DPDP penalty calculator
for the 2023 Act.
The Schedule to the DPDP Act sets a maximum for each obligation, from ₹50 crore for a general breach to ₹250 crore for failing to keep reasonable security safeguards. Tick the ones you would fail today and see what that adds up to, adjusted for the factors the Board actually weighs.
The Schedule, entry by entry
The DPDP Act does not set penalties in the body of the statute. It sets them in a Schedule at the end, as a list of maxima attached to specific obligations. That structure matters, because it means exposure is not a single number: it is the sum of whichever entries you are exposed to, and the Board fixes the actual figure within each cap after an inquiry.
| Breach | Where | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards The obligation to prevent a personal data breach in the first place | Section 8(5) | ₹250 crore |
| Failure to notify a personal data breach Owed to the Board and to each affected Data Principal | Section 8(6) | ₹200 crore |
| Failure to meet the children's obligations Verifiable parental consent; no tracking or targeted advertising at children | Section 9 | ₹200 crore |
| Failure to meet Significant Data Fiduciary obligations DPO in India, independent auditor, periodic DPIA, algorithmic due diligence | Section 10 | ₹150 crore |
| Breach of any other provision of the Act or Rules Notice, consent, purpose limitation, retention, accuracy, grievance redressal | Residual entry | ₹50 crore |
| Breach of a voluntary undertaking Given to the Board to close proceedings, then not honoured | Section 32 | Up to the cap for the underlying breach |
| Breach of a Data Principal's own duties Including registering a false or frivolous grievance or complaint | Section 15 | ₹10,000 |
Figures are the statutory maxima. Verify against the current text of the Act and Rules with counsel.
Per instance, not per person
This is the most common misreading, and it cuts both ways. The Schedule sets a maximum per instance of non-compliance, not per affected individual. A breach touching four million records is not four million multiples of ₹250 crore. It is one instance, and the number of people affected is one of the things the Board weighs when deciding where inside the cap to land.
That is a meaningfully different shape from the GDPR, which sets its ceiling as a percentage of global annual turnover. A £20m-or-4% regime scales with the size of the company; a fixed-rupee regime does not. For a large Indian enterprise the DPDP maxima may be comparatively mild. For a Series A company, ₹250 crore is existential, and that asymmetry is deliberate policy rather than an oversight.
How the Board actually fixes the amount
Section 33(2) lists what the Board must have regard to. It is a short list and it is worth knowing by heart, because every item on it is something you can influence before an inquiry ever starts.
- The nature, gravity and duration of the breach
- The type and nature of the personal data affected
- Whether the breach is repetitive
- Whether, as a result of the breach, the person realised a gain or avoided a loss
- Whether the person took any action to mitigate the effects, and how timely and effective it was
- Whether the penalty is proportionate and effective, having regard to the need to secure observance of and deter breaches of the Act
Three of those six are about what you did after you found out. Mitigation, timeliness and whether it recurred are the levers most companies still have available on the day an incident lands, which is why an incident response plan you have actually rehearsed is worth more than any clause in a policy document.
What happens between a complaint and a penalty
A penalty is the end of a process, not the start of one. The Data Protection Board can act on a complaint from a Data Principal, on a reference from the government, or on a breach notification you filed yourself. It first decides whether there are sufficient grounds to inquire. If it proceeds, it has the powers of a civil court for that inquiry: summoning people, requiring documents, and inspecting records.
Two off-ramps exist. Under Section 32 the Board may accept a voluntary undertaking at any stage, which ends the proceedings for that breach, unless you then fail to honour it, at which point the original exposure revives. And the Board may simply close an inquiry if it finds the grounds insufficient. Neither is automatic, and both are more available to a company that self-reported than to one that was found out.
Appeals go to the Telecom Disputes Settlement and Appellate Tribunal, and from there to the Supreme Court. There is no imprisonment provision anywhere in the Act. The exposure is financial and it falls on the entity, not on named individuals: a real difference from several other Indian statutes that companies often assume applies here too.
What reduces the number
Nothing on this page is legal strategy, and the Board is not obliged to credit any of it. But the Section 33(2) factors point clearly at what a defensible position looks like, and all of it is ordinary engineering and process work rather than legal work.
- Be able to scope the breach. Access logs that let you say exactly whose data was reached, and when, turn an unbounded incident into a bounded one
- Notify on time. The obligation runs from becoming aware, not from finishing the investigation
- Show the safeguards predate the incident. Evidence dated after the breach reads as remediation, not as a control
- Do not let it recur. Repetition is the single factor most likely to move a figure upward
If you want to know where you stand before any of this is theoretical, the readiness check scores the same obligations this calculator prices, and the DPDP Act guide walks the duties in the order they bite.
The things people ask us
Are these fines per breach or per affected person?
Per instance of non-compliance, not per affected individual. A breach affecting four million people is one instance against the Section 8(5) cap, not four million. The number of people affected is one of the Section 33(2) factors the Board weighs when fixing the amount inside that cap.
Can directors or officers be held personally liable?
The Act's penalties are financial and fall on the entity. There is no imprisonment provision anywhere in the DPDP Act. That is a meaningful difference from some other Indian statutes, and it means the practical exposure is balance-sheet risk rather than personal criminal risk.
How do DPDP penalties compare to GDPR fines?
The shape differs more than the size. The GDPR caps at the higher of €20 million or 4% of global annual turnover, so it scales with company size. DPDP sets fixed rupee maxima per obligation, up to ₹250 crore. For a large enterprise the DPDP ceiling may be lower in practice; for an early-stage company it is proportionally far more severe.
Does self-reporting a breach make a penalty more likely?
Notification is a legal obligation under Section 8(6), not a choice, and failing to notify is itself the second-largest entry in the Schedule at ₹200 crore. Beyond that, prompt mitigation is an express Section 33(2) factor, and a voluntary undertaking under Section 32 is more realistically available to a company that came forward than to one that was discovered.
What is a voluntary undertaking under Section 32?
A commitment you offer and the Board accepts, which ends the proceedings for that breach without a penalty being imposed. It is capped in effect by the underlying breach: if you fail to honour it, the Board can proceed on the original matter, so the exposure is deferred rather than removed.
Is the indicative figure on this page a prediction?
No. The maximum is statutory and verifiable; the indicative figure simply applies the direction of the Section 33(2) factors to that maximum so you can see how much the same breach can move depending on what you did about it. The Board sets the real number after an inquiry, and no calculator can anticipate it.
Stop generating documents. Start evidencing controls.
These tools write a document from what you tell them. The platform writes one from what your systems are actually doing, and keeps the proof behind it.