Each penalty, and the control that stops it
12 October 2026
Six steps to avoid DPDP penalties: the control for each Schedule entry, in order of ceiling, and the dated records that show the Board what you did.
You avoid DPDP penalties by controlling the specific duties the Schedule attaches a penalty to, in order of ceiling, and by keeping dated records of what you did. The Act gives no safe harbour for a particular tool or certificate. It gives seven penalty entries, and each figure is a ceiling.
For the amounts, the factors the Board weighs and how a penalty arrives, see DPDP penalties explained. This page is the other side: the controls that keep each entry from being triggered. The substantive duties commence on 13 May 2027 under Rule 1(4); the timeline has the full dates, and controls built before then have no breach history to explain.
Six steps, in order of ceiling
Follow these in order. The effort tracks the exposure.
- Security safeguards, Sec. 8(5): up to 250 crore rupees. Put the Rule 6 minimum in place: encryption, obfuscation, masking or virtual tokens; access control over your computer resources and your processors'; logs, monitoring and review; backups for continued processing; one year of log retention; and security terms in the processor contract. See security safeguards.
- Breach intimation, Sec. 8(6): up to 200 crore rupees. Build and test an incident path that meets Rule 7: a plain-language message to each affected Data Principal, and to the Board a prompt description followed by detail within seventy-two hours. See breach notification.
- Children, Sec. 9: up to 200 crore rupees. Add age gating and verifiable parental consent under Rule 10, and no tracking, behavioural monitoring or targeted advertising directed at children under Sec. 9(3), subject to the exemptions in Sec. 9(4).
- Significant Data Fiduciary duties, Sec. 10: up to 150 crore rupees. These apply only if the government notifies you. If it does, the Data Protection Officer, independent auditor, DPIA and audit duties follow; see how to conduct a DPIA.
- Everything else: up to 50 crore rupees. Give each remaining duty an owner: notice (Sec. 5, Rule 3), consent and withdrawal (Sec. 6), the rights in Sec. 11 to 14, the grievance mechanism (Sec. 8(10), Rule 14(3)), erasure (Sec. 8(7), Rule 8) and the processor contract (Sec. 8(2)). The compliance checklist puts these in dependency order.
- Evidence for all of it. See the section below.
Two entries are not controls you build. Sec. 15 puts duties on the Data Principal, with a ceiling of 10,000 rupees. A broken voluntary undertaking is dealt with under Sec. 32, so do not offer terms you cannot meet.
Keep the evidence
A control with no record cannot be shown to the Board. For each duty above, keep who owned it, when it was reviewed, and what changed. For consent that means notice version, language, time and outcome per decision, which is what a consent receipt holds. For vendors it means the contract, the date, and the security terms Rule 6(1)(f) calls for. For breaches it means the timeline from awareness to each notification.
Decide in advance who has authority to commit the organisation if an undertaking is ever offered, and which engineering owner can say honestly what can be done by when.
MyConsent+ generates the consent and withdrawal records; the security, breach and vendor controls above live in your own systems and processes. If you lend or process payments, the fintech guide applies these steps to partner chains and vendor-heavy flows.
Where to start
If you have a month, do these in order: the Rule 6 security list, the Rule 7 breach runbook, the processor contract review, and the consent and retention records.
Questions people ask
- How can I avoid penalties under the DPDP Act?
- Control the entries that carry the highest ceilings first: reasonable security safeguards under Sec. 8(5), breach intimation under Sec. 8(6) and the children's obligations under Sec. 9. After that, cover notice, consent, rights, grievance and erasure, which sit under the residual 50 crore rupee entry. Keep dated records of each control so you can show what you did and when.
- What should a DPDP breach runbook contain?
- It should name an owner for each of the three Rule 7 steps: the plain-language message to each affected Data Principal without delay, the description to the Board without delay, and the detailed report to the Board within seventy-two hours, or a longer period the Board allows. It should also say how you learn of a breach at a vendor, since the duty stays with you.
- Which records should I keep to show the Board I took the required steps?
- Keep who owned each duty, when it was reviewed and what changed. For consent that means the notice version, language, time and outcome of each decision. For vendors it means the contract and its security terms under Rule 6(1)(f). For breaches it means the timeline from awareness to each intimation.
- Does every DPDP violation lead to a penalty?
- No. A penalty follows an inquiry and a Board determination that the breach is significant, after a hearing, as Sec. 33(1) provides. The process is set out in the penalties guide.