Breach and enforcement
What are the penalties under DPDP?
- Short answer
- Penalties are set per breach type in the Schedule and are levied by the Data Protection Board. The largest is up to Rs 250 crore for failing to take reasonable security safeguards. Failure to notify a breach carries up to Rs 200 crore.
The two figures are frequently conflated in commentary. Rs 250 crore attaches to the security safeguards failure, and Rs 200 crore to the notification failure. They are separate entries.
Other entries cover children's data obligations, Significant Data Fiduciary duties and breaches of other provisions, at lower amounts.
The Board decides the amount after an inquiry, taking into account the nature and gravity of the breach, the type of data affected, whether the conduct was repetitive, what the person gained or avoided, and what they did to mitigate.
Where this comes from
- Section 33 and the Schedule, DPDP Act 2023
The mistake people make
Quoting Rs 250 crore as the penalty for any DPDP breach. It is the cap for one specific failure.