# DPDP Act penalties: the full Schedule, up to Rs 250 crore

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/penalties/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Every figure is a ceiling ("may extend to"), imposed only if the Data Protection Board finds the breach "significant" (s.33(1)).

## THE SCHEDULE
[See section 33 (1)]

| Sl. No. | Breach of provisions of this Act or rules made thereunder | Penalty |
|---|---|---|
| 1. | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to **two hundred and fifty crore rupees**. |
| 2. | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. | May extend to **two hundred crore rupees**. |
| 3. | Breach in observance of additional obligations in relation to children under section 9. | May extend to **two hundred crore rupees**. |
| 4. | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to **one hundred and fifty crore rupees**. |
| 5. | Breach in observance of the duties under section 15. | May extend to **ten thousand rupees**. |
| 6. | Breach of any term of voluntary undertaking accepted by the Board under section 32. | **Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted.** |
| 7. | Breach of any other provision of this Act or the rules made thereunder. | May extend to **fifty crore rupees**. |

*Signed:* DR. REETA VASISHTA, Secretary to the Govt. of India.


Section 33(2) factors: nature, gravity and duration; type of data; repetition; gain or loss avoided; mitigation and its timeliness; proportionality and deterrence; impact on the person. Penalties go to the Consolidated Fund of India (s.34); no compensation to individuals; civil courts barred (s.39). Appeals to TDSAT within 60 days (s.29). Blocking possible after two or more penalties (s.37). No criminal offences.