India's DPDPA creates a penalty framework unlike anything seen in Indian regulation before — fines up to ₹250 crore, a fast-moving enforcement body, and no cap on aggregate liability. This is the authoritative guide to what your business actually faces.
Five Penalty Tiers — Quick Reference
| Tier | Max Penalty | Violation | Who Is Exposed |
|---|---|---|---|
| Tier 1 | ₹250 Cr | Security safeguards failure (breach) | All Data Fiduciaries |
| Tier 2 | ₹200 Cr | Failure to notify DPBI & Data Principals | All Data Fiduciaries |
| Tier 3 | ₹200 Cr | Non-compliance with SDF obligations | Significant Data Fiduciaries |
| Tier 4 | ₹50 Cr | Violation of children's data provisions | Platforms serving under-18 users |
| Tier 5 | ₹10 Cr | Any other Act/Rules violation | All Data Fiduciaries |
Details on each of these penalties follow after the next few sections.
How to Avoid These Penalties
The DigiFortex team is well equipped to strengthen your DPDPA data privacy posture.
DigiFortex's team holds internationally recognised certifications in data privacy — CIPP/E from IAPP (the global standard for European privacy law) and DCPLA from DSCI/NASSCOM (India's premier data privacy credential). Our practitioners bring hands-on experience advising enterprises across BFSI, healthcare, and technology on exactly the penalty risks discussed here.
See Your DPDPA Privacy Exposure Before the DPBI Does
The DigiFortex Privacy Engine gives organisations real-time visibility into every dimension of their DPDPA risk — PII instances discovered, critical violations active, breach exposure score, and live compliance control coverage. Instead of finding out your penalty exposure from a Show Cause Notice, you see it on your dashboard and fix it before enforcement begins.
The DPDPA Penalty Framework: What Your Business Actually Faces
Schedule I of the DPDPA does not give regulators discretion on whether to penalise — it gives them a ceiling and a mandate. Five tiers. Fines up to ₹250 crore. No aggregate cap. One incident can trigger three tiers at once.
The DPBI: India's Data Protection Enforcer
The Data Protection Board of India operates entirely digitally — complaints filed online, notices issued through a central portal, orders published publicly. No paper. No delays. No years of regulatory patience. If your internal grievance mechanism does not work, DPBI complaints arrive faster and you pick up a Tier 5 violation at the same time. The Board can also act suo motu, without waiting for a complaint.
A Show Cause Notice is not a warning. It is the formal start of enforcement. If you are building your compliance posture after receiving one, you are already too late.
Breaking Down the Five Penalty Tiers
Security Safeguard Failure Resulting in a Personal Data Breach
Section 8(5) requires every Data Fiduciary to implement reasonable security safeguards. When a breach occurs and the DPBI determines those safeguards were inadequate, the ceiling is ₹250 crore per incident. The DPBI will examine your encryption posture, access controls, breach detection capability, patch management, and vendor security. Absence of any of these is an aggravating factor.
Failing to Notify the DPBI and Data Principals After a Breach
Section 8(6) requires notification to both the DPBI and every affected Data Principal within 72 hours of becoming aware of a breach. Partial disclosure, delayed disclosure, or notification that minimises severity each attract separate liability on top of Tier 1. Organisations that quietly patch a breach take on ₹200 crore of additional risk.
Significant Data Fiduciary (SDF) Obligations Not Met
Organisations designated as SDFs must appoint an India-based DPO accountable to their Board, conduct independent Data Audits, perform DPIAs for high-risk processing, and maintain algorithmic accountability records. Failure on any front: ₹200 crore. Most organisations do not yet know if they will be designated an SDF — that uncertainty is itself a risk that needs active management.
Children's Data Violations
If your platform is used by anyone under 18, you must obtain verifiable parental consent before processing their data. Behavioural monitoring, targeted advertising, and tracking of minors are explicitly prohibited — with no grace period and no safe harbour for accidental collection. The ₹50 crore ceiling applies per violation.
All Other Act and Rules Violations
The catch-all tier covers defective consent records, unanswered rights requests, missing grievance officers, purpose limitation breaches, and processor failures. Do not underestimate the ₹10 crore ceiling — if your consent mechanism is defective across one million Data Principals, each is a separate contravention.
The Cascade Risk: A single data breach typically triggers Tiers 1, 2, and 3 simultaneously — ₹250 Cr + ₹200 Cr + ₹200 Cr. Combined exposure from one incident: ₹650 crore. There is no aggregate cap under the DPDPA.
How the Fine Is Calculated
The ceiling is not the fine — Section 33 sets the formula. Seven factors push the number up or down. Most of them reward preparation over reaction.
| Factor | Impact | Practitioner Note |
|---|---|---|
| Nature, gravity & duration of breach | High — Aggravating | Prolonged breaches involving sensitive data attract maximum quantum. |
| Type of personal data affected | High — Aggravating | Financial, health, biometric & children's data attract higher penalties. |
| Number of Data Principals affected | High — Aggravating | Scale matters; millions of affected subjects push penalties toward ceiling. |
| Repetitive nature of default | High — Aggravating | Prior violations significantly increase quantum. First-time violators fare better. |
| Gain obtained / loss avoided | Aggravating | DPBI may calibrate penalties to exceed any commercial benefit from non-compliance. |
| Action taken to mitigate harm | Mitigating | Swift remediation, victim compensation & proactive DPBI cooperation reduce exposure. |
| Cooperation with the DPBI | Mitigating | Voluntary disclosure & transparency consistently reduce penalty quantum. |
From Complaint to Order: The Six Steps
DPBI Enforcement Process
- Grievance first: The Data Principal must exhaust your internal grievance mechanism before filing with the DPBI. A non-functional process accelerates DPBI complaints and adds Tier 5 liability.
- Complaint filed: Submitted digitally. The DPBI may also initiate proceedings suo motu. Government complaints bypass the grievance-first step.
- Show Cause Notice: Formal start of proceedings. Response timelines are prescribed and non-extendable without Board approval.
- Evidence submitted: Audit logs, consent records, security documentation, and breach timelines — all digital. The depth of your compliance programme is on trial here.
- Hearing & expert review: The DPBI may appoint technical experts. Organisations with no security documentation will find experts reaching unfavourable conclusions.
- Order published: Violation, quantum, and remediation directions — issued in writing and made publicly available. Reputational damage extends beyond the fine itself.
Who Gets Hit Hardest
Not every sector carries equal risk. Here is where the DPBI will look first.
| Sector | Primary Penalty Exposure & Risk Driver |
|---|---|
| BFSI | Tier 1 ceiling (₹250 Cr) for breaches of financial and identity data at scale. RBI/SEBI frameworks do not fully satisfy DPDPA consent obligations. |
| Healthcare | Health data attracts maximum scrutiny. Breach of medical records, diagnostics, or patient histories exposes organisations to Tier 1 and Tier 5 penalties simultaneously. |
| Ed-Tech & Gaming | Tier 4 (₹50 Cr) for every failure in parental consent verification. Behavioural monitoring and targeted advertising to minors are strict liability offences. |
| E-Commerce | Complex consent and purpose-limitation obligations from loyalty programmes and third-party marketing partnerships. Cross-border data sharing adds transfer compliance risk. |
| IT / ITES | Data Processors face contractual indemnities reversing Fiduciary penalties. Client contracts will routinely require DPDPA compliance warranties. |
| Telecom | Location data and communication metadata at massive scale. A single incident may affect millions of Data Principals — Tier 1 and Tier 2 penalties apply concurrently. |
How to Reduce Your Exposure
Section 33 explicitly rewards preparation. These five controls are what the DPBI looks for — and what moves your fine down.
- Breach Response Plan: A pre-built 72-hour notification workflow. The clock starts from awareness, not from investigation completion.
- Security Documentation: Encryption certificates, access control logs, pen test reports. Absence of records is aggravating, not neutral.
- Consent Records: Timestamped, purpose-specific, verifiable. If the DPBI asks for proof of consent, you must produce it.
- Grievance Mechanism: A functioning grievance officer with documented resolution timelines reduces DPBI complaint volume at every tier.
- Vendor Contracts: Data processing agreements with audit rights and breach notification clauses. If your vendor causes a breach, your contract is your defence.
One question the DPBI always asks: What did you have in place before this happened? Not after.
DPDPA vs GDPR
GDPR calculates fines as a % of global turnover — 4% cap. For a business with ₹500 Cr revenue, that is ₹20 Cr. The DPDPA fixes its ceiling at ₹250 Cr, per incident, regardless of turnover — 12.5x the GDPR exposure. GDPR enforcement takes years. The DPBI was built for speed. If your compliance programme was calibrated against GDPR, it is not calibrated for India.
Know Your Penalty Exposure
DigiFortex delivers AI-powered PII discovery, 72-hour breach notification, consent governance, and live DPDPA compliance scoring — in one platform. CIPP/E and DCPLA certified. Get your free Penalty Exposure Assessment.
Want this applied to your business?
30 minutes. A clear view of where you stand.
