DPDP Act penalties: what the Schedule actually says
The headline numbers in the DPDP Act are large. This is what the Schedule to the Act says, which breach carries which maximum, and what it does not say.
The Schedule, in a table
Section 33 and the Schedule to the Act set the maximum penalties. In every row, the penalty "may extend to" the amount shown. These are ceilings, not fixed fines.
| Failure | Maximum penalty |
|---|---|
| Not taking reasonable security safeguards to prevent a personal data breach (Section 8(5)) | Rs 250 crore |
| Not notifying the Board and affected people of a personal data breach (Section 8(6)) | Rs 200 crore |
| Not meeting the extra duties for children's data (Section 9) | Rs 200 crore |
| Additional duties of Significant Data Fiduciaries (Section 10) | Rs 150 crore |
| Breach of any other provision of the Act or Rules, including consent, notice and customer rights | Rs 50 crore |
| A data principal's duties under Section 15 | Rs 10,000 |
What this means for a store
- Failing to respect consent, to give a notice or to answer a customer's request falls under "any other provision", with a ceiling of Rs 50 crore.
- A data breach carries the highest ceilings: security failures and failing to report a breach.
- Tracking or profiling children, or targeting advertising at them, is covered by the children's-data row (Section 9(3) prohibits it).
What the Schedule does not say
The Act does not say that every breach leads to the maximum. Under Section 33, the Data Protection Board can impose a penalty only after an inquiry, and only if it finds the breach significant, after hearing the person concerned. It must weigh matters such as the nature, gravity and duration of the breach, the type of data involved, whether it was repeated, what the business did to limit the harm, and whether the penalty is proportionate. The numbers tell you how seriously the law takes the duties. They do not predict what a small store would be fined.
Cheap protection
The habits that reduce risk are not expensive: a clear notice, consent that customers actively give, a record of each decision, a way for customers to make requests, and a plan for what you will do if there is a breach. Consenfy helps with the first four. The breach plan is a process you set up yourself.