DPDPA Penalty Calculator
Up to ₹250 Crores. Per contravention. Board-determined.
Penalties under DPDPA 2023 are not capped per organisation — they are calculated per contravention, with the Schedule prescribing seven Schedule entries. The Data Protection Board considers seven factors when fixing penalty quantum. This guide maps the entire penalty architecture.
Schedule entries
Schedule, DPDPA 2023Statutory assessment factors
Section 33(2)Highest single contravention
Para 1, ScheduleOn cumulative penalty exposure
Per organisationThe penalty is not capped per organisation. It is capped per contravention.
Section 33 of DPDPA 2023 empowers the Data Protection Board of India to impose monetary penalties for contraventions specified in the Schedule. The Schedule prescribes seven Schedule entries of contravention with distinct penalty ceilings.
Crucially, a single breach event can attract penalties under multiple Schedule entries simultaneously — inadequate security safeguards (Para 1), failure to notify (Para 2), and breach of other provisions (Schedule item 7). The Board adjudicates each contravention separately under Section 33.
When the Board determines penalty quantum, it weighs seven statutory factors. Two organisations with identical contraventions can face materially different penalties depending on volume, sensitivity, mitigation, and compliance history.
Penalty architecture, in descending order of exposure
The Schedule to DPDPA 2023 prescribes seven Schedule entries of contravention, each with its own ceiling. The bars are illustrative ceiling comparisons, not probabilities or predicted fines. Item 6 has no independent fixed amount.
Failure to take reasonable security safeguards under Section 8(5)
Schedule item 1Failure to give breach intimation under Section 8(6)
Schedule item 2Breach of children’s obligations under Section 9
Schedule item 3Breach of SDF obligations under Section 10
Schedule item 4Breach of Data Principal duties under Section 15
Schedule item 5Breach of an accepted voluntary undertaking under Section 32
Schedule item 6Breach of any other provision of the Act or Rules
Schedule item 7The seven factors that move the penalty needle
When the Data Protection Board fixes penalty quantum within the prescribed ceiling, it considers these statutory factors. No statutory weights or fine-prediction formula are provided. This page is a legal reference, not an interactive fine calculation. Principal penalty provisions commence on 13 May 2027.
Nature, gravity and duration of the breach
Section 33(2)(a). The Act does not assign a fixed numerical or High/Medium weight.
Type and nature of the personal data affected
Section 33(2)(b). The Act does not assign a fixed numerical or High/Medium weight.
Repetitive nature of the breach
Section 33(2)(c). The Act does not assign a fixed numerical or High/Medium weight.
Gain realised or loss avoided
Section 33(2)(d). The Act does not assign a fixed numerical or High/Medium weight.
Mitigation: action, timeliness and effectiveness
Section 33(2)(e). The Act does not assign a fixed numerical or High/Medium weight.
Proportionality and effectiveness, including observance and deterrence
Section 33(2)(f). The Act does not assign a fixed numerical or High/Medium weight.
Likely impact of the monetary penalty on the person
Section 33(2)(g). The Act does not assign a fixed numerical or High/Medium weight.
Illustrative issues requiring legal assessment
These examples require an applicable duty and evidence of a breach. They are not findings about any organisation or automatic penalty triggers.
No formal breach notification protocol — not documented, not rehearsed
Bundled consent for multiple processing purposes via single checkbox
Processing children’s data without verifiable parental consent mechanism
No India-based Data Protection Officer where the entity has been notified as an SDF
Inadequate technical security safeguards — no MFA, weak access controls, unencrypted at rest
No Data Processing Agreements with vendors handling personal data
No periodic Data Protection Impact Assessments where required
No mechanism for Data Principals to exercise rights of access and erasure
Request a Penalty Risk Estimate
Share the contours of your operations and our practitioners will model your maximum statutory exposure across the seven Schedule entries — along with the factors that would materially affect Board-level penalty determination.
Request a Confidential Risk Estimate
Our practitioners will reach out within one working day with an indicative exposure analysis.
DPDPA for the CFO
Insurability of a statutory penalty, Ind AS 37 provisioning and the Section 33 determination factors.
Read →The Workforce Question
Why penalty exposure is, at root, a workforce architecture question — read before you finalise budgets.
Read →Compliance Checklist
42 obligations across 7 domains — mapped to source provisions.
Read →Consent Management
The architecture that drives Schedule item 7 catch-all exposure.
Read →DPDP Rules 2025
Subordinate rules that operationalise the Act.
Read →