DPDP Act Penalties: Fines Under India's Data Protection Law (Table)

Security and breach response carry the heaviest caps, so the costliest mistake is usually a quiet one: weak safeguards, then a slow or missing notice. The ₹50 crore catch-all covers everything the Schedule doesn't name.

These are not today's fines. They show how far the government could raise each cap by notification, since section 42 stops any increase at twice the original amount.

The rules setting up the Board applied on publication, so the enforcement machinery is already in place. Most duties a business has to meet, from notices to breach reporting, start in May 2027.

Only large e-commerce, social media and gaming platforms face the 3-year inactive-data erasure rule. Gaming platforms hit it at 50 lakh users, far sooner than the other two.

The Schedule to the Digital Personal Data Protection Act, 2023: maximum penalties (section 33(1))

Source: Ministry of Electronics and Information Technology (MeitY), Government of India, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India Extraordinary. Download as image

What the Data Protection Board must consider when setting a penalty (section 33(2))

Source: Ministry of Electronics and Information Technology (MeitY), Government of India, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India Extraordinary. Download as image

Key DPDP deadlines that affect penalty exposure

Source: Ministry of Electronics and Information Technology (MeitY), Government of India, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India Extraordinary; Ministry of Electronics and Information Technology (MeitY), Government of India, Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), Gazette of India Extraordinary No. 760. Download as image

Other penalty rules in the DPDP Act, 2023

Source: Ministry of Electronics and Information Technology (MeitY), Government of India, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India Extraordinary. Download as image

How much is the penalty under the DPDP Act?

It depends on what went wrong. The Act groups failures into seven items and gives each a cap. The top one, ₹250 crore, is for not taking reasonable security safeguards to prevent a personal data breach. Not telling the Board and affected users about a breach can cost up to ₹200 crore. So can breaking the extra rules on children's data.

A Significant Data Fiduciary that ignores its additional duties faces up to ₹150 crore. Anything else in the Act or the Rules, such as a sloppy privacy notice or an ignored grievance, falls into a ₹50 crore bucket.

Notice the pattern. Two of the three biggest caps are about breaches: one for letting it happen through weak security, one for staying quiet afterwards. A single incident can expose you to both.

Will the Data Protection Board actually fine the full amount?

Not automatically. Section 33(2) makes the Board weigh the gravity and duration of the breach, the kind of data involved, whether it keeps happening, whether you gained from it, how fast and how well you contained it, and what the penalty would do to you. The fine has to be proportionate.

The Board also can't fine you on a whim. It has to hold an inquiry, decide the breach is significant, and give you a hearing first. If you disagree with the order, you get 60 days to appeal to the Appellate Tribunal (TDSAT), which aims to decide within 6 months.

Two details matter more than people expect. First, the money goes to the Consolidated Fund of India, not to the people whose data leaked. Second, a business penalised in two or more instances can find the Board advising the government to block public access to its platform. For an app or a SaaS product, that is worse than any fine.

When do the DPDP penalties start applying?

The Act became law on 11 August 2023, but it does very little without its Rules. Those were published on 13 November 2025 and arrive in three stages. The rules setting up the Board applied immediately. The Consent Manager rule follows after one year. Most of the rest, including notices, security safeguards, breach reporting, children's data and Significant Data Fiduciary duties, start 18 months after publication, which lands in May 2027.

Don't read that date as breathing room for contracts you're signing today. A vendor deal or client agreement signed now will probably still be running in May 2027. If it says nothing about breach reporting or data deletion, you'll be renegotiating under pressure later. Put a clause in now that lets either side update the data terms when the Rules take effect, and you avoid that fight.

What the 72-hour breach rule means in practice

Once rule 7 is in force, a breach starts two clocks. You must tell the Board and every affected person without delay, then send the Board a detailed report within 72 hours of becoming aware. The Board can extend that on a written request, but you can't count on it.

Here's where most businesses get caught. If your customer data sits with a hosting provider, a CRM or a payroll vendor, you only learn about a breach when they tell you. If their contract gives them a week, or just says they'll notify you "promptly", your own 72 hours may be gone before you hear anything. The fine for a missed notice, up to ₹200 crore, lands on you as the Data Fiduciary, not on them.

Who carries the risk: fiduciary, processor or platform?

The big caps apply to the Data Fiduciary, the business that decides why and how personal data is used. If you run an online store, the customer list is yours, so the duty to protect it is yours too, even when the data physically sits on someone else's servers.

A processor, such as a cloud host, an email tool or a freelance developer working on your app, acts on your instructions. The Act puts the penalty on you, then leaves you to recover your loss from the processor under your contract. That's why the vendor agreement matters so much. Without a clear indemnity and a sensible liability cap, a breach caused by your vendor can leave you paying the fine with nothing to claim back.

Some businesses face more. A company notified as a Significant Data Fiduciary has extra duties, including a data protection impact assessment and an audit once every 12 months, and breaking them can cost up to ₹150 crore. Any business that processes children's data must meet the section 9 rules, with a ₹200 crore cap behind them.

If you're unsure which role you play in a given deal, assume the client will try to make you the one who pays, and read the contract with that in mind.

What to do now if you run a business, freelance or work with data

• Businesses: list every vendor that touches personal data and check each contract for a breach notice deadline well inside 72 hours, a security standard, and a deletion duty at the end of the deal.
• SaaS founders: expect your enterprise customers to push those same terms onto you. Decide now what notice period and liability you can actually support.
• Freelancers and agencies handling client user data: you are likely a processor, not the fiduciary. Read whether the client is trying to shift its entire DPDP liability onto you through an unlimited indemnity.
• Large platforms: if you run an e-commerce or social media service with at least 2 crore registered users in India, or a gaming platform with at least 50 lakh, plan the 3-year erasure process and the 48-hour warning to users.
• Every Data Fiduciary: keep processing logs for at least 1 year and set up a grievance process that answers within 90 days. Both are duties under the Rules, and both start in May 2027.
• Individuals: you can be fined too, up to ₹10,000, for things like impersonating someone or filing a false or frivolous complaint.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. Figures that could not be confirmed were left out.

1. Ministry of Electronics and Information Technology (MeitY), Government of India, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India Extraordinary (Assented and published 11 August 2023 (read 18 October 2026))
2. Ministry of Electronics and Information Technology (MeitY), Government of India, Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), Gazette of India Extraordinary No. 760 (13 November 2025 (read 18 October 2026))