Article
DPDP Act penalties explained: fines of up to ₹250 crore
20 Oct 2026 · Dpofficer.in team · 2 min read
The Data Protection Board can impose penalties of up to ₹250 crore under the DPDP Act. What each penalty is for and how the Board decides the amount.
The DPDP Act, 2023 does not send anyone to jail. Instead it gives the Data Protection Board of India power to impose large financial penalties on organisations that break the law. The amounts are set out in the Schedule to the Act.
The penalty table
| What went wrong | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failing to tell the Board and the affected people about a personal data breach | ₹200 crore |
| Breaking the extra duties for children’s data | ₹200 crore |
| A Significant Data Fiduciary breaking its additional duties | ₹150 crore |
| Breaking a voluntary undertaking accepted by the Board | Up to the penalty for the original breach |
| Breaking any other provision of the Act or Rules | ₹50 crore |
| A Data Principal breaking their own duties, such as filing a false complaint | ₹10,000 |
These are maximums for each instance. The Board decides the actual amount after an inquiry.
How the Board decides the amount
The Act lists what the Board must consider, including:
- the nature, gravity and duration of the breach
- the type and nature of the personal data affected
- whether the breach was repeated
- whether the organisation gained or avoided a loss because of it
- what the organisation did to reduce the effects, and how quickly
- whether the penalty is proportionate and effective
- the likely impact of the penalty on the organisation
So an organisation that discovers a breach quickly, reports it on time and limits the damage is in a far better position than one that hides it.
The biggest risk: security and breach reporting
The two largest penalties are about security safeguards and breach reporting. Under the DPDP Rules, 2025, an organisation must tell affected people about a breach without delay and send the Board a detailed report within 72 hours of becoming aware of it. Weak access controls, unencrypted data, missing logs or a slow response can each lead to the highest penalty band.
How to stay on the right side
- Know what personal data you hold and protect it with encryption, access control and logging.
- Have a breach response plan, and practise it so the 72-hour report is realistic.
- Treat children’s data with extra care, including verifiable parental consent.
- Train every team that touches personal data. Most incidents start with a human mistake.
Learn it properly
Our online courses cover the Board’s powers, inquiries, penalties and settlement routes, with practical breach-response exercises. Browse the courses.
This article is for education and is not legal advice.