DPDP Act, 2023 • Penalties
Potential Penalties under the DPDP Act
Non-compliance with DPDP requirements can result in significant financial penalties. Start your DPDP compliance assessment today.
Maximum penalties under the DPDP Act, 2023
- Failure to take reasonable security safeguards to prevent personal data breaches: up to ₹250 Crore
- Failure to notify the Data Protection Board or affected individuals of a personal data breach: up to ₹200 Crore
More Penalties You Should Know
Obligations for children’s data, for Significant Data Fiduciaries and under every other provision of the Act carry penalties too. Find your gaps before they become costly.
More maximum penalties under the DPDP Act, 2023
- Non-fulfilment of additional obligations relating to children’s data: up to ₹200 Crore
- Non-fulfilment of obligations relating to Significant Data Fiduciaries: up to ₹150 Crore
- Other breaches of the Act: up to ₹50 Crore
DPDP Act 2023: A Practical Business Guide
What the DPDP Act means for Indian businesses, why it matters, the potential penalties and the first questions to ask about your own data protection readiness.
Non-Compliance Can Cost You Up to ₹250 Crore!
Penalties under the DPDP Act are among the highest of any Indian law. Understand where you stand before a gap becomes costly.
- Up to ₹250 Crore: Failing to take reasonable security safeguards against personal data breaches
- Up to ₹200 Crore: Not notifying the Data Protection Board and affected people of a breach, or breaching children’s data obligations
- Up to ₹150 Crore: Not meeting the extra obligations of a Significant Data Fiduciary
- Up to ₹50 Crore: Any other breach of the Act
Your DPDP Compliance Journey Starts Here
Assess your organization’s data privacy readiness, manage DPDP requirements and stay compliant with ease.
Know Your Compliance Readiness
Answer structured DPDP questionnaires, attach evidence and see a clear readiness score once your assessment is submitted.
The Right Access for Every Role
Super Admins, Client Admins and team members each see and do exactly what their role allows — nothing more.
Track Progress Every Step of the Way
Assign questions to your team, follow progress in real time and submit your assessment when everything is complete.
DPDP compliance software to keep your organisation ready
DPDP Assessment
Evaluate your data protection readiness with a structured DPDP readiness assessment questionnaire and plain-language guidance.
Role-Based Access
Secure, flexible access for Super Admins, Client Admins and their team members.
Track & Manage
DPDP compliance tracking in one place: assign questions, monitor progress and manage compliance tasks with ease.
Find & Close Gaps
A DPDP gap assessment shows your priority and improvement gaps, so you can build a stronger data privacy compliance framework.
About DPDP Compliance Hub
DPDP Compliance Hub makes data protection compliance in India simpler. It helps organisations prepare for India’s Digital Personal Data Protection Act, 2023 with a personal data protection assessment: each organisation answers a structured DPDP readiness questionnaire, assigns questions to the right people, attaches supporting evidence and submits the assessment for a clear readiness score and gap report — with every user seeing only what their role allows.
- Register your organisation and invite your team
- Assign questions and collect answers with evidence
- Submit the assessment and see your readiness score
The DPDP Act, 2023 at a glance
Consent
Process personal data only with free, specific, informed and unambiguous consent — or for a legitimate use the Act allows.
Purpose limitation
Use personal data only for the purpose it was collected for, and say clearly what that purpose is.
Data minimisation
Collect only the personal data that is necessary for that purpose.
Accuracy & retention
Keep data accurate and complete, and erase it once the purpose is served.
Security safeguards
Protect personal data with reasonable security safeguards to prevent breaches.
Breach notification
Inform the Data Protection Board and affected people of a personal data breach.
Rights of individuals
Enable access, correction, erasure, grievance redressal and nomination for Data Principals.
Children's data
Obtain verifiable parental consent and avoid tracking or targeted advertising to children.
A plain-language summary for guidance only. Refer to the Digital Personal Data Protection Act, 2023 and its Rules for the authoritative text.
DPDP compliance in India: frequently asked questions
How do I comply with the DPDP Act 2023?
Start by knowing what personal data your organisation collects, where it comes from, why it is used and who handles it. A DPDP Act compliance checklist for organisations usually covers: a personal data inventory; consent and clear notices (or a legitimate use the Act allows); using data only for its stated purpose and collecting only what is needed; reasonable security safeguards; a personal data breach response plan; handling the rights of Data Principals; erasing data once its purpose is served; extra care for children’s data; and contracts with the vendors who process data for you. DPDP Compliance Hub turns this into a structured assessment with a readiness score and a gap report.
What is a DPDP readiness assessment?
It is a structured way to assess data protection readiness under the DPDP Act. Your team answers a DPDP readiness assessment questionnaire area by area (personal data inventory, consent, notices, security, breaches, rights, retention and more), attaches evidence, and gets a readiness score with priority and improvement gaps to work on.
What are data fiduciary obligations under the DPDP Act?
A Data Fiduciary is the organisation that decides why and how personal data is processed. Its obligations include processing personal data only with valid consent or for a legitimate use, giving clear notice, keeping data accurate, protecting it with reasonable security safeguards, notifying personal data breaches, erasing data once the purpose is served, and providing a way to resolve grievances. A Significant Data Fiduciary has further duties, such as appointing a Data Protection Officer, an independent data auditor and periodic data protection impact assessments.
Do we need a Data Protection Officer?
A Data Protection Officer based in India is mandatory for Significant Data Fiduciaries, which the Central Government notifies based on factors such as the volume and sensitivity of the data they process. Every Data Fiduciary must publish the business contact details of a Data Protection Officer, if it has one, or of a person who can answer Data Principals’ questions about the processing of their personal data.
How should personal data breach management work under the DPDP Act?
Have a plan before a breach happens: detect and contain it, assess its impact, and notify both the Data Protection Board of India and each affected Data Principal. Under the DPDP Rules, 2025, affected people and the Board are informed without delay, with a detailed report to the Board within 72 hours of becoming aware of the breach. Keep records of what happened and what you did about it.
What does a consent and data principal rights assessment check?
It checks that consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, preceded by a clear notice, and as easy to withdraw as to give. It also checks that Data Principals can access information about their data, have it corrected or erased, raise grievances and nominate another person to exercise their rights.
What are the penalties for not complying with the DPDP Act?
The Data Protection Board of India can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach or to meet the obligations for children’s data, up to ₹150 crore for the additional obligations of Significant Data Fiduciaries, and up to ₹50 crore for other breaches. These are maximum amounts; the actual penalty depends on the circumstances.
Who is DPDP Compliance Hub for?
It is DPDP compliance software for organisations of any size that process personal data in India and want a practical path to Indian data privacy law compliance. It needs no prior technical or legal expertise: the questions come with explanations, the work can be shared across your team, and the results show where to focus. You can address the gaps internally or with an advisor of your choice.
General information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, not legal advice. Obligations depend on your organisation and the applicable provisions and commencement dates.
Need help?
Forgot your password?
Get a secure link to choose a new password. Reset password
New organisation?
Register your organisation and its Client Admin account. Register here
Contact us
Questions about your account or assessment? Contact your organisation’s Client Admin.