Statutory Schedule of Penalties (Official Gazette)
Under Section 33(1) of the Digital Personal Data Protection Act, 2023, the Data Protection Board of India has statutory authority to levy monetary fines up to the following maximum caps:
| S. No. | Statutory Breach | Governing Section | Maximum Penalty Cap |
|---|---|---|---|
| 1 | Breach in observing obligation to take reasonable security safeguards to prevent personal data breach | Section 8(5) | ₹250 Crore(₹2,500,000,000) |
| 2 | Breach in observing obligation to notify the Board and affected individuals of a personal data breach | Section 8(6) | ₹200 Crore(₹2,000,000,000) |
| 3 | Breach in observance of additional obligations in relation to children and minors (tracking, targeting, parental consent) | Section 9 | ₹200 Crore(₹2,000,000,000) |
| 4 | Breach in observance of additional obligations of Significant Data Fiduciary (SDF) (DPO, DPIA, independent audits) | Section 10 | ₹150 Crore(₹1,500,000,000) |
| 5 | Breach in observance of duties by Data Principal (false grievances, impersonation, frivolous complaints) | Section 15 | ₹10,000 |
| 6 | Breach of any term of a voluntary undertaking accepted by the Board | Section 32 | Up to the amount applicable to the original breach that the proceedings under Section 28 were about |
| 7 | Breach of any other provision of this Act or the rules made thereunder (for example, tracking before consent or a defective notice) | General | ₹50 Crore(₹500,000,000) |
Detailed Analysis of Major Penalty Categories
1. ₹250 Crore Cap: Failure of Security Safeguards (Section 8(5))
This is the highest penalty in the DPDP Act. It applies if a business fails to protect stored customer data from leaks, hacks, ransomware, or unauthorized exfiltration due to missing encryption, poor access controls, or unpatched vulnerabilities.
2. ₹200 Crore Cap: Failing to Notify a Data Breach (Section 8(6))
Failing to report a security incident to the Data Protection Board of India and affected users triggers up to ₹200 Crore in penalties. The law eliminates the practice of keeping data compromises silent.
3. ₹200 Crore Cap: Breaching Children’s Data Rules (Section 9)
Processing a child’s data without verifiable parental consent, harmful processing, or tracking, behavioural monitoring or targeted ads aimed at children can bring up to ₹200 Crore in penalties. Parental consent does not make tracking or targeted ads lawful. EdTech and gaming platforms carry heightened exposure here.
4. ₹50 Crore Cap: General Compliance Violations
Any other breach falls under the general ₹50 Crore bracket. Examples include firing analytics or advertising cookies before the user consents, making withdrawal harder than giving consent, or not offering the notice in the user’s chosen Eighth Schedule language.
How the Caps Work
These are maximums (“may extend to”). The Board sets the actual amount using the Section 33(2) factors, and only after a hearing. Under Section 42, the government can amend the Schedule but cannot raise any penalty above twice its original amount. All penalties go to the Consolidated Fund of India (Section 34), not to affected users.
Calculate Your Organization’s Risk Exposure
If you are unsure where your website stands under these statutory caps:
- Run your domain through the ConsentPlix DPDP Website Scanner to inspect non-compliant tracking scripts and unauthorized cookies firing before consent.
- Calculate potential exposure across categories using our DPDP Penalty Calculator.
Check if your website complies with The Schedule
Scan your domain in seconds to detect tracking cookies, third-party analytics pixels firing before consent, and missing regional notices.