DPDP Penalties: What the ₹250 Crore Headlines Really Mean

What Penalties Actually Look Like Under the DPDP Act

The Digital Personal Data Protection Act, 2023 lists its penalty schedule in Section 33 and the Schedule to the Act, and it is more aggressive than Indian privacy teams unfamiliar with GDPR-style penalty regimes typically assume. The maximum penalty under the Act is ₹250 crore for a single failure, and the Act allows multiple failures to be penalised separately in the same proceeding. The headline numbers deserve attention — but the operational detail of how the Data Protection Board of India will assess, calculate, and impose penalties is where privacy teams actually need to focus.

Unlike the GDPR, which pegs its penalties to a percentage of global turnover, the DPDP Act uses fixed-rupee ceilings. This has two implications. First, large multinationals cannot plan for a penalty by referring to a turnover-linked cap — the ceiling is the same whether you process a thousand records or a billion. Second, the penalty is unmistakably punitive for Indian mid-market and SME Fiduciaries: a ₹200 crore penalty for notification failure is existential for most of them, and the Act does not grant the Board any formal small-business exemption to the penalty amounts.

The practical read is that the Board's effective enforcement will not be a function of maximum penalties but of mitigating factors. The Act provides a mitigating-factor framework in Section 33(2), and the DPDP Rules provide further detail on process. This post walks through each penalty band in the Schedule, the factors the Board weighs in setting a specific amount, the practical steps that reduce exposure, and the enforcement signals we are watching as the regime begins to produce decisions.

The ₹250 Crore Band — Security Safeguards and Breach Prevention

The top penalty band in the Schedule — up to ₹250 crore — applies to breach of the obligation to take reasonable security safeguards to prevent personal data breach under Section 8(5). This is deliberately framed around a reasonableness test rather than a specific technical standard: the Fiduciary must take appropriate technical and organisational measures, with the reasonableness assessed against the nature of the processing and the state of the art.

The penalty attaches to the preventive failure, not the breach itself. In other words, a Fiduciary that suffers a sophisticated breach despite a mature security program faces lower exposure here than a Fiduciary with weak controls that suffers a less sophisticated incident. This is the Board's lever to reward investment in security hygiene — and conversely to punish lax security as a standalone wrong, independent of whether a breach is detected.

For penalty-mitigation purposes, the evidence of reasonable safeguards is overwhelmingly built before any incident. The documented security program — risk assessments, access controls, encryption posture, logging and monitoring, patch management, third-party assurance, employee training — is the main input the Board will weigh. A Fiduciary without a documented program faces the full exposure of this band on first contact. A Fiduciary with a program that maps to recognised frameworks (ISO 27001, SOC 2, the CERT-In technical directions) can point to its posture and expect the Board to tilt sharply toward the lower end of the range.

The ₹200 Crore Band — Breach Notification Failures

The second band — up to ₹200 crore — covers two obligations: failure to notify the Board of a personal data breach, and failure to notify affected Data Principals of a personal data breach. Both are drawn under Section 8(6) and the detailed Rules. The band's practical sting is that the two failures are stacked in effect: a Fiduciary that notifies neither the Board nor the Principals faces both heads of exposure in the same proceeding.

The penalty structure is calibrated to encourage timely, complete notification even in the face of an uncertain investigation. The DPDP Rules permit a two-stage filing — the initial intimation without delay and the detailed 72-hour report — specifically so Fiduciaries can satisfy the obligation while the forensic picture is still developing. A Fiduciary that holds back the initial intimation while waiting for perfect information will typically draw a higher penalty than one that files promptly and corrects on the detailed report.

User notification carries a parallel discipline. The Rules require the Fiduciary to notify each affected Principal 'without delay', in plain language, through the user account or registered contact details. A Fiduciary that mass-mails a vague statement to a mailing list and treats this as compliance will be found short on both counts — the delivery mechanism and the content standard. The template preparation and rehearsal we have written about elsewhere is the single biggest mitigation lever for this band.

The ₹200 Crore Band — Children's Data Failures

The third major band — also up to ₹200 crore — attaches to breach of Section 9, which governs processing of children's personal data. Section 9 obliges Fiduciaries to obtain verifiable consent of the parent or legal guardian before processing a child's personal data, to abstain from processing that is likely to cause detrimental effect on the well-being of the child, and to abstain from tracking, behavioural monitoring, and targeted advertising directed at children.

The ₹200 crore penalty applies as a single band across these obligations, meaning that a Fiduciary with weak age-gating, unverifiable parental consent, or any form of children-directed tracking faces this exposure as its baseline. The band is one of the Act's clearest regulatory signals: the government has placed children's privacy at the same risk level as breach notification, and expects Fiduciaries operating children-adjacent services to invest proportionately.

Mitigation here comes from engineering decisions rather than paperwork. A documented age-gate at account creation, a parental-consent workflow that captures verifiable evidence of the parent-child relationship, a prohibition policy on behavioural tracking of accounts flagged as belonging to children, and a periodic audit of advertising audiences for inadvertent targeting are the measurable controls the Board will look for. A Fiduciary that cannot show these controls on first contact will likely draw a penalty near the top of the range, especially if the Board sees evidence of harm.

The ₹150 Crore Band — Additional Significant Data Fiduciary Obligations

The fourth band — up to ₹150 crore — covers breach of the additional obligations of a Significant Data Fiduciary under Section 10. These include appointment of a Data Protection Officer, independent Data Auditor appointment, periodic DPIAs, periodic independent audits, and the undertaking of algorithmic risk assessments where the Fiduciary's processing uses automated decision-making. The band also covers failure of the SDF to comply with any other measure the Central Government may notify.

This band is unique in that it applies only once the Fiduciary is notified by the government as an SDF — a status based on volume of processing, sensitivity of data, risk to Principals, and other criteria the government may specify. Fiduciaries notified as SDFs step up into a materially more demanding regime, and the Section 10 obligations are not optional add-ons but ongoing programme requirements. The band is designed to incentivise compliance by making the cost of non-performance substantial relative to the operational cost of the Section 10 obligations themselves.

For Fiduciaries that expect or have been notified as SDFs, the mitigation strategy is procedural rather than substantive. Each Section 10 obligation becomes a scheduled, documented workstream with named owners, due dates, and audit trail. A Fiduciary that cannot produce the DPIA records for its sensitive processing on request will fare worse under this band than one that over-documents even routine assessments. The Data Protection Board, in its early decisions, is widely expected to treat procedural rigour as a strong mitigating signal.

The ₹10,000 Band — The Data Principal's Own Duties

The lowest penalty band in the Schedule is unusual: it applies to the Data Principal, not the Fiduciary. The Act's Section 15 imposes duties on Data Principals — not to furnish any false particulars, not to suppress material information, not to impersonate another person, and not to file false or frivolous grievances. Section 15 is enforced through a maximum ₹10,000 penalty under the Schedule.

This provision has been more politically controversial than operationally impactful. The Board has signalled that it will not use this clause to deter legitimate DSR submissions, and Fiduciaries should not treat it as a shield against inconvenient requests. The Act's intent is to penalise genuine abuse — serial frivolous requests, impersonation of other users, deliberately falsified claims — and the Board will apply a high evidentiary bar before invoking the clause.

For privacy teams, the practical implication is to resist the temptation to escalate low-value user disputes under this clause. The reputational and regulatory downside of being seen to pursue Data Principals under Section 15 vastly outweighs any benefit from the ₹10,000 recovery. In most cases where this provision looks tempting, the correct response is to tighten identity verification on DSR intake rather than to prosecute a user.

How the Board Calculates a Specific Penalty

Section 33(2) provides a mitigating-and-aggravating-factor framework the Board must apply when setting a specific penalty amount. The listed factors are: the nature, gravity and duration of the breach; the type and nature of the data affected; whether the breach was repetitive; whether the respondent realised disproportionate gain; the action taken to mitigate the effects of the breach; the proportionality of the penalty; and the likely impact of the penalty on the respondent.

Several of these factors reward specific operational behaviours. The 'action taken to mitigate' factor directly favours Fiduciaries with a documented incident response that moved fast and completely — the detailed breach report filed with the Board, the user notifications completed, the remediation backlog closed. The 'disproportionate gain' factor cuts hard against Fiduciaries whose processing was commercially motivated, and favours those whose processing was for compliance or operational reasons.

The 'likely impact on the respondent' factor is the Board's safety valve for proportionality. In its early decisions the Board is likely to use this factor to avoid existential penalties for small and medium Fiduciaries, provided the facts show substantive cooperation and remediation. A Fiduciary that stonewalls the Board's inquiry forfeits this mitigation entirely. For penalty-mitigation planning, treat the first communication from the Board as the single highest-leverage event in the proceeding: a prompt, complete, cooperative response here changes the trajectory of the entire case.

Enforcement Timing and the Realistic Horizon

As of mid-2026, the Data Protection Board of India is operational but still ramping up. The Board's enforcement capacity is finite, and the realistic enforcement horizon in the first eighteen months after the Rules commence is a small number of landmark cases — on the order of ten to twenty — rather than a wide enforcement sweep. The Board's early docket will likely cluster around high-visibility breaches, children's-data failures by well-known platforms, and clear-cut notification failures.

This timing creates a tactical choice for Fiduciaries. The low probability of an immediate enforcement action tempts organisations to defer compliance investment, especially where the operational cost is high and the enforcement risk feels remote. The counterargument is twofold. First, the Board's early decisions will set precedents that structure enforcement for a decade — being on the wrong side of a landmark case is disproportionately costly. Second, the sector regulators (RBI, SEBI, IRDAI) are already treating DPDP compliance as a de facto audit criterion, and sectoral enforcement will outpace the Board's own schedule for regulated entities.

The practical recommendation is to prioritise the handful of controls that most reduce landmark-case risk: documented security safeguards sufficient to defeat a Section 8(5) finding, a tested breach workflow that can execute within the Rules' timelines, a children's-data posture that would survive first-pass scrutiny, and — for SDFs — the Section 10 obligations in motion with evidence. Everything else is good practice but second-order against the enforcement pattern we expect to see in 2026–27.

What TruePrivacy Does to Reduce Penalty Exposure

A privacy platform's job in the penalty regime is to make the mitigating-factor case for the Fiduciary almost automatically. TruePrivacy's design centres on this: every processing activity carries a lawful-basis record and a security-controls attestation that is auditable without staff intervention. Every DSR is logged with timing, scope, and verification evidence that can be produced on request. Every breach workflow records the awareness moment, the intimation delivery, the 72-hour report, and the Principal-notification audit trail — exactly the evidence Section 33(2) rewards.

For Significant Data Fiduciaries, the SDF module tracks each Section 10 obligation on a compliance calendar: the DPIA roster, the independent audit cycle, the algorithmic risk assessments, the Data Auditor appointments. The platform's design assumption is that the Board will ask for evidence, and the Fiduciary that can produce it in minutes rather than weeks will see penalties mitigated down the band — in some cases dropped entirely in favour of a compliance order. That mitigation posture is the Act's real risk management lever, and the operating discipline it demands is the platform's main value proposition for Indian Fiduciaries working through the first enforcement cycle.