How the penalties work
Penalties are monetary, imposed by the Board after it inquires into a complaint, a reference from the government or a breach intimation. The amounts in the Schedule are the maximum for each instance of breach.
The Board must consider factors including the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether it was repeated, any gain made or loss avoided, the steps taken to mitigate it and how quickly, and whether the penalty is proportionate and effective.
Why the biggest number is about safeguards
The highest head, up to 250 crore rupees, is for failing to take reasonable security safeguards to prevent a personal data breach. Rule 6 describes what those safeguards include: encryption, obfuscation, masking or virtual tokens, access control, logs and monitoring, keeping logs and personal data for a year for detection and investigation, backups for continuity, and contract terms with processors.
The penalty therefore turns on whether you protected the data, as well as on whether a breach happened. Records showing what controls were in place, and when, matter in that inquiry.
Which duties carry which ceiling
The Schedule sets a separate ceiling for each head of breach. A single incident can touch more than one, for example weak safeguards that lead to a breach that is then not reported.
When penalties become possible
The Board inquires and imposes penalties. Most of the duties these penalties enforce apply in Phase 3, around 13 May 2027 as notified, unless amended.
The Board can also accept a voluntary undertaking from an organisation during proceedings, which can include specific steps to put things right.
Reducing exposure in practice
The most effective defence is ordinary, documented work: an accurate inventory, working safeguards, a breach plan that has been rehearsed and evidence of each of them. TrustOS helps by keeping requirement, responsibility, action and evidence together, with evidence packs that can be verified cryptographically. It does not remove legal risk and is no substitute for legal advice on your exposure.
Maximum penalties per instance under the Schedule to the DPDP Act
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | Up to 250 crore rupees |
| Failing to notify the Board or affected Data Principals of a personal data breach | Up to 200 crore rupees |
| Breaching the additional duties for children's data | Up to 200 crore rupees |
| Breaching the additional duties of a Significant Data Fiduciary | Up to 150 crore rupees |
| Breach of any other provision of the Act or the Rules | Up to 50 crore rupees |
| Breach of a Data Principal's duties | Up to 10,000 rupees |
Official sources
- MeitY: Data protection framework (the Act, the Rules and notifications)
- India Code: Digital Personal Data Protection Act, 2023
This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.