The Bottom Line
The highest Schedule ceiling is upto Rs 250 crore. Applicability, commencement and findings determine exposure.
DPDPA Penalties and
Enforcement Architecture
Section 33 of the Digital Personal Data Protection Act, 2023 creates the penalty framework that the Data Protection Board of India will adjudicate.
Exhibit 1
Section 33, Complete Penalty Architecture
Commencement matters: the substantive processing duties, breach-reporting requirements and penalty adjudication provisions discussed here belong to the eighteen-month phase after Gazette publication under G.S.R. 843(E) and Rule 1. They are not yet operative. Existing CERT-In and other applicable legal obligations continue independently. Commencement notification.
| Schedule item / section | Breach | Statutory maximum | Qualification and status |
|---|---|---|---|
| Item 1 Section 8(5) | Failure to take reasonable security safeguards to prevent personal data breach | Upto Rs 250 crore | A security-safeguard breach must be established. A cyber incident does not by itself establish every statutory breach.Status: eighteen-month phase; not yet operative. |
| Item 2 Section 8(6) | Failure to give the Board or affected Data Principal notice of a personal data breach | Upto Rs 200 crore | Once operative, Rule 7 requires initial intimation without delay and a detailed Board report within 72 hours, or a longer period the Board allows on a written request.Status: eighteen-month phase; not yet operative. |
| Item 3 Section 9 | Breach of additional obligations relating to children | Upto Rs 200 crore | Apply Section 9 and the relevant exemptions. The involvement of children in an incident alone is not proof of a Section 9 breach.Status: eighteen-month phase; not yet operative. |
| Item 4 Section 10 | Breach of additional obligations of a Significant Data Fiduciary | Upto Rs 150 crore | Significant Data Fiduciary status requires Central Government notification under Section 10, not an assumed volume threshold.Status: eighteen-month phase; not yet operative. |
| Item 5 Section 15 | Breach of duties of a Data Principal | Upto Rs 10,000 | This category concerns the statutory duties of the Data Principal; it is not a processor penalty.Status: eighteen-month phase; not yet operative. |
| Item 6 Section 32 | Breach of a term of a voluntary undertaking accepted by the Board | Underlying breach ceiling | Upto the extent applicable to the breach for which proceedings under Section 28 were instituted; no independent fixed crore amount is specified.Status: eighteen-month phase; not yet operative. |
| Item 7 Other provisions / rules | Breach of any other provision of the Act or rules | Upto Rs 50 crore | The residual category applies where appropriate, including rights-related duties not covered by a specific Schedule category. There is no standalone Rs 10 crore processor category.Status: eighteen-month phase; not yet operative. |
Primary authority: DPDP Act, Sections 8–15, 32–33 and Schedule. Apply the facts, exemptions and operative provisions before assessing exposure.
Evidence needed for a readiness assessment
Readiness must be assessed from the organisation’s records. No sector percentage or assumed industry benchmark establishes compliance.
Processing and role map
Identify purposes, systems, personal data, Data Fiduciary decisions, processors, affected individuals and applicable exemptions.
Security and incident records
Review access controls, safeguards, incident chronology, vendor evidence, notifications and remedial action against the applicable obligation.
Consent and rights evidence
Check notices, the chosen statutory ground, withdrawal workflows, rights requests and grievance handling; a published policy is not evidence of operation.
Governance and designation
Check any Significant Data Fiduciary notification, responsibility allocation, audit findings, remedial owners and evidence retention.
Exhibit 3
The Data Protection Board, Enforcement Process
The enacted procedure must be read with commencement. Sections 27–29 and 33 govern jurisdiction, inquiry, hearing, penalty and statutory appeal.
Statutory trigger
Sections 27–28 specify the complaints, intimations, references and directions on which the Board may act. An inquiry requires sufficient grounds recorded in writing.
Risk
Identify the jurisdictional trigger and applicable commencement; do not assume a general power to act on any public signal.
Notice and response
Read the allegations, evidence requested, directions and response deadline in the notice. Preserve the record and prepare a factual and legal response.
Risk
Non-response can prejudice participation, but the Act does not state that every unprepared or missing response is automatically an admission.
Inquiry and hearing
Section 28 requires natural justice and a reasoned procedure. Present evidence, challenge unsupported allegations and distinguish established facts from assumptions.
Risk
A policy alone does not establish implementation; logs, contracts, training and decision records may be relevant.
Reasoned penalty decision
Under Section 33 the Board must find a significant breach after inquiry and give an opportunity of being heard before imposing a Schedule penalty.
Risk
A statutory maximum is not automatic. Assess each alleged breach and all seven Section 33(2) factors without mechanically adding ceilings.
Appeal to TDSAT
Section 29 provides an appeal to TDSAT within 60 days of receipt of the Board order or direction, with admission of a delayed appeal possible on sufficient cause.
Risk
Preserve proof of receipt and obtain advice on grounds and any interim relief. A High Court is not the ordinary first statutory appeal under Section 29.
Exhibit 4
The Seven Statutory Penalty Factors
Section 33(2) specifies these factors. They can affect the amount in either direction; they are not promised discounts or ranked weights.
Evidence standard
Keep contemporaneous evidence of the breach, its effects and mitigation. Neither appointing counsel nor producing a policy guarantees a reduced penalty.
Nature, gravity and duration
33(2)(a)Identify the conduct, its seriousness and how long the breach continued.
Type and nature of personal data
33(2)(b)Establish what data was affected, rather than assuming a fixed penalty from the incident label.
Repetition
33(2)(c)Consider the repetitive nature of the breach.
Gain realised or loss avoided
33(2)(d)Examine whether the person benefited financially as a result of the breach.
Mitigation
33(2)(e)Evidence the action taken to mitigate effects and consequences, including its timeliness and effectiveness.
Proportionality and deterrence
33(2)(f)The penalty must be proportionate and effective, having regard to observance and deterrence.
Likely impact on the person
33(2)(g)Consider the likely impact of imposing the monetary penalty on that person.
Assess allegations separately; do not add ceilings mechanically
An incident can raise more than one legal issue, but it does not establish every alleged breach. There is no automatic aggregate fine. The obligation, evidence, commencement, statutory category and Section 33 factors must be considered for each allegation.
Security
Examine the reasonable safeguards actually taken and the alleged failure under Section 8(5). The fact of an incident alone is not a complete liability analysis.
Notification
Examine awareness, recipients, content, timing and proof of delivery under Section 8(6) and Rule 7 once operative. CERT-In obligations run independently.
Rights and processor arrangements
Identify the relevant duty and residual category where applicable. Sections 11–13 do not carry a dedicated Rs 250 crore ceiling, and Section 8(2) creates no standalone Rs 10 crore processor fine.
AMLEGALS Recommendation
Build the Defence Before the Notice Arrives.
Immediate
- →Appoint DPDPA legal counsel
- →Conduct data breach readiness assessment
- →Review all vendor DPAs for DPDPA clauses
- →Document existing security safeguard architecture
Short Term
- →Complete personal data inventory
- →Build Data Principal rights mechanism
- →Draft DPDPA compliant breach notification protocol
- →Identify SDF designation risk
Programme
- →Full DPDPA gap assessment and remediation plan
- →Privacy policy and consent architecture rebuild
- →Staff training across HR, IT, marketing, procurement
- →Quarterly compliance audit programme established
Why AMLEGALS
The engagement starts with the relevant processing activity, incident or notice and a source-linked applicability assessment.
The legal work can include an evidence checklist, obligation map, response draft and remedial action register, with scope agreed in writing.
Technical findings, commercial arrangements and legal duties must be reconciled without assuming that one document proves compliance.
DPDPA Penalty Exposure Assessment
Source-linked assessment of potentially applicable duties and penalty categories, with evidence gaps and commencement qualifications.
Data Protection Board Defence Preparation
Pre-enforcement documentation programme that builds your evidentiary position before any notice arrives.
Breach Response Counsel
Immediate legal counsel when a breach occurs including notification strategy, Board communication, and penalty mitigation.
Ongoing DPDPA Monitoring Retainer
Continuous regulatory tracking, rules updates, and quarterly compliance audit with AMLEGALS counsel on record.
Questions and primary authorities
What is the maximum DPDPA penalty?
The highest ceiling in the Schedule is upto Rs 250 crore for breach of the reasonable-security-safeguards obligation under Section 8(5). It is not an automatic fine. Section 33 requires an inquiry, a finding of significant breach, an opportunity of hearing and consideration of the statutory factors. The penalty provisions belong to the eighteen-month commencement phase.
Where does an appeal against a Board order lie?
Section 29 provides an appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), ordinarily within 60 days of receipt of the order or direction. The Tribunal may admit a later appeal on sufficient cause. A High Court is not the ordinary statutory first appellate forum under this section.
Are rights breaches and processor breaches separate Rs 250 crore and Rs 10 crore categories?
No. The Schedule has no such categories. A rights-related breach may engage the residual ceiling of upto Rs 50 crore where applicable. A separately established security-safeguard breach has its own category. Section 8(1) places responsibility on the Data Fiduciary, including processing on its behalf; contractual and other legal liabilities require separate analysis.
What determines the amount?
Section 33(2) specifies nature, gravity and duration; type and nature of data; repetition; gain or loss avoided; mitigation and its timeliness and effectiveness; proportionality and deterrence; and likely impact on the person. Hiring counsel does not create a statutory discount.
Can Schedule ceilings be added to predict the fine for one incident?
No automatic aggregate follows from an incident. Identify each alleged obligation, evidence, applicable Schedule item and commencement position. Any penalty depends on findings and the statutory process; adding maxima is not a reasoned exposure assessment.
DPDP Act: Sections 27–29, 32–33 and Schedule · Rules: Rules 1 and 7 · Commencement notification