The structure
The Schedule of Penalties to the DPDP Act caps civil penalties. There are no criminal offences in the Act — a deliberate departure from the IT Act. The caps:
- ₹250 crore — failure to take reasonable security safeguards (Section 8(5))
- ₹200 crore — failure to give breach notice to the Board / Data Principal (Section 8(6))
- ₹200 crore — failure to fulfil children's-data obligations (Section 9)
- ₹150 crore — failure of Significant Data Fiduciary additional obligations (Section 10)
- ₹50 crore — failure of any other duty
- ₹10,000 — failure of any Data Principal duty (Section 15) per instance
How the Board applies them
Section 33 lists the matters the Board takes into account when determining penalty quantum:
- Nature, gravity, duration of contravention
- Type and nature of personal data affected
- Repetitive nature
- Whether unjust enrichment
- Whether voluntary remediation
- Disproportionate impact on the contravener
- Effect on public
The cap is the ceiling, not the floor. Smaller, less-serious contraventions attract smaller penalties.
The compounding question
Multiple contraventions arising from a single incident can attract multiple penalties. A breach involving children's data, with delayed notification, processed by an SDF, with security inadequacies — could in principle attract penalties under Sections 8(5), 8(6), 9 and 10 simultaneously. Maximum theoretical exposure: ₹800 crore.
How to limit exposure
The factors most directly within your control:
- Reasonable measures: Section 8(5) penalises failure of security. Demonstrating a documented, evidenced security programme (Rule 6 controls implemented, audited, reviewed) limits exposure even if a breach occurs.
- Notification discipline: Section 8(6) penalises non-notification. Pre-built playbook, pre-drafted templates, designated decision-makers — all reduce the risk of late or non-notification.
- Voluntary remediation: Self-disclosed contraventions, with documented remediation, attract reduced penalties.
- Children's-data programme: Section 9 carries one of the highest caps. The single most leveraged investment is the verifiable parental consent flow plus marketing-system child-exclusion.
- Vendor flow-down: Section 8(2) makes you liable for processor failures. Strong DPAs and a vendor-DDQ programme limit this.
The board-pack view
For board-level reporting, present penalty exposure as: maximum theoretical exposure (sum of relevant caps) versus your residual exposure after current controls. Use Template 16 for the format. The trend in residual exposure over quarters is the most useful single metric.