Question · Penalties
DPDP Act penalties: what each band actually covers
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
The Schedule sets seven bands the Board may impose under Section 33: up to Rs 250 crore for failing reasonable security safeguards, Rs 200 crore for failing to intimate a breach, Rs 200 crore for children’s data failures, Rs 150 crore for a Significant Data Fiduciary’s additional duties, Rs 10,000 for a Data Principal’s duties, and Rs 50 crore for any other breach. They are ceilings, decided after an inquiry, on the factors in Section 33(2).
How the amount is decided
Section 33(1) requires a significant breach, found after an inquiry with the Fiduciary heard. Section 33(2) lists the factors: the nature, gravity and duration of the breach, the type and nature of the data affected, whether it was repetitive, any gain or loss avoided, mitigation taken, the proportionality of the penalty, and its likely impact on the person. Section 32 lets the Board accept a voluntary undertaking instead.
Why security is the largest
The single highest band attaches to Section 8(5) alone. Security failures are what cause breaches, and the Act prices them accordingly. Rule 6 sets the minimum safeguards; the Gevox scanner shows the visible edge of them on a public website, where sixteen of twenty advisor sites were missing HSTS or a Content Security Policy.
What the penalty does not do
Penalties go to the Consolidated Fund of India under Section 34. The Act gives the Data Principal no right to compensation; the compensation route under Section 43A of the IT Act was removed by Section 44. Section 42 lets the Government amend the Schedule but caps any increase at twice the original amount.
The seven bands
| Failure | Provision | Ceiling |
|---|---|---|
| Reasonable security safeguards not taken | Section 8(5) | Rs 250 crore |
| Breach not intimated to the Board or affected principals | Section 8(6) | Rs 200 crore |
| Children’s data obligations breached | Section 9 | Rs 200 crore |
| Significant Data Fiduciary duties breached | Section 10 | Rs 150 crore |
| Data Principal duties breached | Section 15 | Rs 10,000 |
| Voluntary undertaking breached | Section 32 | Up to the penalty for the underlying breach |
| Any other provision or rule | Act and Rules | Rs 50 crore |
Questions people ask
- Is Rs 250 crore the fine for any breach?
- No. It is the ceiling for failing reasonable security safeguards under Section 8(5). Other failures have lower ceilings, and the Board decides the amount within the ceiling.
- Can a customer sue us for damages under the Act?
- No. The Act provides penalties to the Board, credited to the Consolidated Fund, not compensation to individuals.
- Are penalties per individual affected?
- The Schedule sets a ceiling per contravention. Scale and repetition are factors the Board weighs under Section 33(2).
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.