec. 9.
- Up to 150 crore rupees: breach in observance of the additional obligations of a Significant Data Fiduciary, Sec. 10.
- Up to 10,000 rupees: breach in observance of the duties of a Data Principal, Sec. 15.
- Up to the amount applicable to the breach: breach of a term of a voluntary undertaking accepted by the Board under Sec. 32, measured against the matter the proceedings concerned.
- Up to 50 crore rupees: breach of any other provision of the Act or the Rules.
Two features are worth a second look. The largest figure is about security, not about consent banners or notices; a missing notice sits in the residuary entry at 50 crore rupees. And the Rules are inside entry 7: breaching a duty set only in the Rules (for example, the content of a notice under Rule 3) carries the 50 crore ceiling.
Sec. 42 lets the Central Government amend the Schedule, but not to more than twice the penalty originally specified. The figures above are those in the Act as published.
Security safeguards and breach notification are the two duties behind the first two entries. Entry 1 is the largest ceiling; entries 2 and 3 follow at 200 crore rupees each.
What the Board must weigh
Sec. 33(2) tells the Board to have regard to seven matters when fixing the amount:
- the nature, gravity and duration of the breach;
- the type and nature of the personal data affected;
- the repetitive nature of the breach;
- whether the person realised a gain or avoided a loss as a result;
- whether the person took action to mitigate the effects, and how timely and effective it was;
- whether the penalty is proportionate and effective, having regard to securing observance and deterring breach; and
- the likely impact of the penalty on the person.
Read as a checklist, these are also an account of what helps. Mitigation counts, and the timeliness of it counts. Repetition counts against you. Sensitive categories raise the stakes even though the Act itself draws no category line. The Act does not give a formula, so the amount below the ceiling is the Board's judgment, with reasons.
How a penalty is actually imposed
The route runs through Chapter VI. Details of the Board are on the Data Protection Board page.
- Trigger. Under Sec. 27(1), the Board acts on an intimation of a personal data breach, a Data Principal's complaint, a reference from the Central or a State Government or a court direction. A Data Principal must first exhaust the Fiduciary's grievance route under Sec. 13(3) before approaching the Board.
- Sufficient grounds? Under Sec. 28(3) and (4), the Board decides whether there are sufficient grounds to proceed, and may close the proceedings with reasons if not.
- Inquiry. Sec. 28(5) and (6): an inquiry that follows natural justice, with reasons recorded. The Board has civil court powers for summoning, evidence and inspecting documents (Sec. 28(7)), and can issue interim orders after hearing the person (Sec. 28(10)). Rule 19(9) sets six months to complete it, extendable by up to three months at a time for recorded reasons.
- Decision. On completion the Board may close the proceedings or proceed under Sec. 33 (Sec. 28(11)), and may impose a penalty only if it finds the breach significant, after hearing the person.
- Appeal. A person aggrieved can appeal within sixty days (Sec. 29(2)); see below.
Sec. 31 also lets the Board direct parties to try mediation where it thinks a complaint can be resolved that way. All sums realised go to the Consolidated Fund of India under Sec. 34, not to the complainant.
Voluntary undertakings
Sec. 32 gives a route out of a penalty. At any stage of a Sec. 28 proceeding, the Board may accept a voluntary undertaking about observance of the Act. It can include taking or refraining from stated action within a stated time, and publicising the undertaking (Sec. 32(2)). The terms can be varied with the person's consent.
Acceptance bars further proceedings under the Act on what the undertaking covers (Sec. 32(4)). The bar has a catch: if the person fails to adhere to a term, that breach is deemed a breach of the Act and the Board may, after hearing, proceed under Sec. 33 (Sec. 32(5)). That is entry 6 of the Schedule.
An undertaking is a negotiated outcome, not a right. The Board "may accept" one.
Appeal and what follows
An order or direction of the Board can be appealed to the Appellate Tribunal, which Sec. 2(a) defines as the Telecom Disputes Settlement and Appellate Tribunal (Sec. 29(1)). The time limit is sixty days from receipt, with room for late appeals on sufficient cause. The Tribunal should aim to dispose of an appeal within six months and must record reasons if it does not (Sec. 29(6) and (7)). Sec. 39 bars civil courts from entertaining matters the Board is empowered to decide.
Sec. 37 adds a sanction beyond money. If the Board has imposed monetary penalties on a Data Fiduciary in two or more instances and advises blocking in the interests of the general public, the Central Government may, after hearing the Data Fiduciary and recording reasons, direct that public access to the information enabling its activity be blocked.
Planning around the numbers
The substantive duties the penalties attach to commence on 13 May 2027 (Rule 1(4)); the Board itself has existed in law since 13 November 2025. Three practical points follow from the structure above.
- Security and breach reporting are the expensive failures. Entry 1 is the largest ceiling and entries 2 and 3 follow, and Rule 6 and Rule 7 spell out the measures and the timings.
- Records are your defence. Mitigation, timeliness and your consent evidence under Sec. 6(10) all depend on what you can show. The compliance checklist lists evidence to retain against each provision.
- Act early. An undertaking can be offered at any stage of a Sec. 28 proceeding, but the better position is never being in one. See how to avoid DPDP penalties.
The compliance map ties each provision to the control that answers it.