DPDP Act penalty calculator (free)

DPDP penalty calculator
for the 2023 Act.

The Schedule to the DPDP Act sets a maximum for each obligation, from ₹50 crore for a general breach to ₹250 crore for failing to keep reasonable security safeguards. Tick the ones you would fail today and see what that adds up to, adjusted for the factors the Board actually weighs.

Which obligations would you fail today?

Tick honestly. The point of the exercise is the number you would rather not see.

Failure to take reasonable security safeguards to prevent a personal data breachSection 8(5) · The largest single entry in the Schedule, and the one that turns an ordinary security incident into a regulatory event.Failure to notify the Board and affected Data Principals of a personal data breachSection 8(6) · Notification is owed on becoming aware, with no materiality threshold and no de minimis carve-out.Failure to meet the additional obligations for children's dataSection 9 · Verifiable parental consent, and no tracking, behavioural monitoring or targeted advertising directed at children.Failure to meet the additional obligations of a Significant Data FiduciarySection 10 · DPO based in India, independent data auditor, periodic DPIA and algorithmic due diligence.Breach of any other provision of the Act or the RulesSection Other · The catch-all: notice, consent, purpose limitation, retention, accuracy, grievance redressal and the rest.Breach of a voluntary undertaking accepted by the BoardSection 32 · Capped at whatever the original breach would have attracted, and it revives the proceedings the undertaking closed.Breach of a Data Principal's own duties, including a false or frivolous complaintSection 15 · Falls on the individual, not the company. Included for completeness.

Aggravating and mitigating factors

Section 33(2) tells the Board what to weigh when it fixes the amount. These adjust the indicative figure below the maximum; they do not change the statutory cap.

The breach was repetitiveAggravating Sensitive or children's data was involvedAggravating Large number of Data Principals affectedAggravating We took prompt action to mitigateMitigating We self-reported to the BoardMitigating First instance, no prior findingsMitigating

DPDP penalty calculatorfor the 2023 Act.

Which obligations would you fail today?

Aggravating and mitigating factors

Stop generating documents. Start evidencing controls.

DPDP penalty calculator
for the 2023 Act.