DPDPA penalties explained: what is at stake and how the Board decides

01The penalty tiers

These are ceilings, not tariffs. The Act does not say a failure costs ₹250 crore; it says the Board can impose up to that amount for that type of failure. Two other points worth knowing: the Board can also accept a voluntary undertaking from an organisation, which can end proceedings, and a Data Principal can themselves be fined a small amount (₹10,000) for breaching their own duties, for example by making a false or frivolous complaint.

02How the Board decides the amount

The Act directs the Board to consider the following when setting a penalty:

1. The nature, gravity and duration of the failure.
2. The type and nature of the personal data affected.
3. Whether the failure was repeated.
4. Whether you gained or avoided a loss as a result.
5. What you did to reduce the harm, and whether you gave relief to those affected.
6. Whether the penalty is proportionate and effective, and the likely impact on you.

03Penalty against the cost of a breach

It is easy to focus on the fine and forget the breach itself.

An average breach cost of ₹22 crore sits well below the top penalty tiers, but the two are additive: a breach with weak safeguards and late reporting can trigger both. Preventing the first and handling the second well are the same project.

04What enforcement tends to look like

The DPDPA Board is new, so there is no track record yet. The closest guide is the GDPR, now seven years into enforcement.

Three patterns stand out. Fines accumulated slowly and then reached roughly €1.2 billion a year. A few regulators and a few very large cases account for most of the total. And breach notifications grew steadily, to 443 a day across Europe. For India, a sensible planning assumption is that early activity focuses on complaints, notices and corrective directions, with large penalties following as the Board builds capacity. Do not read that as a reason to wait: the penalty provisions apply from the same date as the duties.

05How to reduce your exposure

• Fix safeguards first. They carry the biggest tier. Encryption, access control, logging and backups, with evidence.
• Rehearse the breach clock. Practise the first six hours and the 72-hour report.
• Paper your vendors. Data protection terms in every processor contract.
• Keep the evidence together. Dated, owned and retrievable.
• Consider a voluntary undertaking early if something does go wrong, on advice.

?Frequently asked questions

§Sources

1. Digital Personal Data Protection Rules, 2025 notified (Press Information Bureau)
2. DLA Piper GDPR Fines and Data Breach Survey, January 2026
3. Cost of a Data Breach Report 2025, India (IBM)
4. DPDPA Rules 2025: commencement and key changes (S.S. Rana & Co.)

Figures are quoted from the sources above and were checked on 6 November 2026. Laws and rules change; confirm the current text before relying on any of it. This is general information, not legal advice. Illustrative exhibits are marked as such.