They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
₹250 Cr MAX PENALTY CEILING
DPDP Act 2023 · Sections 33–34 · Penalties & Enforcement
DPDP Penalties & Enforcement
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineThe DPDP Act 2023 establishes a robust penalty framework with fines up to ₹250 Crores for serious violations, enforced by the Data Protection Board of India.
Penalties reach up to ₹250 crore, imposed by the Data Protection Board of India.
₹250 CrMax penalty ceiling
₹200 CrBreach non-notification
1,000+Audits delivered
Data Protection Board of India · Sections 33–34 + the Schedule · Last reviewed October 2026
Direct Answer
What are the penalties under the DPDP Act 2023?
The Digital Personal Data Protection Act, 2023 empowers the Data Protection Board of India to impose monetary penalties of up to ₹250 crore for the most serious failures — chiefly a failure to take reasonable security safeguards to prevent a personal data breach. Penalties are fixed-rupee ceilings set out in the Schedule to the Act (not a percentage of turnover). They cap each category of breach rather than setting a sum per breach, and a single incident can engage more than one category.
The penalty framework was given operational shape by the DPDP Rules 2025, notified by the Ministry of Electronics and Information Technology (MeitY). Before fixing an amount, the Board must weigh the factors in section 33(2), such as the gravity and duration of the breach and how quickly and effectively you acted to mitigate it — so a documented compliance program directly reduces exposure. You can model a worst-case figure for your organisation with our DPDP penalty calculator, then explore the full slab-by-slab schedule below.
Key Takeaways
- The DPDP Act 2023 empowers the Data Protection Board of India to impose monetary penalties of up to ₹250 crore for the most serious failure — not taking reasonable security safeguards to prevent a personal data breach.
- The Schedule sets ceilings, not a sum per breach. One incident can still engage more than one entry, for example missing safeguards and a missed breach notice.
- Before fixing an amount, the Board must weigh the factors in section 33(2), including the nature, gravity and duration of the breach and how quickly and effectively you acted to mitigate it, so a documented compliance program materially reduces exposure.
- Orders can be appealed to the Telecom Disputes Settlement & Appellate Tribunal (TDSAT) within 60 days, with a further appeal to the Supreme Court on questions of law.
The Schedule
Penalty Schedule by Category
The Schedule to the DPDP Act 2023 fixes a maximum penalty for each category of default. Amounts are ceilings — the Board sets the actual figure case by case.
| Violation Category | Maximum Penalty | Severity |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a breach (Section 8(5)) | Up to ₹250 Crores | highest |
| Failure to notify breach to Board and Data Principals | Up to ₹200 Crores | highest |
| Non-compliance with obligations for children's data (Section 9) | Up to ₹200 Crores | highest |
| Breach of Significant Data Fiduciary obligations (Section 10) | Up to ₹150 Crores | high |
| Breach of a voluntary undertaking accepted by the Board (Section 32) | Up to the penalty for the original breach | varies |
| Breach of any other provision of the Act or the Rules | Up to ₹50 Crores | medium |
| Breach of Data Principal duties (Section 15) | Up to ₹10,000 | low |
At a Glance
Penalties at a Glance
- Failure to take reasonable security safeguards to prevent a breach (Section 8(5))Up to ₹250 Crores
- Failure to notify breach to Board and Data PrincipalsUp to ₹200 Crores
- Non-compliance with obligations for children's data (Section 9)Up to ₹200 Crores
- Breach of Significant Data Fiduciary obligations (Section 10)Up to ₹150 Crores
- Breach of a voluntary undertaking accepted by the Board (Section 32)Up to the penalty for the original breach
- Breach of any other provision of the Act or the RulesUp to ₹50 Crores
- Breach of Data Principal duties (Section 15)Up to ₹10,000
Enforcement & Mitigation
Board Powers & Mitigating Factors
Data Protection Board Powers
- Receive and adjudicate complaints from Data Principals
- Inquire on a breach intimation, a complaint, a government reference or a court direction
- Issue directions to Data Fiduciaries
- Impose monetary penalties as per Schedule
- Direct mediation (s.31) and accept voluntary undertakings (s.32)
- Seek assistance from other authorities
Mitigating Factors
Before fixing an amount, section 33(2) says the Board must have regard to:
- The nature, gravity and duration of the breach
- The type and nature of the personal data affected
- Whether the breach was repeated
- Any gain made or loss avoided because of the breach
- Action taken to mitigate the breach, and how timely and effective it was
- Whether the penalty is proportionate and effective as a deterrent
- The likely impact of the penalty on the person
The Appeal Route
Appeal to the Appellate Tribunal
60 Days
Time limit to file appeal from date of Board order
TDSAT
Telecom Disputes Settlement & Appellate Tribunal is the appellate authority
Supreme Court
Further appeal lies to Supreme Court on questions of law
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
DPDP Penalties — Frequently Asked Questions
Straight answers on penalty amounts, who imposes them, and how to reduce exposure.
What is the maximum penalty under the DPDP Act 2023?
The highest penalty under the Digital Personal Data Protection Act, 2023 is up to ₹250 crore. This top slab applies to a failure to take reasonable security safeguards to prevent a personal data breach (section 8(5)). The breach itself is not a separate entry in the Schedule. Failure to notify the Data Protection Board or affected data principals of a breach (a single entry in the Schedule), and non-compliance with children’s-data obligations, can each draw up to ₹200 crore. There is no percentage-of-turnover formula — penalties are fixed-rupee ceilings set out in the Schedule to the Act.
Who imposes penalties under the DPDP Act?
The Data Protection Board of India — a body established under the Act and notified by the Ministry of Electronics and Information Technology (MeitY) — adjudicates complaints and imposes monetary penalties. Section 27(1) lets the Board act on a breach intimation from a data fiduciary, a complaint from a data principal, a reference from the Central or a State Government, or a court’s direction. It has no power to start an inquiry on its own. Most of its inquiry powers, and its power to impose penalties, start on 13 May 2027. It can inquire into a consent manager’s breach of its registration conditions from 13 November 2026. It is designed to function as a digital-first, largely online adjudicatory body.
Are DPDP penalties charged per violation or per incident?
Neither, strictly. The Schedule sets a ceiling for each category of breach, and the Board fixes the amount after an inquiry, weighing the factors in section 33(2). One security incident can engage more than one entry: missing reasonable security safeguards (up to ₹250 crore) and failing to give the Board or affected data principals notice of the breach (up to ₹200 crore). Notice to the Board and notice to data principals are one entry in the Schedule, not two.
Can a DPDP penalty be reduced or appealed?
Yes. Before fixing an amount, the Board considers factors such as the nature and gravity of the breach, the type and nature of the personal data affected, whether the default was repeated, any gains made or losses avoided, whether the fiduciary acted to mitigate the breach and how timely and effective that was, whether the penalty is proportionate, and its likely impact on the person. Once an order is passed, it can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days, and a further appeal on a question of law lies to the Supreme Court.
How can a company reduce its DPDP penalty exposure?
The most reliable mitigation is a demonstrable, documented compliance program: a current data inventory, lawful consent flows, reasonable security safeguards (encryption, access control, logging), a tested breach-response playbook, and evidence of training. Because the Board must weigh the action you took to mitigate a breach and how timely and effective it was (section 33(2)(e)), organisations that can show they acted in good faith and remediated quickly are better placed. Tranquility Cybersecurity (TCSA) helps organisations build that evidentiary trail before an incident occurs.
Penalty risk is best managed before an incident. Start with the DPDP Act knowledge hub, model your exposure with the penalty calculator, and see verified outcomes from our compliance work on the proof page. When you want hands-on help, Tranquility Cybersecurity (TCSA) offers DPDP compliance consulting in India.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP Rules 2025
The rules under the DPDP Act, each with its start date and what it asks of a company.
Read morePrivacy
DPDP Breach Notification
Mandatory breach reporting obligations and timelines.
Read morePrivacy
Significant Data Fiduciary
Enhanced obligations for large-scale data processors under the DPDP Act.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read moreDPDP course · Module 4 of 8
Previous4.4 Personal data breaches: who you tell and whenCourse map8 modules · 79 lessons · 24 readyNext · Module 55.5 Sending personal data outside India
Next in the course: 4.9 How the Board sets a penalty: section 33(2). Surendra Pal Singh is writing it.