DPDP Act Penalties Explained: Every Line of the Schedule, How the Board Sets the Amount, and Who Pays

What are the penalties under the DPDP Act?

The penalties under DPDP Act section 33(1) are set out in the Schedule. Section 33(1) lets the Board impose the monetary penalty specified in the Schedule. The Schedule has seven lines. Each one maps to a specific duty, and each figure is the most the Board can impose for that breach. The DPDP Act penalty amount in any real case will be whatever the Board decides within that ceiling. Section 34 sends all penalties to the Consolidated Fund of India, so they are not paid as compensation to the affected individuals.

Reading the Schedule correctly

Line 1 is the headline ₹250 crore figure, and it is about security, not about the breach itself. A breach can happen despite reasonable safeguards. The question for line 1 is whether the fiduciary took reasonable security safeguards under s.8(5). Rule 6 of the Digital Personal Data Protection Rules, 2025 (DPDP Rules, 2025) sets the minimum: encryption or masking, access control, logs and monitoring, backups, one-year log retention, an appropriate security provision in processor contracts, and technical and organisational measures.

Line 2 is separate. A fiduciary with good security can still be penalised for not telling affected people and the Board as Rule 7 requires. Line 7 is the catch-all. It covers notice and consent failures, ignoring erasure, failing to answer rights requests, and not having a valid contract with a processor under s.8(2). Line 5 is the only line aimed at individuals, for example someone who files a false or frivolous complaint.

The Schedule speaks of a breach of provisions, and nothing in s.33 caps the total where several provisions are breached. Whether the Board treats a single incident as one breach or several has not yet been tested.

How does the Data Protection Board decide the penalty amount?

Section 33(2) says that, in setting the amount, the Board shall have regard to seven matters. These are the factors any submission to the Board should address, in this order:

• (a) the nature, gravity and duration of the breach;
• (b) the type and nature of the personal data affected;
• (c) whether the breach is repetitive;
• (d) whether the person realised a gain or avoided a loss as a result;
• (e) whether the person took action to mitigate the effects and consequences, and how timely and effective that action was;
• (f) whether the penalty is proportionate and effective, having regard to the need to secure observance of the Act and deter breaches; and
• (g) the likely impact of the penalty on the person.

The inquiry: how a case reaches a penalty

The Board can act on a breach intimation you send under s.8(6), on a complaint from an individual, on a reference from the Central or a State Government, or on a court’s direction (s.27(1)). Under s.28 it first decides whether there are sufficient grounds for an inquiry. If not, it closes the proceedings with recorded reasons. If there are, it inquires, following natural justice, with the powers of a civil court to summon people, take evidence and inspect documents (s.28(7)). It may issue interim orders after a hearing (s.28(10)).

Only at the end, and after hearing the person again, does the Board either close the case or proceed under s.33 (s.28(11)). It may also refer a complaint to mediation under s.31. Note that an individual must first use the fiduciary’s own grievance process before approaching the Board (s.13(3)). A working grievance system is therefore likely to be one of the cheaper forms of protection, though s.13(3) does not stop the Board acting on a breach intimation, a government reference or a court direction under s.27(1).

Voluntary undertakings under section 32

At any stage of a s.28 proceeding, the Board may accept a voluntary undertaking from the person concerned. It can include a commitment to take or stop an action within a set time, or to publicise the undertaking. Once accepted, it bars further proceedings on its contents (s.32(4)). If the undertaking is then broken, that is treated as a breach of the Act, and line 6 of the Schedule allows a penalty up to the amount applicable to the original breach. For a fiduciary that has found and fixed a problem, offering an undertaking early is likely to be worth considering with an advocate.

Appeals to TDSAT

Any person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal, which s.2(a) defines as the Telecom Disputes Settlement and Appellate Tribunal (s.29). The appeal must be filed within sixty days of receiving the order, though the Tribunal may admit a late appeal for sufficient cause. It should try to decide within six months. Rule 22 requires appeals to be filed digitally, with the same fee as a TRAI Act appeal unless waived. A further appeal from TDSAT follows s.18 of the TRAI Act, 1997.

When do DPDP Act penalties start?

Under paragraph (c) of G.S.R. 843(E), s.27 (except (1)(d), which starts on 13 November 2026) and ss.28 to 34, which include the Board’s inquiry powers and s.33 penalties, commence eighteen months after 13 November 2025. As of October 2026 that is 13 May 2027. The substantive duties those penalties enforce, in s.8, s.9 and s.10, start on the same day. The government proposed shortening the eighteen-month window in early 2026, but no notification changing the date had been published as of October 2026. See our enforcement timeline guide for the full table of dates.

Because the duties and the penalty provisions start together, the Board is unlikely to be able to penalise conduct before 13 May 2027 under the Act. A breach on 20 May 2027, though, will be judged against safeguards and contracts you put in place before it.

Who pays the DPDP Act fine when a vendor caused the breach?

The fiduciary. Section 8(1) makes the data fiduciary responsible for processing done on its behalf by a processor, irrespective of any agreement to the contrary. Section 8(5) extends the security duty to processing by a processor. The Act puts no direct duties on processors, so the Board’s penalty is likely to fall on you, not the vendor.

Recovering that loss from the vendor is a contract question, and an unsettled one. It depends on the indemnity, on the liability cap and its carve-outs, and on whether an Indian court would allow a party to recover a regulatory penalty from another party at all. There is no clear authority on that last point under the DPDP Act yet. What you can control is the contract. A data protection indemnity, a separate higher cap for data incidents, and clear security and breach-notice terms give you a claim to argue. A cap of three months’ fees gives you almost nothing. Our guides on section 8, on data processing agreement clauses and on data fiduciary vs data processor roles go into the drafting.

A worked example: a Delhi D2C brand and its support vendor

A Delhi direct-to-consumer skincare brand has 2,00,000 customers. Its customer support desk is outsourced to a vendor that uses a cloud helpdesk tool. An agent’s login is compromised, and an export of 60,000 tickets containing names, phone numbers, addresses and order histories ends up on a public forum. The vendor discovers it four days later and emails the brand.

The brand is the data fiduciary. On becoming aware, Rule 7 requires it to tell each affected customer without delay and to send the Board a description without delay and a detailed report within 72 hours. Its 72 hours run from its own awareness, so the vendor’s four-day delay does not directly start the brand’s clock. But that delay may well feature in the Board’s view of the brand’s safeguards.

If the Board inquires, the questions are likely to be: were there reasonable safeguards under s.8(5) and Rule 6, such as multi-factor login, access limits on bulk export and monitoring; did the vendor contract contain a security provision under Rule 6(1)(f); and were the Rule 7 intimations made. A gap on security points toward line 1 of the Schedule, up to ₹250 crore. A failure to notify points toward line 2, up to ₹200 crore. The actual figure would depend on the s.33(2) factors: the data is not financial or health data, the duration was short, and fast mitigation would count in the brand’s favour.

Then the brand turns to its vendor contract. Suppose liability is capped at twelve months’ fees, ₹18 lakh, with no carve-out for data breaches and no specific indemnity. Even if recovery of a penalty were allowed in principle, ₹18 lakh would be the ceiling. That gap is the reason to fix the contract before May 2027, not after.

What does a DPDP compliance check actually give you?

The penalty sits with you. Under s.8(1) the fiduciary answers for its vendor, and a security failure can attract a penalty of up to ₹250 crore. Many vendor contracts signed before November 2025 are likely to say nothing about DPDP, breach notice or data incident liability.

There are three honest ways to check. An advocate’s review is thorough and the right choice for material contracts, but it is slower and costlier per document. A free checklist, such as the one in our DPDP compliance checklist guide, is fast, but you still have to read every clause and judge each gap yourself. ClauseAudit’s DPDP Compliance Check reads the whole agreement, schedules included, in minutes, for ₹999 per contract. Every finding is tied to the section or rule, or labelled recommended practice. You get the clause quoted, why it matters, a suggested fix, a redline and a negotiation email. You can run it as the customer or the vendor, and the document is not stored after the review.

It is an AI-assisted review and can miss things. For large or sensitive deals, children’s data at scale, or regulated sectors, have an advocate review the contract.