DPDP Act monetary penalties up to Rs 250 crore (2026)

The DPDP Act 2023 does not scatter penalty amounts through its chapters. Every monetary cap sits in one place, the Schedule at the end of the Act, and one section, section 33, controls who imposes them and how they are sized. The Act calls them monetary penalties, not fines.

Who imposes penalties, and when

Only the Data Protection Board of India imposes monetary penalties, and only at the end of a process.

"If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule."

Section 33(1) of the DPDP Act 2023.

3 gates are built into that sentence. There must be an inquiry that has concluded, the Board must determine that the breach is significant, and the person must have had an opportunity of being heard. A penalty is the outcome of that process, not an automatic consequence of a breach.

The 7 caps in the Schedule

The Schedule pairs each category of breach with a maximum. Every figure is a ceiling that the penalty "may extend to", not a fixed amount.

The Schedule of penalty caps, the gate that stands before them and their commencement status. The headline states that every figure is a ceiling and that there is no power to impose one yet, and the subtitle that a monetary penalty can be imposed only under section 33, which commences 18 months after the Gazette was published. Section 33(1) is printed in full from Gazette pages 16 and 17: the Board may impose a penalty specified in the Schedule only on conclusion of an inquiry, only where it determines the breach is significant, and only after giving the person an opportunity of being heard, which are 3 gates before any figure below applies. Every figure below reads may extend to. The caps are drawn to scale. Entry 1, security safeguards under section 8(5), Rs 250 crore. Entry 2, breach intimation under section 8(6), Rs 200 crore. Entry 3, children's obligations under section 9, Rs 200 crore. Entry 4, Significant Data Fiduciary obligations under section 10, Rs 150 crore. Entry 7, any other provision of the Act or rules, Rs 50 crore. Entry 5, the section 15 duties of a Data Principal, is Rs 10,000 and too small to draw. A panel headed what a cap is not, typed as this site's reading, states that the Board fixes the sum rather than the Schedule, because section 33(2) has the Board have regard to 7 matters when it sets a figure within the cap, among them gravity, duration, repetition and the timeliness of any mitigation; and that entry 6, breach of a voluntary undertaking under section 32, carries no figure of its own, being capped at the amount applicable to the breach whose section 28 proceedings the undertaking settled. A panel headed not in force records that sections 28 to 34 carry the inquiry, the appeal and this penalty power, that notification G.S.R. 843(E) commences them 18 months after its Gazette was published, printed 13 November 2025, and that paragraph (b) puts only section 6(9) and section 27(1)(d) in a 1 year group; that both computed dates, 13 November 2026 and 13 May 2027, are interpretations until officially confirmed; and that the Schedule operates through section 33(1), so on this site's reading it commences with section 33 and no amount is reachable without it, sections 28(11) and 32(5) being the 2 routes to a penalty and both sending the Board to section 33. A second panel records a bounded appointment finding rather than another legal reason: G.S.R. 844(E) established the Board on 13 November 2025 and G.S.R. 845(E) notified that it shall consist of four members, but no appointment of a Chairperson or Member was located in MeitY's published document library through 24 October 2026. The wider 28 August 2026 search of official channels was not repeated and the eGazette search was not queried, so this is not a certified negative. The footer records that the Schedule is printed on Gazette page 21 under its heading with the reference See section 33(1), and that entry 5 is its only rupee figure below a crore.

Open the penalty caps diagram at full size.

• Security safeguards, section 8(5): a Data Fiduciary failing to take reasonable security safeguards to prevent personal data breach faces the highest cap, up to 250 crore rupees.
• Breach notification, section 8(6): failing to give the Board or affected Data Principals notice of a personal data breach, up to 200 crore rupees.
• Children's data, section 9: breach of the additional obligations in relation to children, up to 200 crore rupees.
• Significant Data Fiduciary obligations, section 10: breach of the additional obligations placed on a Significant Data Fiduciary, up to 150 crore rupees.
• Duties of Data Principals, section 15: breach of the statutory duties that the Act places on individuals, up to 10,000 rupees.
• Voluntary undertakings, section 32: breach of any term of a voluntary undertaking accepted by the Board. This is the 1 entry in the Schedule that names no figure of its own. Its penalty column reads "Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted", so the ceiling is borrowed from the proceedings it settled.
• Everything else: breach of any other provision of the Act or its rules, up to 50 crore rupees.

The Schedule places security safeguards at the highest ceiling. Breach intimation and children's obligations share the next ceiling, followed by Significant Data Fiduciary obligations. This is a comparison of the printed ceilings, not a separate rule of priority.

Does a missed CERT In report carry the Rs 200 crore DPDP cap?

No. The Schedule does not name CERT In, the 6 hour direction or section 70B. Its Rs 200 crore breach intimation row is entry 2, tied to section 8(6): notice to the Board or affected Data Principals under the DPDP Act, not notice to CERT In.

The separate CERT In direction says covered entities must report listed cyber incidents to CERT In within 6 hours of noticing them or being told about them. As at 28 October 2026, the consequence for failing to provide information called for or comply with a direction under section 70B(6) is in section 70B(7) of the Information Technology Act: imprisonment up to 1 year, a fine up to Rs 1 crore, or both. This is an IT Act fine, not a DPDP monetary penalty. The Jan Vishwas Act changed the figure from one lakh to one crore, and the consolidated Information Technology Act footnote records that change as effective from 30 November 2023.

The 6 hour CERT In and DPDP breach reporting regimes explains which incidents and organisations each route covers. The Jan Vishwas guide owns the separate review of the IT Act figures.

Is Rs 650 crore the total?

The Act does not print a Rs 650 crore total. Adding 250 + 200 + 200 creates scenario arithmetic from 3 selected Schedule ceilings. It is not an official Schedule figure and not a statutory penalty calculation.

Section 33 still requires a concluded inquiry, a finding that the breach is significant, an opportunity of being heard and a Board decision. Section 33(2) also requires the Board to consider 7 matters when setting an amount. The cited provisions do not settle whether distinct Schedule entries may be combined for 1 event or proceeding, so this page does not claim that aggregation is either required or forbidden. A worked estimate should name each assumed breach separately and label any sum as scenario arithmetic.

The cap is a ceiling, not the amount

Every figure above is a maximum. The amount actually imposed is chosen by the Board under section 33(2), which directs it to have regard to 7 matters when it fixes a figure within the cap. Whether the person acted to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of that action, is 1 statutory sizing matter. Keeping a dated record is this site's practical recommendation. The 7 matters are quoted in full and taken clause by clause in the Board process guide, which owns that question; this page stays with the amounts and the Schedule.

Where the money goes

Section 34 answers a question boards and CFOs often ask: penalties are not compensation to affected individuals. The reverse of that question, what an affected individual actually gets, is answered in can I sue under the DPDP Act.

"All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India."

Section 34 of the DPDP Act 2023.

When these provisions begin to operate

Sections 33 and 34 sit in the group that notification G.S.R. 843(E) brings into force 18 months from the publication of its gazette, printed 13 November 2025. That computes to 13 May 2027, and the computed calendar date is interpretation until officially confirmed. The notification names sections only; the Schedule takes effect through section 33(1), so the Schedule is presented as commencing with section 33, which is also a reading rather than an official statement.

Several expressly listed obligations, including sections 8 to 10 and 15, are in the same 18 month group. Other provisions have earlier commencement groups, but on this site's reading no Schedule amount is reachable until section 33 commences. This site's recommendation is to build the controls before the enforcement machinery switches on. The company action plan tool sequences that work, and the breach response tool covers the notification duty whose failure carries the 200 crore rupee cap.

Can a penalty be imposed today?

No. Section 33 has not commenced, which is the conclusive legal reason. A separate, bounded source check has also located no appointment to the Board, but that search result is not needed to reach the answer.

Section 33 has not commenced. Be exact about what that means, because the Act uses the word power in more than 1 place: section 27(1) confers on the Board the function to "impose penalty as provided in this Act", while section 33 authorises imposition of a monetary penalty specified in the Schedule. Every route to a Schedule amount runs through section 33. Section 28(11) has the Board, on completion of an inquiry, "either close the proceedings or proceed in accordance with section 33", and section 32(5) sends it the same way when a voluntary undertaking is broken. Sections 28, 32 and 33 are all in the 18 month group, so until they commence there is no route to a Schedule amount, however serious a breach was.

A separate appointment check is a scoped source finding. Notification G.S.R. 844(E) established the Data Protection Board of India on 13 November 2025, and G.S.R. 845(E) of the same date notified that the Board "shall consist of four members". An establishment notification appoints nobody, and a notified strength is not a staff. No appointment of a Chairperson or Member was located in MeitY's published document library through 24 October 2026. The 19 DPDP records include the circular and advertisement inviting applications, not an appointment. The wider search of official channels dated 28 August 2026 was not repeated, MeitY's library is not the Gazette and the eGazette search was not queried. This is a bounded account of what was located, not a certified negative and not a second legal basis for the answer. Whether the Board is operational owns the wider question and its other official records.

The distinction still matters: a commencement date appoints nobody, and an appointment commences nothing. For penalties today, however, section 33's status decides the answer by itself.

Nothing in the Schedule begins on the computed 13 November 2026

G.S.R. 843(E) has a 1 year group as well as an 18 month one, and the 1 year group is where the timeline is most often stated wrongly. Paragraph (b) puts exactly 2 provisions in it: section 6(9), which requires every Consent Manager to be registered with the Board, and section 27(1)(d).

Section 27(1)(d) is worth being exact about, because it does use the words "impose penalty":

"on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and"

Section 27(1)(d) of the DPDP Act 2023.

On this site's reading that clause puts no amount in play on 13 November 2026, a computed date that is interpretation until officially confirmed, and the words carrying the reading are "as provided in this Act". The clause refers a penalty to machinery elsewhere and supplies none of its own. The amounts are in the Schedule, which is reachable only through section 33(1); section 33(1) can be reached only "on conclusion of an inquiry"; the Board takes action on a section 27(1) matter under section 28(2); and the 2 provisions that actually send the Board to section 33, sections 28(11) and 32(5), are in the 18 month group, as are sections 28 to 34 entire. So what arrives in November 2026 under this notification is a registration duty and a Board function, with the penalty they refer to waiting on the sections that supply it. On this site's reading, no amount in the Schedule can be imposed on that date.