What is the maximum financial penalty under India's DPDP Act?
The DPDP Act's Schedule caps financial penalties at INR 250 crore (roughly USD 30M), which applies to failure to take reasonable security safeguards. Lower tiers cover breach-notification, children's-data and Significant Data Fiduciary obligations. There is no penalty tier above INR 250 crore.
Lower tiers in the same Schedule cover breach-notification failures, obligations owed in respect of children's data, and the additional duties placed on a Significant Data Fiduciary. The Data Protection Board of India adjudicates and imposes them.
If you have seen a much larger figure quoted, it is wrong. This is a number worth checking against the Schedule directly rather than repeating from a summary — including this one.
Sources
- Digital Personal Data Protection Act 2023, Schedule
Drafted with the tools on this site, then checked against the sources above by a practitioner before publishing. Reviewed 2026-08-07. Found something wrong? It should be corrected — this page is only worth as much as its accuracy.