Penalties & Offences under the DPDP Act 2023
The DPDP Act 2023 introduces some of the highest data protection penalties in the world � up to ?250 crore for a single violation. Unlike previous Indian privacy laws, the penalties are severe and designed to make organisations take data privacy seriously. This page breaks down every penalty, the enforcement process, the factors the Board considers, and how appeals work.
The 6 Penalty Categories at a Glance
Failure to Protect Data
The highest penalty is reserved for Data Fiduciaries who fail to take reasonable security safeguards to prevent a personal data breach. This applies to serious breaches affecting large numbers of individuals.
Failure to Notify Breach
If a data breach occurs, the Data Fiduciary must notify the Data Protection Board and affected individuals. Failure to report a breach in a timely manner attracts a heavy fine.
Children's Data Violations
Processing the personal data of children (under 18) without verifiable parental consent, or engaging in behavioral tracking/targeted advertising directed at children, carries massive penalties.
Significant Data Fiduciary (SDF) Non-Compliance
Significant Data Fiduciaries have extra obligations (appointing a DPO, independent audits). Failure to fulfill these enhanced duties as notified by the government results in this penalty.
Failure to Comply with Board Directions
The Data Protection Board has the power to issue interim or final directions to an organisation. If the organisation fails to comply with these official directions, a penalty can be imposed.
General Non-Compliance
Breach of any other terms or conditions of the DPDP Act (like failing to maintain accurate records or not providing proper notice) falls under this category.
1. Why the DPDP Act Penalties Are So Severe
India's previous data protection framework � the Information Technology Act, 2000 and its rules � imposed penalties that were, in practice, too small to deter large organisations. Fines of a few lakh rupees were often seen as the cost of doing business, and enforcement was fragmented across multiple regulators.
The DPDP Act 2023 changes this completely. It introduces a single, centralised enforcement authority (the Data Protection Board) and a penalty schedule with teeth � up to ?250 crore for the most serious violations. The message is clear: data protection is no longer a compliance checkbox; it is a boardroom-level priority.
The penalties are structured to reflect the gravity of the harm. The highest penalty is reserved for failures that cause or enable a personal data breach. The next tier covers failures to notify breaches and violations involving children. The lowest tier covers general non-compliance. This tiered structure ensures that the punishment is proportionate to the wrongdoing.
2. Full Penalty Schedule (Section-Wise)
The Schedule to the DPDP Act 2023 sets out the penalties. Here is the complete breakdown, mapped to the relevant section of the Act:
| Section | Violation | Max Penalty |
|---|---|---|
| Section 8(5) | Failure to take reasonable security safeguards to prevent a personal data breach | ?250 Crore |
| Section 8(6) | Failure to notify a personal data breach to the Board or affected Data Principals | ?200 Crore |
| Section 9(1) & 9(3) | Processing children's personal data without verifiable parental consent, or behavioral tracking/targeted advertising at children | ?200 Crore |
| Section 10 | Non-compliance by a Significant Data Fiduciary with its additional obligations | ?150 Crore |
| Section 27 | Failure to comply with directions issued by the Data Protection Board | ?150 Crore |
| General | Breach of any other provision of the Act not covered above | ?50 Crore |
Important: These are maximum penalties, not fixed penalties. The Board has discretion to impose a lower amount based on the facts of each case. The actual penalty depends on the factors listed in Section 33 of the Act.
3. How the Board Decides the Penalty Amount
The Board does not impose the maximum penalty in every case. Section 33 of the Act requires it to consider several factors before determining the penalty amount. These factors are designed to ensure that the penalty is proportionate, fair, and deterrent:
Nature, Gravity & Duration
How serious was the breach? How long did it continue? Was it a one-time lapse or a systemic failure?
Number of Data Principals Affected
A breach affecting 10,000 individuals is treated differently from one affecting 10 million.
Repetitiveness of the Breach
Is this a first-time lapse, or has the Data Fiduciary been penalized before for similar conduct?
Corrective Action Taken
Did the organisation act promptly to contain the breach, notify affected parties, and prevent recurrence?
Whether the Breach was Foreseeable
Was the risk known or reasonably foreseeable? Did the organisation ignore warning signs?
Gain or Avoidance of Loss
Did the organisation gain unfairly from the breach, or avoid a loss it should have incurred?
4. How Penalties Are Enforced
Penalties are not imposed automatically. The Data Protection Board follows a due process � giving the organisation a fair opportunity to be heard before any penalty is imposed. The process typically works as follows:
Complaint or Reference
The Board receives a complaint from a Data Principal, or a reference from the Central Government, or acts on its own motion (suo motu).
Preliminary Inquiry
The Board examines whether a prima facie case exists. Frivolous or vexatious complaints are dismissed at this stage.
Notice to the Data Fiduciary
A formal notice is issued, giving the organisation an opportunity to respond and present its side of the story.
Investigation & Hearing
The Board may summon witnesses, require documents, and conduct a hearing. Both parties are heard.
Reasoned Order
The Board passes a reasoned order � dismissing the complaint, issuing directions, or imposing a penalty.
Appeal to TDSAT
Aggrieved parties can appeal to the TDSAT within 60 days. The TDSAT decision is final and binding.
Key point: The Board is not bound by the Code of Civil Procedure, but it is expected to follow the principles of natural justice � notice, hearing, and a reasoned order. Appeals against the Board's orders lie to the TDSAT.
5. Real-World Scenarios
To make the penalties concrete, here are four hypothetical scenarios illustrating how different violations could attract different penalties:
Scenario A: Large-Scale Data Breach
Up to ?250 CroreA fintech company with 5 million users suffers a breach exposing names, PAN numbers, and bank details. The company had no encryption at rest and no access controls. The Board found that reasonable security safeguards were absent.
Scenario B: Delayed Breach Notification
Up to ?200 CroreA healthcare provider discovers a breach but delays notifying the Board and affected patients for 30 days. The breach itself was minor, but the delay prevented timely remedial action.
Scenario C: Children's Data Violation
Up to ?200 CroreAn ed-tech platform collects data from children under 18 without verifiable parental consent, and uses behavioral tracking to serve targeted ads.
Scenario D: SDF Non-Compliance
Up to ?150 CroreA social media platform designated as a Significant Data Fiduciary fails to appoint a Data Protection Officer, conduct independent audits, or submit a DPIA report.
Note: These are illustrative scenarios only. Actual penalties depend on the facts of each case and the Board's discretion.
6. Can Directors Be Personally Penalized?
Yes. Under Section 37 of the DPDP Act 2023, if a company commits an offence, the Board can proceed against the directors, managers, and other officers who were in charge of the company's affairs at the time of the contravention. This is a significant shift � it means that data protection is not just a corporate liability but a personal one for senior management.
The Act provides a defence: an officer can escape liability if they can prove that the contravention took place without their knowledge, or that they exercised due diligence to prevent it. But this defence is not easy to establish � it requires documented evidence of active oversight, not just a claim of ignorance.
This is why we recommend that boards and senior management take a hands-on approach to DPDPA compliance � not just delegate it to the IT team. For a deeper dive, see our Director Liability insight.
7. How Do DPDP Penalties Compare with GDPR?
GDPR fines go up to �20 million or 4% of global annual turnover, whichever is higher. For a global enterprise with �10 billion in revenue, the GDPR cap is �400 million � much higher than DPDP's ?250 crore (approximately �28 million).
However, for Indian SMEs and mid-market companies, the DPDP penalties are equally severe relative to their size. A ?50 crore penalty for an Indian company with ?200 crore revenue is a business-ending event. The DPDP Act also has a broader scope in some respects � for example, its rules on children's data are stricter than GDPR's.
The key takeaway: whether you are a global enterprise or an Indian startup, DPDPA compliance should be a board-level priority.
Shilpi Kulshrestha
Founder, BusinezExcellence | Corporate Law & Company Secretary Expert
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy governance, and AI compliance.
Frequently Asked Questions
What is the maximum penalty under the DPDP Act 2023?+
The maximum penalty is ?250 crore, imposed on Data Fiduciaries who fail to take reasonable security safeguards to prevent a personal data breach. This is one of the highest data protection penalties in the world.
Who imposes penalties under the DPDP Act?+
Penalties are imposed by the Data Protection Board of India (DPB), the regulatory authority established under Section 18 of the DPDP Act 2023. The Board follows a quasi-judicial process � issuing notice, hearing the parties, and passing a reasoned order.
Can penalties under the DPDP Act be appealed?+
Yes. Under Section 29 of the DPDP Act, any person aggrieved by an order of the Board may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days of receiving the order.
Are DPDP Act penalties imposed automatically after a breach?+
No. Penalties are not automatic. The Board conducts an inquiry, considers factors such as the nature and gravity of the breach, the number of Data Principals affected, the repetitiveness of the breach, and whether the Data Fiduciary took corrective action, before imposing a penalty.
Can directors be personally penalized under the DPDP Act?+
Yes. Section 37 of the DPDP Act allows the Board to proceed against directors, managers, and other officers of a company if the offence was committed with their consent, connivance, or due to their neglect. Personal liability can attach even if the company is penalized.
What is the penalty for failing to notify a data breach?+
Failure to notify a personal data breach to the Board and affected Data Principals can attract a penalty of up to ?200 crore. This is separate from the penalty for the breach itself, which can be up to ?250 crore.
Does the DPDP Act have criminal penalties?+
No. The DPDP Act 2023 is a civil law � it imposes civil penalties, not criminal penalties. However, non-compliance with Board directions can attract additional civil penalties, and individuals (directors, officers) can be held personally liable.
How does the DPDP Act penalty compare with GDPR?+
GDPR fines go up to �20 million or 4% of global annual turnover, whichever is higher. DPDP Act fines go up to ?250 crore (approximately �28 million). For large enterprises, GDPR fines can be much higher; for smaller Indian businesses, DPDP fines can be equally severe relative to their size.
Related Topics on Compliance
Data Protection Board
The authority that enforces the Act and imposes penalties.
Obligations of Data Fiduciary
Learn what you must do to avoid these penalties.
Rights of Data Principals
The rights that trigger penalty exposure.
Director Liability
Can directors be personally penalized?
DPDPA Complete Guide
End-to-end guide to the Act.
Cross-Border Data Transfer
Penalties for unlawful cross-border transfers.
Don't wait for a penalty notice.
Our compliance experts can help you assess your penalty exposure, build a defensible compliance programme, and prepare for potential Board inquiries.
Disclaimer: This page is for educational and informational purposes only. It is not legal advice. The penalty amounts shown are maximums under the Act � actual penalties depend on the facts of each case. For advice on your specific situation, consult a qualified legal professional.