The DPDP penalty structure
In short
Penalties under the DPDP Act 2023 are monetary and civil. There is no imprisonment provision. Section 33 empowers the Data Protection Board of India, after an inquiry in which it finds a contravention significant, to impose a penalty up to the amount specified in the Schedule to the Act for that class of contravention.
The figures in the Schedule are maxima, not tariffs. The amount actually imposed is determined against the factors in Section 33(2).
01The Schedule, by class of contravention
| Entry | Contravention | Penalty up to |
|---|---|---|
| 1 | Failure to take reasonable security safeguards to prevent a personal data breach, under Section 8(5) | 250 crore rupees |
| 2 | Failure to give the Board or affected Data Principals intimation of a personal data breach, under Section 8(6) | 200 crore rupees |
| 3 | Breach of additional obligations in relation to children, under Section 9 | 200 crore rupees |
| 4 | Breach of additional obligations of a Significant Data Fiduciary, under Section 10 | 150 crore rupees |
| 5 | Breach of the duties of a Data Principal, under Section 15 | 10,000 rupees |
| 6 | Breach of a term of a voluntary undertaking accepted by the Board, under Section 32 | The extent applicable to the underlying contravention |
| 7 | Breach of any other provision of the Act or the rules | 50 crore rupees |
The entries are distinct heads. A single incident that involves both a safeguards failure and a notification failure engages entry 1 and entry 2, and the Board is not confined to one of them.
02What the Board weighs
Section 33(2) requires the Board to have regard to the nature, gravity and duration of the contravention; the type and nature of the personal data affected; the repetitive nature of the contravention; whether any gain was realised or loss avoided as a result of it; whether mitigating action was taken and how timely and effective it was; the proportionality and effectiveness of the penalty; and the likely impact of the penalty on the person concerned.
Two of those are directly within the organisation's control after an incident: whether mitigating action was taken, and whether it was timely and effective. Both are matters of evidence rather than assertion, which is why the contemporaneous record of the response matters as much as the response.
03Process, appeal and undertakings
- Inquiry first. A penalty follows an inquiry by the Board, with an opportunity of being heard. Under Rule 19(9) the inquiry is to be completed within six months of receipt of the intimation, complaint, reference or direction under Section 27, extendable by the Board for recorded reasons by up to three months at a time.
- Digital proceedings. Rule 20 provides that the Board functions as a digital office and may adopt techno legal measures to conduct proceedings without requiring physical presence.
- Appeal. An appeal lies to the Appellate Tribunal. Rule 22 requires it to be filed in digital form, with a fee of like amount to an appeal under the Telecom Regulatory Authority of India Act 1997, payable digitally.
- Voluntary undertaking. Section 32 allows the Board to accept a voluntary undertaking at any stage, and acceptance bars proceedings on that subject matter. Breach of the undertaking brings entry 6 of the Schedule into play.
- Where the money goes. Section 34 credits penalty sums to the Consolidated Fund of India.
04Common questions
What is the maximum penalty under the DPDP Act?
The highest figure in the Schedule is for failure to take reasonable security safeguards leading to a personal data breach. Check the current Schedule text before quoting the figure.
Are there criminal penalties?
No. The Act provides monetary penalties imposed by the Data Protection Board, not imprisonment.
Can a Data Principal sue for damages?
Enforcement runs through the Board rather than a statutory right of civil action, and the Act provides for a penalty on a Data Principal who breaches her duties under Section 15.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.