DPDP Act Penalties: What Non-Compliance Can Cost

Published on 10/18/2026 • Updated on 10/22/2026

A finance head reads a headline about data protection fines of hundreds of crores and asks whether his plant could be fined that much for an open visitor register. The honest answer has two parts. The figures are real maximums set in the law. They are also ceilings, not price tags, and what matters in practice is how a regulator treats a specific failure.

This guide sets out what the penalties in the Digital Personal Data Protection Act, 2023 are, which failures attract the largest ones, how the Data Protection Board is meant to decide, and what a facility can do now to reduce risk. It quotes the Schedule to the Act and the Press Information Bureau release of 17 November 2025. It is not legal advice.

The penalty schedule

Section 33 of the Act and its Schedule set maximum penalties. The table lists them.

The Press Information Bureau release summarises the main three tiers in the same way: up to Rs 250 crore for security safeguards, up to Rs 200 crore each for breach notification and children's data, and up to Rs 50 crore for other violations by a Data Fiduciary.

How penalties are decided

The Act sets up the Data Protection Board of India as an independent body that oversees compliance, inquires into breaches and ensures that corrective measures are taken, as the Press Information Bureau describes it. Appeals against the Board's decisions go to the Telecom Disputes Settlement and Appellate Tribunal.

The Act directs the Board to consider factors when deciding a penalty, including the nature, gravity and duration of the breach, the type of personal data affected, the repetitive nature of the breach and the steps taken to mitigate its effects. Read the full text of section 33 with your legal adviser, because the exact wording matters.

Why the security safeguard tier is the largest

The highest penalty applies to a failure to take reasonable security safeguards. Rule 6 of the DPDP Rules, 2025 says what reasonable means at a minimum: encryption, masking or virtual tokens, access control, logs and monitoring, data backups, one year of log retention and appropriate contract terms with processors.

• A visitor register open on a reception desk fails access control.
• A spreadsheet of staff phone numbers emailed to personal accounts fails any reasonable control.
• A processor with no contract terms on security leaves the fiduciary exposed.

For a facility, the first step is the register at the gate, since it holds data about many people and has the least protection.

The breach notification tier

Rule 7 requires a Data Fiduciary to tell each affected person without delay and to tell the Board without delay, with a detailed report within seventy-two hours of becoming aware, or a longer period the Board allows. Penalty exposure rises when a breach is hidden or delayed. Having a written routine and a named decision maker turns this into a drill instead of a scramble.

Children's data

The Act sets additional obligations for processing children's data, and Rule 10 requires verifiable consent from a parent or lawful guardian, with exemptions in Rule 12. Schools, hospitals and facilities with minors on site should check where children's data appears in their records. The penalty ceiling for breaching these duties is Rs 200 crore.

Reducing risk without a large budget

These steps do not guarantee that a penalty will never be imposed. They show that you identified the risks and acted on them, which is what a regulator looks for.

What management usually asks

Does the penalty fall on the company or on me?

The Schedule sets penalties for breaches by a Data Fiduciary, which is the organisation. Individual liability under other laws is a separate matter for your legal adviser. Name an accountable owner inside the company all the same, so someone is responsible for the routine.

Does a small site face the same duties?

The Act's duties apply to a Data Fiduciary, whatever its size, apart from exemptions the Act and Rules provide for specified classes. A small office that runs a visitor register is still a fiduciary for that data. The scale of the effort should match the scale of the data you hold.

What is the first thing the Board would ask for?

Expect questions about what personal data you hold, what safeguards you applied, when you found the breach and when you told people. Records that answer these questions in minutes are worth more than a long policy document. Keep a dated log of decisions, tests and training sessions. When an inquiry arrives, that log shows what you did and when, which is stronger than a statement that you meant to comply. Review the log every quarter and note any new risks, such as a new vendor or a new entry gate.

A worked example for management

The example is illustrative. It shows that the difference lies in preparation, not in luck.

Mistakes to avoid

Another mistake is relying only on a vendor's assurances. The fiduciary is responsible, even when a processor holds the data.

A third mistake is waiting for the commencement date. Penalties are tied to duties that start around mid-May 2027 under Rule 1, but the habits take months to build.

A 30-day risk reduction plan

Use a month to address the highest-tier risks.

Report the results to management with a short table of what changed.

Five-minute self-check

Check your exposure against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

The penalty figures are large because they are ceilings meant to deter. The practical lesson is to protect data, plan for a breach and delete what you do not need.

Start with the visitor register, masking and a written breach routine. They are low in cost and address the highest tiers.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.