DPDP penalties, the Data Protection Board and your compliance roadmap
The penalty schedule up to ₹250 crore, how the Data Protection Board works, Significant Data Fiduciary duties, cross-border transfers and a five-phase roadmap.
The DPDP Act's penalties are large enough to get the attention of any board of directors: up to ₹250 crore for a single category of breach. But the Act is also designed to reward organisations that act responsibly — through proportionate penalties, voluntary undertakings and a clear grievance-first process.
This final article in our series explains how enforcement works, the extra duties on Significant Data Fiduciaries, how cross-border transfers are treated, and a practical roadmap to be ready before the substantive obligations take effect.
The Data Protection Board of India
The Board is an independent, digital-first adjudicatory body established under the Act. Its provisions came into force as soon as the 2025 Rules were notified. Its main functions are to:
- direct urgent remedial or mitigation measures when a personal data breach occurs;
- inquire into breaches and complaints, and impose penalties;
- accept voluntary undertakings from Data Fiduciaries;
- refer matters for mediation where appropriate.
The Board functions as a "digital office": complaints, hearings and proceedings are designed to be conducted online. An individual must first exhaust a Data Fiduciary's grievance mechanism before complaining to the Board. Appeals against Board orders lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), generally within 60 days.
The penalty schedule
The Schedule to the Act sets maximum penalties per instance of breach:
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board or affected Data Principals of a breach | ₹200 crore |
| Non-fulfilment of additional obligations relating to children | ₹200 crore |
| Non-fulfilment of additional obligations of a Significant Data Fiduciary | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
| Breach of a voluntary undertaking accepted by the Board | Up to the penalty applicable to the original breach |
| Breach of duties by a Data Principal | ₹10,000 |
These are ceilings. When deciding the amount, the Board must consider the nature, gravity and duration of the breach, the type of personal data affected, whether it was repetitive, any gain made or loss avoided, mitigation steps taken, and whether the penalty is proportionate and effective. Penalties collected go to the Consolidated Fund of India — they are not paid as compensation to individuals.
Voluntary undertakings and repeat offenders
At any stage of proceedings, the Board may accept a voluntary undertaking from a Data Fiduciary — a commitment to take or refrain from specific actions within a set time. An accepted undertaking bars proceedings on the matters it covers, unless the undertaking is breached. For a business that discovers a problem, cooperating early and offering a credible remediation plan can be far better than contesting a penalty.
At the other end of the scale, where a Data Fiduciary has been penalised in two or more instances, the central government may — on a reference from the Board and after giving a hearing — direct that public access to its platform be blocked in the interests of the general public.
Significant Data Fiduciaries: the extra layer
The government can notify any Data Fiduciary or class of fiduciaries as "significant" based on factors such as the volume and sensitivity of data processed, the risk to Data Principals' rights, potential impact on India's sovereignty, electoral democracy, security or public order. Significant Data Fiduciaries must:
- appoint a Data Protection Officer based in India, responsible to the board of directors or similar governing body, who is the point of contact for grievances;
- appoint an independent data auditor to evaluate compliance;
- conduct a Data Protection Impact Assessment and an audit once every twelve months, and furnish a report of significant observations to the Board;
- exercise due diligence on algorithmic software they deploy, to verify it does not pose a risk to Data Principals' rights;
- ensure that personal data specified by the government on a committee's recommendation, and associated traffic data, is not transferred outside India.
Cross-border data transfers
The Act takes a "negative list" approach: personal data may be transferred to any country or territory outside India except those the central government restricts by notification. Sector-specific rules — for example, RBI's payment data localisation requirements — continue to apply where they are stricter.
The Rules add that transfers by a Data Fiduciary processing data in India, or in connection with offering goods or services to people in India, are subject to any requirements the government may specify by order regarding making data available to foreign states. For most businesses today, the practical tasks are to know where your data goes, keep vendor contracts current and watch for notifications.
Exemptions worth knowing
Section 17 exempts certain processing from most obligations — for example, processing necessary to enforce a legal right or claim, by courts and tribunals, for the prevention, detection, investigation or prosecution of offences, and processing of data of non-residents under a contract with a foreign entity. The Rules also set conditions for processing for research, archiving or statistical purposes. Exemptions are narrow: treat them as exceptions to be documented, not as a default.
A practical compliance roadmap
With the substantive obligations taking effect eighteen months after the Rules were notified — around mid-2027 — here is a sequence that works for most mid-sized organisations:
| Phase | Focus | Outputs |
|---|---|---|
| 1. Discover | Data inventory and flows | System register, data map, vendor list, legal basis per purpose |
| 2. Assess | Gap analysis against the Act and Rules | Risk register and prioritised remediation plan |
| 3. Remediate | Notices, consent, security, contracts | New notices and consent logs, processor addenda, safeguard upgrades |
| 4. Operationalise | Rights, breach response, retention | Request workflow, incident plan, retention schedule, training |
| 5. Assure | Testing and evidence | Penetration test, tabletop exercise, internal audit, board report |
A founder's one-page checklist
- Name an accountable owner for privacy, even if you are not a Significant Data Fiduciary.
- Build and maintain a data inventory covering every system and vendor.
- Rewrite notices and rebuild consent capture to the Section 5 and 6 standard.
- Publish a rights-request process and a grievance timeline of 90 days or less.
- Implement the Rules' security safeguards and retain logs for a year.
- Write and rehearse a breach plan with 72-hour Board reporting.
- Review child-user exposure and implement verifiable parental consent if needed.
- Update processor contracts for security, breach notice and erasure.
- Set a retention schedule and delete data you no longer need.
- Brief your board and record decisions — accountability is easier to prove when it is written down.
The DPDP Act rewards preparation. Organisations that treat it as an operational programme rather than a legal checkbox will find the deadline manageable — and will earn the trust of customers who increasingly care where their data goes.
