Under the Schedule to the Digital Personal Data Protection Act, 2023, non-compliance attracts substantial financial penalties that can reach up to ₹250 crore per breach. Unlike the GDPR, which calculates fines as a percentage of global turnover, the DPDP Act sets absolute statutory caps enforced directly by the Data Protection Board of India (DPBI).
1. Statutory Penalty Matrix (The Schedule)
| Breach Category | Statutory Violation | Maximum Penalty |
|---|---|---|
| Failure to Prevent Data Breaches | Breach in observing reasonable security safeguards under Section 8(5). | Up to ₹250 Crore |
| Failure to Notify Breaches | Failure to give intimation of personal data breach to Board or affected users under Section 8(6). | Up to ₹200 Crore |
| Violation of Children's Data Duties | Breach in observing obligations in respect of children under Section 9 (tracking, ads, parental consent). | Up to ₹200 Crore |
| SDF Obligation Default | Non-fulfilment of additional duties by Significant Data Fiduciaries under Section 10. | Up to ₹150 Crore |
| General Non-Compliance | Breach of any other provision of the Act or Rules. | Up to ₹50 Crore |
| Data Principal Duties Breach | Breach in observing duties specified under Section 15 (e.g. false complaints, impersonation). | Up to ₹10,000 |
2. How the Board Determines Penalty Amounts (Section 33(2))
The DPBI does not levy the maximum penalty automatically. Section 33(2) mandates that the Board must consider specific mitigating and aggravating factors:
- Nature, Gravity, and Duration: The sensitivity of the compromised personal data, duration of exposure, and number of Data Principals impacted.
- Timely Mitigation & Remedy: How quickly the fiduciary contained the breach and mitigated harm to users.
- Disproportionate Gain or Avoided Loss: Any financial profits reaped through non-compliance.
- Repetitive Conduct: Whether the fiduciary has a history of prior statutory warnings or violations.
- Cooperation with the Board: Full transparency and forensic cooperation during digital inquiries.
3. Absence of Criminal Penalties & Focus on Civil Compensation
Unlike earlier data protection drafts in India, the DPDP Act 2023 contains no criminal jail provisions for corporate executives. All penalties are civil monetary fines paid into the Consolidated Fund of India. However, intentional fraud, hacking, or identity theft can still be prosecuted in parallel under the Information Technology Act, 2000 (Section 43A, 66) and the Bharatiya Nyaya Sanhita (BNS).