DPDP Act Penalties: What a ₹250 Crore Fine Actually Looks Like

Who this is for: founders, CEOs, boards and legal teams who need to understand the DPDP Act's financial exposure in concrete terms, and what actually drives the size of a penalty.

₹250 crore is the figure most often quoted about the DPDP Act. It is real, but on its own it is misleading. It is a maximum, not a typical amount. It applies to one specific failure. And it is not the only way an organisation can be penalised. Some incidents can lead to more than one penalty at once.

This explainer sets out every penalty in the Act, what triggers it, how the Data Protection Board decides the amount, and the decisions that most affect your exposure. For the obligations behind each penalty, see The DPDP Act, Explained.

The penalty schedule

Section 33 empowers the Data Protection Board to impose penalties set out in the Schedule to the Act. Each amount is a maximum per instance of breach.

The residual category is wider than it looks. It covers failures in notice, consent, withdrawal, rights handling, grievance redressal, retention and erasure, and processor contracts. These are the obligations most organisations will find hardest to evidence.

How the Board decides the amount

The Schedule sets ceilings, not fixed fines. Under Section 33(2), the Board must consider:

• the nature, gravity and duration of the breach
• the type and nature of the personal data affected
• whether the breach is repetitive
• whether the organisation gained, or avoided a loss, as a result
• the action taken to mitigate the effects, and the timeliness and effectiveness of that action
• whether the penalty is proportionate and effective, having regard to the need to secure compliance and deter breaches
• the likely impact of the penalty on the organisation

Before penalising, the Board must conduct an inquiry and give the organisation an opportunity to be heard (Sections 27 and 28). It can also direct the parties to attempt mediation (Section 31). At any stage, it can accept a voluntary undertaking from the organisation to take, or refrain from, specified actions (Section 32). An accepted undertaking can bar proceedings on that matter, but breaching it is itself penalised.

What exposure looks like in practice

These illustrative scenarios show how the Schedule applies. They describe maximum exposure only. Actual amounts will depend on the Board's assessment.

Scenario 1: an exposed cloud bucket. A retailer leaves a storage bucket containing customer addresses and order histories publicly accessible because access controls were never configured. The failure to apply basic safeguards required by Rule 6 engages Section 8(5), with a ceiling of ₹250 crore.

Scenario 2: the breach nobody reported. The same retailer finds out but decides the exposure was "minor" and notifies no one. Because the DPDP Act has no materiality threshold, this is a separate breach of Section 8(6), with its own ceiling of ₹200 crore. One incident now carries two penalties. Our Rule 7 breach notification playbook explains how to avoid this.

Scenario 3: targeted ads to teenagers. An edtech app runs behavioural advertising campaigns aimed at its users, many of whom are under 18, without verifiable parental consent. This engages Section 9, with a ceiling of ₹200 crore.

Scenario 4: the bundled consent form. A lender uses one signature on its loan application to cover marketing, group cross-selling and partner sharing. That fails the Section 6 standard for valid consent, and any processing that relies on it falls under the residual category, with a ceiling of ₹50 crore. See what makes consent valid under DPDP.

Consequences beyond the fine

Appeals. Orders of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (Section 29).

Blocking. Section 37 allows the central government, on a reference from the Board, to block public access to a fiduciary's platform in India. This power applies where the Board has imposed penalties on that fiduciary in two or more instances and advises blocking in the interests of the general public, after giving the fiduciary an opportunity to be heard. For digital businesses, this may be a larger risk than any single penalty.

Where the money goes. Penalties are credited to the Consolidated Fund of India (Section 34). The Act does not provide for compensation to affected individuals, which distinguishes it from the GDPR.

How DPDP penalties differ from the GDPR

• Fixed ceilings, not percentages. The GDPR caps fines at a percentage of global turnover. The DPDP Act sets fixed rupee amounts, regardless of company size. For a small company, ₹50 crore can be existential.
• Per instance. Penalties apply to each instance of breach, so related failures can stack.
• No compensation route. Individuals cannot claim damages under the Act. Their remedy is the grievance process and a complaint to the Board.

How to reduce your exposure

The Section 33(2) factors point directly at what lowers a penalty:

1. Prevent the biggest category. Implement and evidence the Rule 6 safeguards. The ₹250 crore penalty is for failing to take safeguards, not for suffering a breach despite them.
2. Never skip a notification. Reporting a breach removes the risk of the separate ₹200 crore penalty and counts as timely mitigation.
3. Evidence everything. The Board will judge what you can prove. Consent records, notice versions, rights request logs and breach timelines are your defence.
4. Act fast when something goes wrong. Timeliness and effectiveness of mitigation are explicit factors.
5. Use voluntary undertakings deliberately. Offering a credible remediation commitment early can resolve proceedings, but only commit to what you can deliver.

The Board's penalty powers over business obligations apply from 13 May 2027, as set out in the DPDP compliance timeline. No penalties have been imposed under the Act so far.

How ConsentifyAI helps

Most DPDP penalty factors come down to evidence: what you did, when, and how well. ConsentifyAI records consent, notices, rights requests and incident actions in a tamper-evident audit trail, and its compliance reporting maps each obligation to the controls and evidence behind it. If the Board ever asks, you can show a documented compliance history rather than reconstruct one under pressure.