India's Digital Personal Data Protection Act, 2023 (DPDPA) imposes some of the heaviest data protection penalties in the world. Businesses that fail to comply face fines ranging from ₹10,000 to ₹250 crore per violation, with the Data Protection Board of India (DPBI) empowered to impose penalties directly.

This guide breaks down every penalty category, who is at risk, and how to protect your business.

Penalty Schedule — Complete Breakdown

Who Is At Risk?

The DPDPA applies to every business operating in India that processes digital personal data, regardless of size:

• Startups and MSMEs — even a 2-person team with a website collecting email addresses
• E-commerce businesses — payment data, addresses, purchase history
• SaaS companies — user accounts, usage data, billing
• Mobile apps — device data, location, contacts
• Content websites and blogs — analytics, cookies, email signup forms
• Freelancers and consultants — storing client data digitally
• Foreign companies — processing data of individuals in India (extraterritorial reach)

Most Common Compliance Failures

1. No Privacy Policy — ₹50 Crore risk

The most basic requirement. Every website and app must have a clear, accessible privacy policy explaining what data is collected, why, and how users can exercise their rights. Most Indian websites still don't have a DPDPA-compliant policy.

2. No Consent Mechanism — ₹50 Crore risk

DPDPA requires explicit, informed consent before collecting personal data. A pre-ticked checkbox or buried terms in a lengthy document does NOT qualify as valid consent.

3. No Data Breach Response Plan — ₹250 Crore risk

If your business suffers a data breach without reasonable security measures, you face the maximum penalty. This includes lacking encryption, access controls, or an incident response plan.

4. Children's Data Without Parental Consent — ₹200 Crore risk

Processing data of anyone under 18 without verifiable parental consent carries severe penalties. Age verification and parental consent mechanisms are mandatory.

5. No Grievance Redressal — ₹50 Crore risk

Data Principals have the right to raise grievances. You must have a designated person or mechanism to handle data protection complaints within prescribed timelines.

Real Indian Data Breach Case Studies — Estimated DPDPA Exposure

The following are well-documented Indian data exposures from 2022–2025. The DPDPA was either not in force or its Rules were not yet notified when these occurred, so actual penalties were not imposed. We have modeled what the likely DPDPA exposure would have been if the Act were active and enforcement mature.

Modeled exposure reflects the statutory maximum per violation under the DPDPA Schedule. Actual penalties imposed by the DPBI typically apply mitigating factors (Section 33) and can be substantially lower if the entity demonstrates good-faith compliance effort.

DPDPA Exposure by Industry — What Your Business Actually Risks

Different industries trigger different DPDPA sections based on the personal data they process. Use the table below to estimate your exposure category.

How Penalties Are Determined

The Data Protection Board of India considers several factors when determining the penalty amount:

1. Nature, gravity, and duration of the violation
2. Type and nature of personal data affected
3. Whether the violation was repetitive
4. Whether the entity made any gain or avoided any loss
5. Whether the entity took mitigating actions (having a privacy policy counts!)
6. Any prior violations by the entity

Key insight: Having a privacy policy, even an imperfect one, demonstrates good faith compliance effort. The DPBI is likely to impose lower penalties on businesses that show they made reasonable attempts to comply.

DPDPA vs GDPR Penalties

How to Protect Your Business

1. Create a DPDPA-compliant privacy policy — Use our free generator
2. Implement consent mechanisms — Clear opt-in for data collection
3. Appoint a Data Protection Officer — Required for Significant Data Fiduciaries
4. Review your data practices — Use our compliance checklist
5. Implement security safeguards — Encryption, access controls, regular audits
6. Create a breach response plan — Know what to do when (not if) a breach occurs
7. Document everything — Demonstrate compliance efforts to reduce penalty risk

DPDPA Penalty FAQ

What is the maximum DPDPA penalty in India?

The maximum penalty under the Digital Personal Data Protection Act 2023 is ₹250 crore (approximately USD 30 million) for failure to take reasonable security safeguards that result in a personal data breach. This is imposed per violation by the Data Protection Board of India under Section 8(5) and the Schedule.

Who enforces DPDPA penalties?

The Data Protection Board of India (DPBI), a statutory body established under Chapter V of the DPDPA 2023, has direct authority to investigate violations, hold inquiries, and impose monetary penalties without requiring a court order. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Are DPDPA fines applied per violation or per affected user?

DPDPA penalties are imposed per violation, not per affected data principal. A single incident affecting 10 million users typically counts as one violation, capped at the Schedule maximum (₹250 Cr for security failures). However, the DPBI considers the number of affected users when determining the penalty quantum within that cap.

Can small businesses or startups face ₹250 crore fines?

Yes. Unlike GDPR which caps fines at 4% of global revenue, DPDPA imposes fixed maximum penalties regardless of company size. A 5-person startup that suffers a breach with no security controls is theoretically exposed to the same ₹250 Cr cap as a Fortune 500 company. In practice the DPBI considers gravity, intent, and mitigating factors when sizing the penalty — see our startup-specific DPDPA guide.

What is the penalty for not having a privacy policy under DPDPA?

Failure to provide notice (Section 5) or to fulfill any other Data Fiduciary obligation falls under the residual penalty bucket of up to ₹50 crore. While ₹50 Cr is the statutory maximum, even small businesses without a compliant privacy policy face inquiry, mandatory remediation, and reputational damage. Generating a DPDPA-compliant policy takes 2 minutes.

Has anyone been fined under DPDPA yet?

As of mid-2026 the Data Protection Board of India has begun its first round of inquiries following the publication of final DPDPA Rules in 2025. Several large breaches from 2023–2025 (Aadhaar-linked CSC leaks, telecom KYC dumps, fintech credential exposures) are under active investigation. Industry observers expect the first major DPDPA orders in late 2026.

How do DPDPA penalties compare to GDPR?

DPDPA caps fines at ₹250 crore (about EUR 28 million) per violation with fixed amounts in the Schedule. GDPR caps fines at the higher of EUR 20 million or 4% of global annual turnover. For very large global companies GDPR fines can exceed DPDPA, but for mid-size Indian businesses DPDPA exposure is substantially higher because it does not scale with revenue. Read our deeper DPDPA vs GDPR comparison.

Can I reduce my DPDPA penalty exposure?

Yes. The DPBI explicitly considers mitigating actions when setting penalties (Section 33). Concrete steps that reduce exposure:

• Publish a DPDPA-compliant privacy policy (generate one free)
• Implement a consent mechanism with one-click withdrawal
• Appoint a DPO if you qualify as a Significant Data Fiduciary
• Run an annual data audit using the DPDPA compliance checklist
• Document a written breach response plan
• Encrypt personal data at rest and in transit
• Log all data access and review the logs monthly

Related Resources

• DPDPA compliance checklist (free, downloadable)
• Who is actually at risk of the ₹250 Cr fine?
• DPDPA enforcement timeline: Phase 1 vs Phase 2
• DPDPA vs GDPR — key differences for Indian businesses
• Data Principal rights under DPDPA
• When does your business need a Data Protection Officer?