TABLE OF CONTENTS
₹250 crore- That’s how much a business in India can be fined for one data protection failure. And you don’t need a big, dramatic hack to get there. A data breach plus weak security is enough.
This is what the Digital Personal Data Protection (DPDP) Act, 2023 brings to the table. Its Rules came out in November 2025, so the clock is already ticking.
Many business owners think this law is only for big tech companies. It isn’t. If you collect names, phone numbers or email IDs from people in India, it applies to you too.
In this guide, you’ll learn about DPDP Act penalties in simple words: what causes them, how fines are decided and what you can do today to stay safe.
The DPDP Act is India’s first proper data privacy law. It applies to any business that handles digital personal data of people in India. Even foreign companies are covered if they sell to Indian customers.
The law uses two terms you’ll hear a lot. Your business is the “Data Fiduciary.” The customer or employee whose data you hold is the “Data Principal.”
In simple terms, you need to:
The DPDP Rules were notified in November 2025. Most rules start applying after 18 months, around May 2027. That might feel like plenty of time, but it really isn’t. Fixing forms, contracts and security takes months and the cost of DPDP Act non-compliance is much higher than the cost of getting ready early.
The Act lists seven types of fines. Here’s how DPDP Act penalties in India work (DPDP Act, 2023):
What Went Wrong | Maximum Fine |
Not Having Proper Security To Prevent A Data Breach | ₹250 crore |
Not Telling The Board And Affected People About A Breach | ₹200 crore |
Breaking The Rules For Children’s Data | ₹200 crore |
A Significant Data Fiduciary Missing Its Extra Duties | ₹150 crore |
Breaking A Promise (Voluntary Undertaking) Made To The Board | Same as the original breach |
Breaking Any Other Part Of The Act Or Rules | ₹50 crore |
An Individual Misusing Their Rights, Like Filing Fake Complaints | ₹10,000 |
Keep in mind, these are maximum amounts. Also, one incident can lead to more than one fine. If a breach happens because of weak security and you also report it late, both the ₹250 crore and ₹200 crore penalties could apply.
The biggest fine isn’t about getting hacked. It’s about whether you had “reasonable security” in place. The Rules explain what that means: encryption or masking of data, access controls, activity logs and keeping those logs for at least one year.
If a breach happens, you must tell the affected people quickly. You also have to send a detailed report to the Data Protection Board within 72 hours. Together, these two make up the main DPDP Act data breach penalties.
If any of your users are under 18, you need proper consent from their parents. You also can’t track children, monitor their behaviour, or show them targeted ads. Ed-tech, gaming and shopping apps need to be extra careful here.
Fines aren’t fixed. The Data Protection Board looks at a few things before deciding how much to charge (Section 33):
This means your actions after a breach really count. Acting fast, being honest and keeping good records can lower the fine. Hiding a breach or ignoring warnings will do the opposite.
One more thing: the fine goes to the government, not to the affected people. If a business disagrees with a penalty, it can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days.
DPDP Act non-compliance can hurt your business in other ways too.
First, there’s the risk of being blocked. If a business is fined in two or more cases, the government can block access to its app or website on the Board’s advice (Section 37).
Then there’s trust. 94% of organisations say customers won’t buy from them if their data isn’t properly protected.
You could also lose business deals. Big companies now often check how well suppliers protect data before signing contracts.
And there’s public attention. In 2024, Star Health faced heavy media and regulator focus after a breach reportedly exposed data of around 31 million customers.
Other countries show how serious regulators can get. In Europe, Meta was fined €1.2 billion under GDPR in 2023. In total, GDPR fines have crossed €5.8 billion since 2018.
Most DPDP Act violations won’t happen on purpose. They’ll come from small habits that seem harmless, like:
Not sure where to start? Here’s an easy order to follow for the main DPDP Act compliance requirements:
Good Cyber Security Services can make these much faster and easier. In the end, DPDP Act compliance is mostly about good security and good habits.
DPDP Act penalties are meant to be serious. India wants businesses to take personal data seriously and these numbers make that very clear.
There is good news; It is easy to avoid most penalties that one might incur. Hence, it is easy to have a solid plan for handling incidents, communicate security policy and consent and implement security measures early enough.
ECS is ready to assist you by providing you with everything you need. As your reliable Cyber Security Company in India, ECS will help you with any Cyber Security Services needed for DPDP compliance, which include risk assessment, data mapping, encryption, monitoring and incident response. We will help you avoid being caught off guard.
Get in touch with ECS to learn how to comply with the DPDP requirements long before they come into force!
They’re civil. The law only imposes fines, not jail time. But the fines are big enough to seriously hurt most businesses.
The maximum limits are the same for everyone. But the Board looks at what’s fair, so a small business is unlikely to be fined like a big tech company. The government may give some startups limited relief, but there’s no blanket exemption for small businesses.
There are two main ones. Up to ₹250 crore for not having proper security and up to ₹200 crore for not reporting a breach properly.
The Data Protection Board is being set up first. Most rules for businesses apply from around May 2027. It’s a good idea to check MeitY’s website for the latest dates.
