What is the DPDP Act penalty for a data breach in India?
The DPDP Act sets stiff financial penalties for data breaches and compliance failures. Here is the complete penalty structure.
What is the maximum penalty for a data breach under DPDP?
The maximum penalty for failure to implement adequate security safeguards that leads to a personal data breach is ₹250 crore. This is the ceiling — not the automatic fine. The Board determines the actual penalty based on the severity of the breach, the harm caused to data principals, the volume of data affected, whether the company cooperated with the investigation, whether it notified promptly, and whether it had implemented any safeguards. A company that had reasonable security controls and notified promptly would receive a lower penalty than one that had no controls and attempted to conceal the breach.
Is the penalty per breach or per data principal affected?
The Act sets penalty ceilings per violation — not per data principal affected. A single breach affecting 10 million individuals is one violation (failure to implement adequate safeguards), carrying a penalty of up to ₹250 crore. However, if the same breach also involves failure to notify the Board (a separate violation), the ceiling is an additional ₹200 crore. If children's data was involved and there was no parental consent (another separate violation), add another ₹200 crore ceiling. Multiple independent violations from the same incident can accumulate.
What factors reduce the penalty a company receives?
Mitigating factors in penalty assessment: having implemented reasonable security safeguards before the breach; promptly notifying the Board and affected individuals; cooperating fully with the Board's investigation; implementing remediation before or during proceedings; having a compliance programme in place (even if imperfect); the absence of prior violations; the Fiduciary's financial capacity; and voluntary undertakings to remediate. A company that reports a breach proactively, cooperates fully, and has a credible remediation plan will fare significantly better in penalty proceedings than one that conceals or minimises.
What factors increase the penalty a company receives?
Aggravating factors: deliberate or wilful non-compliance; concealment of a breach; failure to notify the Board; repeat violations; processing sensitive personal data with no safeguards; a large number of affected data principals; significant harm caused to individuals; commercial benefit derived from the non-compliant processing; and failure to cooperate with the Board's investigation. Enforcement actions globally against large companies for deliberate privacy violations have used the aggravating factor framework to justify maximum or near-maximum penalties.
How does DPDP penalty compare to GDPR fines?
GDPR allows penalties of up to €20 million or 4% of global annual turnover, whichever is higher — the 'higher' option means turnover-based fines can far exceed €20 million for large companies. Meta's €1.2 billion GDPR fine from Ireland in 2023 illustrates the scale. DPDP's ceiling of ₹250 crore (approximately €27 million at current rates) is broadly comparable for mid-sized companies but lower than GDPR's percentage-of-turnover model for very large companies. For most Indian businesses, ₹250 crore is a material financial exposure — not a theoretical maximum they can ignore.
Are individual executives liable for DPDP penalties?
The DPDP Act's financial penalties are imposed on the Data Fiduciary (the company). The Act does not explicitly impose personal financial penalties on individual directors or officers. However, wilful or deliberate non-compliance may create personal liability through other legal mechanisms (criminal provisions of other acts, company law liabilities for directors). More immediately, regulatory enforcement actions are career-defining events for senior executives — CEOs, CTOs, and CPOs at companies that face Board enforcement are publicly associated with those proceedings.
Frequently asked questions
Can a company negotiate or reduce a DPDP penalty?
The Board has discretion in determining penalties, and the Act provides for voluntary undertakings — a company can voluntarily commit to remediation steps, which the Board may accept as a basis for resolving the matter without a full penalty order or with a reduced penalty. Proactive cooperation, complete disclosure, and a credible remediation plan are the most effective tools for reducing penalty exposure. Engaging with the Board constructively rather than litigating every step is the approach most likely to result in a favourable outcome.
Does DPDP insurance exist to cover data breach penalties?
Cyber insurance policies increasingly cover regulatory fines and penalties — but the insurability of intentional or wilful violations varies by policy. Most standard cyber policies cover investigation costs, notification costs, and sometimes regulatory fines for negligent data breaches. Check your cyber insurance policy for DPDP-specific coverage now — before an incident — and ensure fines and penalties are included in the coverage scope. Note that many policies cap regulatory fine coverage significantly below the DPDP maximum.
Can the penalty be waived if we remediate immediately after a breach?
Immediate remediation does not waive the penalty for the underlying violation — the breach already occurred and penalties are assessed for past conduct. However, remediation before or during proceedings is a significant mitigating factor in penalty quantum. The Board is likely to impose a lower penalty on a company that has already fixed the underlying gap, implemented additional safeguards, and notified affected individuals than on a company that is still arguing about whether a violation occurred while continuing the non-compliant practice.
Reduce your DPDP penalty risk
Niti Bharat's DPDP Enforcement Defence Pack helps you document your compliance programme, prepare regulatory response materials, and build a penalty mitigation strategy before an incident occurs.
Get the Enforcement Defence Pack