What are the penalties for non-compliance under India's DPDP Act?

Penalty amounts under the DPDP Act are tiered by the type of violation rather than a single flat ceiling - failing to take reasonable security safeguards to prevent a data breach carries a penalty of up to 250 crore rupees, failing to notify the Board and affected individuals of a breach carries up to 200 crore rupees, and other violations like failing to fulfill obligations related to children's data or significant Data Fiduciary obligations carry their own specified ceilings. The Data Protection Board determines the actual penalty within these caps based on factors including the nature and gravity of the breach, the type of personal data affected, and whether the entity took timely remedial action.

Unlike some regimes where penalties scale as a percentage of global turnover, the DPDP Act specifies fixed rupee ceilings per violation category, which makes the absolute exposure predictable but also means the penalty doesn't automatically scale down for a smaller company - a startup and a large multinational face the same statutory ceiling for the same violation type. Given this, building basic DPDP compliance (consent mechanisms, security safeguards, and a breach response plan) into operations early is considerably cheaper than the potential penalty exposure of getting caught without it later.