Penalties explorer
The Schedule, without the scare tactics
Five violation categories, five statutory maximums. The Board determines any penalty after an inquiry — nothing here is automatic, sector-rated, or a prediction.
The DPDP Act does not set separate penalty rates for each sector. These are statutory maximums for violation categories, not predicted or automatic fines.
Statutory maximums at a glance
The five categories in detail
How penalties are actually decided
- The Data Protection Board of India determines any penalty after an inquiry — a listed maximum is not an automatic or predicted fine.
- Do not add category maximums together for a "worst case" number. The Board decides on the facts of the case before it.
- A personal data breach by itself is not proof that security safeguards were inadequate — that is a separate question the Board examines.
- Sector examples on this site are illustrative. Your exposure depends on your facts, not your industry label.
- The penalty provisions are scheduled to commence on 13 May 2027, with the Act's main duties.
The complete official Schedule
The Act's Schedule also covers duties of Data Principals (a ₹10,000 cap for filing false or frivolous complaints — the only penalty aimed at individuals) and voluntary undertakings the Board may accept instead of proceeding to a penalty.
| Schedule entry | What it covers | Amount |
|---|
Read the full Schedule in the official Act text: DPDP Act, 2023 — India Code PDF
Penalty regime scheduled to commence 13 May 2027
Better than studying fines
Reduce the odds of meeting the Board this way
Safeguards, notification runbooks and rights workflows — built calmly now — are what the penalty Schedule rewards later.