How does the Data Protection Board of India (DPBI) determine penalty amounts?

Under Section 33(2) of the DPDP Act 2023, the Board determines penalties based on statutory factors including: (a) the nature, gravity, and duration of the breach; (b) the type and nature of personal data affected; (c) repetitive nature of the breach; (d) whether the Data Fiduciary took timely and effective mitigation steps; and (e) whether the penalty is proportionate to the breach.

What is the maximum monetary penalty under Schedule 1 of the DPDP Act 2023?

The highest statutory penalty is ₹250 crore (approx. $30M USD) under Schedule 1, Item 1 for failing to observe reasonable security safeguards to prevent a personal data breach under Section 8(5). Breaches of children data rules (§9) or failure to notify the Board of a breach (§8(6)) carry penalties of up to ₹200 crore each.

Are penalties cumulative across multiple statutory violations?

Yes. Schedule 1 lists distinct statutory penalties for different categories of breach. If an organization experiences a data breach (§8(5) up to ₹250 Cr), fails to report it to the Board within statutory timeframes (§8(6) up to ₹200 Cr), and improperly processed minor data (§9 up to ₹200 Cr), each breach can be independently adjudicated by the Board.

Does maintaining cryptographic consent receipts mitigate potential penalties?

Yes. Under Section 33(2)(d), the Board must evaluate whether the Data Fiduciary took mitigation measures and possessed verifiable audit trails. Cryptographically sealed receipts with HMAC-SHA256 signatures and Merkle tree roots satisfy the Section 6(10) burden of proof, establishing affirmative compliance and mitigating allegations of systemic negligence.

FREE INTERACTIVE AUDIT UTILITY

DPDP Act 2023 Statutory Penalty Exposure Calculator

Evaluate your organization's financial liability under Schedule 1 of the Digital Personal Data Protection Act 2023. Benchmark statutory risk against your sector, processing scale, and current safeguards.

Schedule 1 Item 1 (₹250 Cr)Schedule 1 Item 2 (₹200 Cr)Schedule 1 Item 3 (₹200 Cr)Schedule 1 Item 4 (₹150 Cr)Section 33(2) Factors

STEP 01 | INDUSTRY SECTOR

Select your primary operating industry

STEP 02 | PROCESSING SCALE

Annual volume of Data Principals processed

STEP 03 | PERSONAL DATA CATEGORIES

Check all sensitive or regulated categories you handle

Categories linked to specific statutory Schedule 1 fine escalations.

Financial or Payment Data (Bank accounts, UPI, cards, credit scores)

STATUTE: Schedule 1, Item 1 (§8(5)) · UP TO ₹250 CR

✓

Health, Medical or Biometric Data

STATUTE: Schedule 1, Item 1 (§8(5)) · UP TO ₹250 CR

✓

Children or Minors Data (under 18 years of age)

STATUTE: Schedule 1, Item 3 (§9) · UP TO ₹200 CR

✓

Behavioral profiling, ad tracking or cross-site pixels

STATUTE: Schedule 1, Item 4 (§10) · UP TO ₹150 CR

✓

Government identity documents (Aadhaar, PAN, Passport)

STATUTE: Schedule 1, Item 1 (§8(5)) · UP TO ₹250 CR

✓

STEP 04 | OPERATIONAL SAFEGUARDS

Which safeguards are currently deployed in production?

Checked items count as mitigating factors under Section 33(2).

Consent notice available in English and all 22 Eighth Schedule languages (§5(3))

✓

Cryptographically signed consent receipts with Merkle tree verification (§6(10))

✓

Automated 72-hour DPBI data breach reporting pipeline (§8(6))

✓

Verifiable parental consent verified before processing minor data (§9(1))

✓

Automated statutory legal holds (KYC/PMLA/tax) on erasure requests (§12)

✓

Designated resident Data Protection Officer or Grievance Officer published (§8(9))

✓

STATUTORY LIABILITY ASSESSMENT

CRITICAL STATUTORY EXPOSURE

Up to ₹250 Crore

MAXIMUM SCHEDULE 1 EXPOSURE TIER

Missing Safeguards:5 / 6

High-Risk Categories:2 checked

Adjudicating Body:Data Protection Board (DPBI)

High risk under DPDP Schedule 1. Missing 5 essential statutory safeguards leaves your organization directly exposed to maximum Board penalties.

Request Technical Remediation Plan Run Full 8-Point DPDP Checklist

DISCLAIMER: This tool generates statutory liability estimations based on Schedule 1 of the Digital Personal Data Protection Act 2023. Final penalty determinations remain under the statutory discretion of the DPBI pursuant to Section 33(2).

LEGAL REFERENCE & METHODOLOGY

Frequently Asked Questions on Schedule 1 Penalties

MATHEMATICALLY PROVABLE PROTECTION

Eliminate your statutory exposure with ConsentPlix

Deploy our sub-12KB consent SDK with 22-language notices and cryptographic Merkle receipts to build court-admissible audit proof under Section 6(10).

Schedule Architecture Consultation View Transparent Pricing