DPDP reference
Section 33: Penalties
Last checked 6 Nov 2026
If the Board finds on concluding an inquiry that a breach is significant, it may, after a hearing, impose a monetary penalty specified in the Schedule (s.33(1)). The Schedule gives a ceiling for each kind of breach.
The amount turns on the nature, gravity and duration of the breach; the type of personal data; repetition; any gain made or loss avoided; the timeliness and effectiveness of action taken to mitigate; whether the amount is proportionate and effective; and the likely impact on the person (s.33(2)).
Schedule ceilings: security safeguards under s.8(5), ₹250 crore; breach notice under s.8(6), ₹200 crore; children under s.9, ₹200 crore; Significant Data Fiduciary duties under s.10, ₹150 crore; Data Principal duties under s.15, ₹10,000; voluntary undertaking under s.32, up to the extent applicable for the original breach; any other provision of the Act or Rules, ₹50 crore. The Government may raise a penalty to no more than twice the enacted figure (s.42(1)).
- Applies to
- Any person the Board finds in significant breach of the Act or Rules.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- This section and its Schedule set the penalties.
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 33; G.S.R. 843(E), commencement
Questions
What is the highest penalty under the DPDP Act?
₹250 crore, for failing to take reasonable security safeguards under s.8(5) (s.33, Schedule item 1).
Is the penalty a fixed amount?
No. The Schedule sets a ceiling. The Board fixes the amount against the factors in s.33(2).
Related
- Section 34: Crediting sums realised by way of penalties
- Section 42: Power to amend Schedule
- Section 8: General obligations of Data Fiduciary
- Section 9: Processing of personal data of children
Next
Not legal advice.