DPDP Act Penalties and the Data Protection Board of India
· Sri Tulasi Tech Labs
The DPDP Act is enforced by the Data Protection Board of India, a digital-first body that inquires into breaches and imposes monetary penalties. Understanding how it works helps organisations focus on what matters.
What the Board does
- Directs urgent remedial or mitigation measures after a personal data breach.
- Inquires into breaches of the Act, on a complaint by a Data Principal, a reference from the Government or a court direction, or on intimation of a breach.
- Imposes penalties after giving the organisation an opportunity to be heard.
- May refer disputes to mediation.
The Board functions as a digital office, receiving complaints and conducting proceedings online as far as practicable.
The penalty schedule
- Failure to take reasonable security safeguards to prevent a personal data breach — up to ₹250 crore.
- Failure to notify the Board or affected Data Principals of a breach — up to ₹200 crore.
- Breach of the additional obligations for children — up to ₹200 crore.
- Breach of the additional obligations of Significant Data Fiduciaries — up to ₹150 crore.
- Breach of the duties of Data Principals — up to ₹10,000.
- Breach of a voluntary undertaking accepted by the Board — up to the penalty applicable to the original breach.
- Any other breach of the Act or Rules — up to ₹50 crore.
How the amount is decided
These are maximums. In deciding a penalty, the Board considers the nature, gravity and duration of the breach; the type and nature of personal data affected; whether it was repeated; any gain made or loss avoided; the steps taken to mitigate its effects and how quickly; whether the penalty is proportionate and effective; and its likely impact on the organisation.
Voluntary undertakings
At any stage of proceedings, the Board may accept a voluntary undertaking from an organisation — for example, to take specified actions within a set time or to publicise its commitments. Accepting an undertaking bars proceedings on the matters it covers, unless the organisation fails to honour it.
Appeals
An organisation dissatisfied with a Board order may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within sixty days.
What this means in practice
Penalties scale with harm and with the care an organisation has shown. Documented security measures, a tested breach response and prompt mitigation all count in your favour.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.