Skip to main content
dpdprules.org
Data breached?
☰

Sources last verified on 17 August 2026. Methodology

DPDP Act 2023 · The Schedule

The Schedule: monetary penalties

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (Publication date 13 November 2025 printed on Gazette issue No. 757, plus eighteen months. The missing space in the phrase "section 6,sections 7 to 10" appears as printed in the Gazette text layer.)
Source
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) · Gazette page 21
Last verified
17 August 2026
Official requirement · verbatim

The Schedule.THE SCHEDULE [See section 33(1)] 1. Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. Penalty: May extend to two hundred and fifty crore rupees. 2. Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. Penalty: May extend to two hundred crore rupees. 3. Breach in observance of additional obligations in relation to children under section 9. Penalty: May extend to two hundred crore rupees. 4. Breach in observance of additional obligations of Significant Data Fiduciary under section 10. Penalty: May extend to one hundred and fifty crore rupees. 5. Breach in observance of the duties under section 15. Penalty: May extend to ten thousand rupees. 6. Breach of any term of voluntary undertaking accepted by the Board under section 32. Penalty: Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. 7. Breach of any other provision of this Act or the rules made thereunder. Penalty: May extend to fifty crore rupees.

Commencement basis · Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 other than section 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2) of the Act

“(c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.”

From commencement notification G.S.R. 843(E), Gazette issue No. 757, printed date 13 November 2025.

Sources cited on this page

  1. [1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule Schedule, p. 21. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026The Schedule is printed as a three column table (serial number, breach description, penalty). The Gazette text layer reads the table column by column; the text here re pairs each description with its penalty by the printed serial numbers 1 to 7 and marks each amount with the word Penalty, which is a presentation aid and not part of the printed text. The printed column headings (Sl. No.; Breach of provisions of this Act or rules made thereunder; Penalty) are not reproduced in the reconstructed text.
  2. [2]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ · Interpretation, requires judgment · Verified 17 August 2026Notification G.S.R. 843(E) names sections only and does not name the Schedule. The Schedule operates through section 33(1), which is in the eighteen month group, so the Schedule is presented as commencing with section 33. That reading is interpretation.
  3. [3]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ · Official requirement · Verified 17 August 2026
  4. [4]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), p. 1. Published 13 November 2025. Official source ↗ · Interpretation, requires judgment · Verified 17 August 2026The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.