The Schedule: Penalty Architecture
The Schedule to the DPDPA prescribes specific penalty amounts for specific categories of contravention. This is not a percentage-of-turnover model like the GDPR. It is a fixed-cap model where each contravention type has a maximum penalty. The Data Protection Board determines the actual quantum within that cap based on the circumstances of the contravention.
Penalty Categories and Caps
The Schedule specifies: (a) Failure to take reasonable security safeguards (Section 8(4)) — up to ₹250 crore. (b) Failure to notify the Board and Data Principals of a breach (Section 8(6)) — up to ₹200 crore. (c) Non-compliance with obligations regarding children (Section 9) — up to ₹200 crore. (d) Non-compliance by a Significant Data Fiduciary (Section 10) — up to ₹150 crore. (e) Any other non-compliance — up to ₹50 crore.
How Penalties Are Calculated
The Data Protection Board is not required to impose the maximum penalty. It will consider: (a) the nature, gravity, and duration of the contravention, (b) the type of personal data affected, (c) repetitive nature of the contravention, (d) whether the contravention was deliberate or negligent, (e) actions taken by the entity to mitigate the impact, and (f) the financial condition of the entity. A first-time contravention by a company that took remedial action will attract a lower penalty than a repeat contravention by an entity that ignored previous warnings.
Cumulative Penalty Risk
Penalties under the Schedule are per contravention TYPE, not per incident. But a single data breach can trigger multiple contravention types simultaneously: failure of security safeguards (₹250 crore cap) AND failure to notify (₹200 crore cap) AND non-compliance with children's data obligations if children's data was involved (₹200 crore cap). The theoretical maximum cumulative penalty for a single incident involving children's data with notification failure is ₹650 crore.
Jurisdiction Over Foreign Entities
Section 3(b) establishes extraterritorial jurisdiction. The Data Protection Board can adjudicate complaints against foreign entities that process Indian personal data. The practical enforcement mechanism is through: (a) assets of the foreign entity in India (bank accounts, property, receivables), (b) the Indian subsidiary or branch office (which can be directed to comply), and (c) international cooperation mechanisms. Foreign companies that believe Indian penalties are unenforceable against them should note that India has mutual legal assistance treaties with over 40 countries.
Comparison with GDPR Penalties
GDPR penalties are calculated as a percentage of global turnover (up to 4% or €20 million, whichever is higher). DPDPA penalties are fixed caps in Indian rupees. For large multinationals with massive global turnover, GDPR's percentage-based model produces larger penalties. But for mid-size companies, DPDPA's fixed caps can exceed the GDPR calculation. A company with €100 million turnover faces a GDPR maximum of €4 million (4%) but a DPDPA maximum of ₹250 crore (approximately €27 million) for the same contravention.
Mitigating Penalty Exposure
The most effective mitigation is documented compliance effort. Companies that can demonstrate: (a) a formal DPDPA compliance programme, (b) board-level governance, (c) regular audits and DPIAs, (d) prompt breach notification, and (e) remedial action upon discovering non-compliance — will face significantly lower penalties than companies that cannot demonstrate any compliance effort. The Board's assessment explicitly considers actions taken to mitigate.