DPDP Act Penalty in India: Maximum Fines, Board Process and Compliance Tips

The DPDP Act 2023 puts a price on careless data handling, and the numbers are large: up to ₹250 crore for a single violation. Penalties are not automatic, though. They are ceilings set in the Act's Schedule, and the Data Protection Board of India decides the actual amount after hearing the organisation.

This guide explains which failures carry which maximum, what the Board looks at before fixing a figure, how a case moves from complaint to order, and what a company can do now to stay out of trouble.

The Act in brief

The Act became law on 11 August 2023 and governs digital personal data processed in India, and in some cases outside India. It gives individuals (Data Principals) rights and places duties on the organisations (Data Fiduciaries) that decide why and how data is used. Different provisions come into force on dates the Central Government notifies, so check the current commencement status before planning timelines.

What each failure can cost

The maximums below are drawn from the Act's Schedule. Each violation can be penalised separately, so ₹250 crore is a per-violation ceiling, not a total cap.

Significant Data Fiduciaries are firms the Government designates because of the volume and sensitivity of data they handle. Large banks, payment platforms, social media and e-commerce companies, health-tech firms and telecom providers are the usual expected candidates, but no final list should be assumed.

Children's data deserves special care

Before processing a child's data, an organisation must obtain verifiable consent from a parent or lawful guardian. It must also avoid processing that harms a child's well-being, tracking or behavioural monitoring, and targeted advertising aimed at children. Some classes of fiduciaries may be exempted by rule where processing is verifiably safe; schools are one example the original discussion gives.

How the Board fixes the amount

The Board weighs the nature, gravity and duration of the breach, the sensitivity of the data, whether it is a repeat offence, the harm to individuals, steps taken to limit damage, how quickly the Board was told, and whether the penalty is proportionate to the organisation's size.

From complaint to order

1. An individual complains, or the Board acts on its own.
2. The organisation is notified and given a hearing.
3. The Board can call for records, summon people and take evidence, with the powers of a civil court.
4. It issues an order with a penalty, directions, or both.
5. The organisation can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

At any stage, an organisation can offer a voluntary undertaking to stop the conduct and take specified steps. If the Board accepts it, proceedings can close without a penalty.

Ten steps that lower your risk

1. Map what personal data you collect, use, store and share.
2. Rewrite consent notices in plain, specific, unbundled language.
3. Let people withdraw consent as easily as they gave it.
4. Put a breach response plan with clear timelines in place.
5. Apply security safeguards: encryption, access controls and audit logs.
6. Add age checks and parental consent for children's data.
7. If you may be a Significant Data Fiduciary, plan for a DPO.
8. Prepare for an independent data audit.
9. Train staff on the Act and on individuals' rights.
10. Update vendor contracts with data protection clauses.

The first six are the urgent ones, because they sit closest to the highest penalties.

Common questions

What is the highest penalty? ₹250 crore, for failing to keep reasonable security safeguards.

Who imposes it? The Data Protection Board of India. Appeals go to TDSAT.

Can a penalty be reduced? Yes. A voluntary undertaking accepted by the Board can reduce or remove it.

Do banks need to worry? Yes. Large banks may be designated Significant Data Fiduciaries and face extra duties.

Final word

The figures are ceilings, but the factors behind them are within your control: safeguards, quick breach reporting and honest cooperation. Fix those before an incident, not after.