DPDP Act · Section 33 · Schedule
DPDP Act penalties: what the maximum fines cover
The DPDP Act sets different maximum penalties for different kinds of breach. The largest figure is not an automatic bill: the Board has to inquire into a significant breach and consider the facts before deciding whether to impose a penalty.
01 · The Schedule
Maximum penalties vary by the obligation breached
The Schedule to section 33 lists the maximum amount that may apply to each category. The Board determines whether a breach is significant and what penalty, if any, is appropriate after an inquiry.
- Up to ₹250 crore: failure to take reasonable security safeguards to prevent a personal data breach (section 8(5)).
- Up to ₹200 crore: failure to notify the Board or affected Data Principals of a breach (section 8(6)); and breach of the additional obligations relating to children (section 9).
- Up to ₹150 crore: breach of additional obligations of a Significant Data Fiduciary (section 10).
- Up to ₹50 crore: breach of any other provision of the Act or Rules.
- Up to ₹10,000: breach of the duties of a Data Principal under section 15.
The Schedule also addresses breach of a voluntary undertaking accepted by the Board. The applicable ceiling depends on the breach for which the proceedings were instituted.
Source: Schedule to the DPDP Act, 2023.
02 · Adjudication
A maximum penalty is not automatic
Under section 33, the Board may impose a penalty after concluding an inquiry that a breach is significant, and after giving the person an opportunity to be heard.
What happened and how far it reached
The Board considers the nature, gravity and duration of the breach, including its type and extent.
Impact and mitigation
Relevant factors include the kind of personal data affected, repeated conduct, any gain or loss avoided, and steps taken to mitigate the effects.
Cooperation and deterrence
The Act also lists proportionality, whether the penalty is effective and dissuasive, and other relevant circumstances.
See section 33(2) of the DPDP Act.
03 · Be ready
Build evidence into the controls you already need
A penalty table is more useful when it leads to practical ownership. Teams should be able to show how they protect data, handle incidents and direct service providers.
- Assign owners for security safeguards, breach response, child data and significant fiduciary duties where applicable.
- Keep an inventory of data, purposes, access routes and processors so incident scope can be established quickly.
- Maintain a response plan with decision points, affected-person communications and Board notification responsibilities.
- Record training, security reviews, processor instructions, remediation and lessons learned.
- Check the controls periodically and close gaps with a named owner and target date.
Related guides: breach notification, compliance checklist and data retention.
04 · Phased commencement
The penalty framework has a scheduled start date
Section 33 and the Schedule are scheduled to commence eighteen months after the notification dated 13 November 2025. Other provisions of the Act have separate commencement dates.
See the official commencement notification.
Questions teams ask
DPDP penalty FAQs
What is the highest penalty under the DPDP Act?
Up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach.
Can the Board impose the maximum for any breach?
The maximum depends on the category in the Schedule. The Board must follow the inquiry process and consider the factors in section 33; it is not an automatic fixed penalty.
Are penalties limited to data fiduciaries?
The Schedule covers obligations assigned to different persons, including a Data Principal’s duties and terms of a voluntary undertaking. The provision breached determines the applicable category.
When does section 33 take effect?
Section 33 is scheduled to commence on 13 May 2027 under the notification dated 13 November 2025.
Turn legal exposure into a practical work plan
Use the checklist to assign owners for the controls, records and response steps that support compliance.