Estimate your fine exposure under the DPDP Act 2023 Schedule — based on violation type, number of people affected, data sensitivity, and aggravating or mitigating factors.
The Schedule to the DPDP Act 2023 specifies the maximum penalty for each category of violation. The Data Protection Board determines the actual amount based on gravity, intent, and mitigating factors.
| Violation | Section | Maximum Penalty |
|---|---|---|
| Failure to implement adequate security safeguards leading to a data breach | Section 8(5) — Item 1 | ₹250 Crore |
| Failure to notify the Data Protection Board of a breach within 72 hours | Section 8(6) — Item 2 | ₹200 Crore |
| Violation of obligations related to children's personal data | Section 9 — Item 3 | ₹200 Crore |
| Failure to comply with Data Processor obligations | Schedule — Item 4 | ₹50 Crore |
| Any other violation of the Act or Rules (consent, retention, rights, etc.) | Section 8 — Item 5 | ₹50 Crore |
| Non-compliance with a direction or order of the Data Protection Board | Section 27 — Item 6 | ₹150 Crore |