Back to Module
1 of 6|Penalties & Enforcement
video 20 min•Penalty Framework
Penalty Matrix
The complete breakdown of fines under the DPDPA.
🎯 Learning Objectives
- ▸ Memorize the key penalty amounts
- ▸ Identify which violations carry the highest fines
- ▸ Understand the tiered structure of penalties
The Schedule
The penalties under the DPDPA are not arbitrary; they are listed in the Schedule of the Act. The Board can impose these penalties after conducting an inquiry.
| Violation | Maximum Penalty |
|---|---|
| Failure to take reasonable security safeguards | ₹250 Crore |
| Failure to notify a breach | ₹200 Crore |
| Processing children's data without verifiable consent | ₹200 Crore |
| SDF non-compliance (DPO, audits, etc.) | ₹150 Crore |
| Failure to comply with Board directions | ₹150 Crore |
| General non-compliance (notice, rights, etc.) | ₹50 Crore |
These are MAXIMUM penalties. The Board has the discretion to impose a lower amount based on the facts of the case.
📖 Glossary
- Penalty Matrix
- A structured table that maps specific violations to their corresponding maximum penalties.
🔑 Key Takeaways
- Failure to protect data: Up to ₹250 crore.
- Failure to notify a breach: Up to ₹200 crore.
- Children's data violations: Up to ₹200 crore.
- General non-compliance: Up to ₹50 crore.
📚 Further Reading
- DPDPA Schedule — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...