# DPDP penalties: what the ₹250 crore cap means, and how the Board decides

> The Schedule to the DPDP Act caps penalties at up to ₹250 crore for failing to keep reasonable security safeguards, ₹200 crore each for breach-notice and children's failures, ₹150 crore for Significant Data Fiduciaries and ₹50 crore for anything else. The Board can impose one only after an inquiry finds a significant breach and after a hearing, and sets the amount by seven factors in s. 33(2), most of which turn on evidence you can prepare now. Penalties start on 13 May 2027 and are paid into the Consolidated Fund of India.

Source: https://dpdp.commons.inc/dpdp-penalties · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

The Schedule to the DPDP Act caps penalties at up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore each for failing to notify a breach or breaching the children's duties, ₹150 crore for a Significant Data Fiduciary's extra duties and ₹50 crore for any other breach of the Act or Rules. These are maximums: the Data Protection Board can impose a penalty only after an inquiry finds a breach "significant", and only after a hearing (s. 33(1)). It then sets the amount by weighing seven factors (s. 33(2)), most of which turn on records you can start keeping now. Penalties can apply only from 13 May 2027, and none has been imposed. The money goes to the Consolidated Fund of India, not to the people harmed (s. 34), and the IT Act's compensation route in s. 43A ends on the same date.

Like the Act (s. 2(y)), we say "she" and "her" for every person.

**Jump to what you need.**

- **CFOs, boards and trustees:** [The Schedule](#the-schedule-item-by-item), [For CFOs](#for-cfos-provisioning-insurance-and-contracts), [Directors and trustees](#directors-trustees-and-officers), [What size does to the number](#what-size-does-to-the-number).
- **DPOs, lawyers and CISOs:** [How a case moves](#from-intimation-to-penalty-how-a-case-moves), [the seven factors and your evidence](#the-seven-factors-and-the-evidence-that-answers-each), [a breach followed through](#one-breach-followed-through), [Voluntary undertakings](#voluntary-undertakings).
- **Vendors:** [If you are a processor](#if-you-are-a-processor).
- **People who have been harmed, and those advising them:** [No compensation](#no-compensation-and-the-end-of-section-43a).

## The Schedule, item by item

| Item | Breach | Up to | What typically falls here |
|---|---|---|---|
| 1 | Failing to take reasonable security safeguards to prevent a personal data breach (s. 8(5)) | ₹250 crore | Shared admin passwords, unencrypted exports, open sharing links, leavers with live access, a processor with no security terms |
| 2 | Failing to give the Board or affected people intimation of a breach (s. 8(6)) | ₹200 crore | Late or missing notices under Rule 7; no 72-hour report; notices that leave out what Rule 7(1) requires |
| 3 | Breaching the additional obligations for children (s. 9) | ₹200 crore | No verifiable parental consent; tracking, behavioural monitoring or targeted advertising directed at children; processing likely to harm a child's well-being |
| 4 | Breaching the additional obligations of a Significant Data Fiduciary (s. 10) | ₹150 crore | No DPO, auditor, DPIA or audit, once notified |
| 5 | A Data Principal breaching her duties (s. 15) | ₹10,000 | Impersonation, false particulars, false or frivolous complaints |
| 6 | Breaching a term of a voluntary undertaking accepted by the Board (s. 32) | Up to the penalty for the breach the proceedings were about | Missing a deadline you committed to |
| 7 | Breaching any other provision of the Act or Rules | ₹50 crore | Invalid notices or consent, ignored withdrawals, unanswered rights requests, no processor contract, data kept past its purpose, no published contact person |

Item 7 covers most of the Act. Weak notices, bundled consent, missing processor contracts and late grievance replies all sit there, so a "₹50 crore item" is where most day-to-day failures land.

Some features of the Schedule are easy to miss:

- **The verbs are "may extend to".** Each figure is the maximum for that item. Nothing in the Act sets a minimum.
- **One incident can engage several items.** A breach caused by weak access control, then reported late, engages item 1 and item 2. Whether the Board can impose both in one proceeding is not addressed; see [Where the law is unclear](#where-the-law-is-unclear).
- **Consent Managers are covered too.** The Board can inquire into a Consent Manager's breach of its obligations or registration conditions (s. 27(1)(c)–(d)). The registration regime applies from 13 November 2026. Breaches of Rule 4 and First Schedule Part B committed after that date may arguably be penalised once s. 33 commences on 13 May 2027.
- **Intermediaries that ignore a blocking direction** under s. 37(2) can be referred to the Board for inquiry and penalty (s. 27(1)(e)).

## From intimation to penalty: how a case moves

The Board works as a digital office, receiving complaints and holding hearings online as far as practicable (s. 28(1), Rule 20). Its penalty power, and most of its inquiry powers, start on 13 May 2027.

| Stage | What happens | Provision |
|---|---|---|
| Trigger | Your own breach intimation; a complaint from a person who has first used your grievance route; a reference from the Central or a State Government; a court's direction | s. 27(1), 13(3) |
| Urgent measures | On a breach intimation, the Board may direct urgent remedial or mitigation steps | s. 27(1)(a) |
| Sufficient grounds | The Board decides whether to inquire, and may close the matter for written reasons | s. 28(3)–(4) |
| Inquiry | Under natural justice, with reasons recorded; civil-court powers to summon, take evidence on affidavit, and inspect any data, book or document | s. 28(5)–(7) |
| Limits on the Board | It may not prevent access to premises or seize equipment in a way that harms day-to-day functioning | s. 28(8) |
| Interim orders | Possible during the inquiry, after a hearing | s. 28(10) |
| Mediation | The Board may direct the parties to mediation where a complaint can be resolved that way | s. 31 |
| Undertaking | At any stage, the Board may accept a voluntary undertaking, which bars proceedings on its contents | s. 32 |
| Conclusion | After a hearing, the Board closes the matter or proceeds to a penalty, for written reasons | s. 28(11) |
| Penalty | Only if the breach is significant, after a hearing, within the Schedule, weighing s. 33(2) | s. 33 |
| Directions | The Board may also issue binding directions, after a hearing and with written reasons | s. 27(2) |
| Time | Six months from the intimation, complaint or reference, extendable by up to three months at a time for written reasons | Rule 19(9) |
| Appeal | To TDSAT within sixty days, later with sufficient cause; TDSAT aims to decide within six months; a further appeal lies to the Supreme Court within 90 days, on a substantial question of law only | s. 29, Rule 22; TRAI Act s. 18 |
| Enforcement | TDSAT's orders are executable as a civil court decree | s. 30 |

No civil court can hear a matter the Board is empowered to decide, and no court or other authority can grant an injunction against action taken under the Act (s. 39). The writ jurisdiction of the High Courts and the Supreme Court (Articles 226 and 32 of the Constitution) is unaffected.

As of 25 October 2026 the Board had no Chairperson or Members. Nominations were sought in May 2026, with a further notification in June 2026, and reports through August 2026 say no appointments had been made ([LiveLaw](https://www.livelaw.in/articles/india-data-protection-board-established-law-543751)). We have found none announced since. There is therefore no enforcement record, and no past penalty to calibrate against.

## When a breach is "significant"

The Board may impose a penalty only if it "determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant" (s. 33(1)). The Act does not define significant.

A finding that you breached the Act is therefore not enough on its own. The Board must also find the breach significant, give you a hearing, and only then turn to the amount. A minor, quickly corrected lapse may end with directions, mediation or an undertaking instead.

Our view: the Board will look at much the same things for significance as for the amount: how many people were affected, what kind of data, how long it went on, whether it was repeated, the harm caused and how you responded. That means the evidence that keeps the amount down may also keep a breach below the threshold. We hold that view with low confidence until the first orders appear.

## The seven factors, and the evidence that answers each

Section 33(2) says what the Board "shall have regard to" in setting the amount. Each factor is a question the Board will ask about facts. Your answer is only as good as the records you made at the time.

| Factor | The question it raises | Evidence to prepare now |
|---|---|---|
| (a) Nature, gravity and duration of the breach | What happened, how serious was it, and how long did it run before you found and stopped it? | Logs and monitoring that show when access began and ended (Rule 6(1)(c)); an incident register with timestamps; detection alerts and who reviewed them |
| (b) Type and nature of the personal data affected | Was it children's, health, financial, caste or location data, or a mailing list? | A data inventory that classifies each data set; evidence that you collected only what each purpose needed (s. 6(1)); masking of high-risk fields (Rule 6(1)(a)) |
| (c) Repetitive nature of the breach | Has this happened before, and did you fix the cause last time? | A breach and near-miss register; closed actions from earlier incidents, drills and audits, with dates |
| (d) Gain realised or loss avoided | Did you profit from the breach, or save money by cutting corners? | Security budgets and approvals; a purpose register showing no undisclosed commercial use; board minutes on risk decisions |
| (e) Mitigation, and its timeliness and effectiveness | What did you do, how fast, and did it work? | Your playbook; timestamps for containment; copies of notices to people and the Board with delivery records (Rule 7); the 72-hour report; follow-up actions closed |
| (f) Proportionate and effective | What penalty is needed to secure compliance and deter breaches, given what you already do? | Evidence of a working programme: an accountable owner, board reports, training records, processor contracts, the [checklist](/dpdp-compliance-checklist) with evidence behind each control |
| (g) Likely impact of the penalty on you | What would the penalty do to the organisation and the people it serves? | Audited accounts; for nonprofits, restricted and unrestricted funds and the services a penalty would cut |

Factors (a), (c) and (e) depend almost entirely on records made at the time. You cannot reconstruct after the event when an alert fired, who saw it, or when the last affected family received her SMS. Factors (f) and (g) let the Board take account of the organisation you are and the programme you run.

Our recommendation is to keep these records as a single penalty-readiness file, maintained by the accountable owner and reviewed each quarter. If an incident happens, the same file becomes the basis of your submissions at the hearing. The hour-by-hour response that produces the evidence for factor (e) is in [Data breach under DPDP](/dpdp-breach-response).

## One breach, followed through

This illustration is a composite, not a client story. It is set after 13 May 2027.

A logistics company with 2,000 employees holds delivery details for about four lakh customers (names, mobile numbers, addresses) and an HR system with its staff's PAN, bank account numbers and salaries. A contractor whose engagement ended in March still has a working VPN account, and the VPN has no multi-factor authentication. In July the account logs in at night and exports both data sets. The monitoring tool raises an alert on day 1, but nobody reviews it. On day 7 the data is offered for sale online, and the company confirms the breach that afternoon.

From then it moves fast. It disables the account and forces password resets within two hours, reports to CERT-In within six hours, and sends the Board its initial intimation the same evening. It emails all staff on day 8 with advice to watch their bank accounts, sends customers an SMS on day 9, and files the detailed report on day 10, within 72 hours of confirmation.

**Items engaged.** Item 1 (reasonable safeguards, s. 8(5)) is the main exposure: a leaver with live access breaches the access-control minimum (Rule 6(1)(b)), and an alert nobody reviewed falls short of "logs, monitoring and review" (Rule 6(1)(c)). Item 2 (breach notice, s. 8(6)) turns on when the company "became aware". If the Board treats the unreviewed day-1 alert as awareness, the notices were days late. The same day-1 question decides whether the CERT-In report met its six hours. If the contractor's firm worked without a valid contract, item 7 is engaged too (s. 8(2)). No children's data was involved, so item 3 is not.

| Factor (s. 33(2)) | Facts that hurt | Facts that help |
|---|---|---|
| (a) Nature, gravity, duration | Six days between the alert and action; two data sets | Contained within hours of confirmation; logs show exactly what left |
| (b) Type of data | Staff bank details and PAN are financial data | Customer data limited to delivery details; card payments handled by the payment gateway, never stored |
| (c) Repetition | An internal audit had flagged leaver access six months earlier, and the action was still open | No earlier breach in the register |
| (d) Gain or loss avoided | The board had deferred the MFA rollout to save cost | No commercial use of the data |
| (e) Mitigation | The day-1 alert was missed | CERT-In in six hours, Board the same day, notices within two days, resets, a helpline, advice to staff on bank fraud |
| (f) Proportionate and effective | | A working programme: named owner, quarterly board reports, signed processor contracts, a drill in April |
| (g) Impact on the company | | Audited accounts showing what a penalty would do |

**Possible outcomes.** After the inquiry the Board could close the matter (s. 28(11)), issue directions such as MFA on every remote-access route within a set time (s. 27(2)), accept a voluntary undertaking (s. 32), or find the breach significant and impose a penalty within the ceilings of up to ₹250 crore for item 1 and up to ₹200 crore for item 2, sized by the factors above (s. 33). Any order can be appealed to TDSAT (s. 29). With no orders yet, we do not guess at a figure. The CERT-In report is a separate matter under the IT Act.

Change one fact, a same-day review of the alert, and duration falls from days to hours, awareness is not in doubt, and the item 2 question disappears.

## Voluntary undertakings

At any stage of a proceeding, the Board may accept a voluntary undertaking about any matter related to observing the Act (s. 32(1)). It can include a commitment to take a specified action within a time the Board sets, to refrain from an action, or to publicise the undertaking (s. 32(2)). The Board can vary its terms with your consent (s. 32(3)).

Acceptance bars further proceedings under the Act on the contents of the undertaking (s. 32(4)). If you then fail to keep any term, that failure is deemed a breach of the Act. After a hearing, the Board may proceed to a penalty (s. 32(5)) of up to the amount that applied to the original breach (Schedule, item 6). The ceiling does not drop because you offered to put things right.

An undertaking the Board can accept (our recommendation, since the Act sets no form):

- **Specific actions with dates**, each with an owner senior enough to deliver it.
- **Evidence the Board can check**, such as a third-party assessment or a dated report.
- **Only commitments you can keep.** A missed deadline revives the original exposure.

An illustrative template follows. The Act prescribes no format, and the Board may want its own.

| Section | Illustrative wording |
|---|---|
| Parties and proceeding | [Organisation], in proceeding [reference] arising from [the intimation dated / the complaint of] [date] |
| Matter covered | The access-control and monitoring failures described in the detailed report of [date] (s. 8(5), Rule 6(1)(b)–(c)) |
| Actions | 1. Multi-factor authentication on all remote access and administrator accounts by [date]. 2. Leaver access removed within 24 hours, with a monthly reconciliation, from [date]. 3. Security alerts reviewed within [hours], seven days a week, from [date] |
| Owner | [Name, designation], reporting to the board |
| Evidence | An independent assessment of actions 1 to 3, filed with the Board by [date]; monthly reconciliation reports for twelve months |
| Publicity | [If the Board requires it: a notice on the organisation's website describing the undertaking, for [period]] (s. 32(2)) |
| Acknowledgement | We understand that acceptance bars proceedings on the matter covered (s. 32(4)), and that failing to keep any term is deemed a breach of the Act and may lead to a penalty of up to the amount applicable to the original breach (s. 32(5); Schedule, item 6) |
| Signature | [Authorised signatory], with the board resolution approving the undertaking attached |

In our view the Board will find an undertaking easier to accept from an organisation whose records already show it can deliver.

## Blocking: the sanction above the Schedule

After a fiduciary has been penalised in two or more instances, the Board may refer the matter to the Central Government. In the reference it may advise blocking public access to information in any computer resource that lets the fiduciary offer goods or services in India (s. 37(1)(a)–(b)). The government must give the fiduciary a hearing and record its reasons. It may then direct a government agency or an intermediary to block access, and intermediaries must comply (s. 37(1)–(2)).

For a platform, app or website, this matters more than any amount in the Schedule. It turns on the number of penalties, not their size, so repeated item 7 failures could in principle count. An organisation that has had one penalty should, in our view, treat a second as a risk to its business.

## The caps can double

The government can amend the Schedule by notification, but cannot raise any penalty to more than twice the amount in the Act as enacted (s. 42(1)). An amendment takes effect on the date of notification, as if enacted in the Act (s. 42(2)), and must be laid before Parliament, which can modify or annul it (s. 41). The highest cap could therefore rise to ₹500 crore. No amendment had been notified as of 25 October 2026.

## No compensation, and the end of section 43A

DPDP penalties are paid to the Consolidated Fund of India (s. 34). The Act gives the Board no power to award compensation to the person whose data was misused, and no section of the Act creates a right to damages.

Until 13 May 2027, IT Act s. 43A lets a person claim compensation from a body corporate that possesses, deals with or handles sensitive personal data in a computer resource it owns, controls or operates, is negligent in implementing reasonable security practices, and so causes wrongful loss or gain; claims go to an adjudicating officer (IT Act s. 46) or a court, depending on the amount. Section 44(2)(a) of the DPDP Act omits s. 43A from 13 May 2027, and s. 44(2)(c) removes the related rule-making power, which ends the SPDI Rules with it.

From then, a person whose data is mishandled can:

- raise a grievance with the fiduciary, which must respond within its published period of no more than 90 days (s. 13, Rule 14(3));
- complain to the Board, after using that route (s. 13(3), 27(1)(b));
- be sent to mediation, if the Board thinks the complaint can be resolved that way (s. 31).

Whether she can still sue for damages in a civil court, and whether claims for events before 13 May 2027 survive the omission of s. 43A, are open questions; see [Where the law is unclear](#where-the-law-is-unclear).

## CERT-In: a separate, criminal regime

The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents within six hours of noticing them ([CERT-In Directions](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf)). They continue after 13 May 2027 alongside the DPDP Act (s. 38(1)). Failing to comply is an offence under IT Act s. 70B(7): up to one year's imprisonment, a fine of up to ₹1 crore (raised from ₹1 lakh from 30 November 2023 by the Jan Vishwas (Amendment of Provisions) Act, 2023), or both, prosecuted only on a complaint by an officer CERT-In authorises (s. 70B(8)). One incident can therefore bring a DPDP penalty and a criminal complaint, with different clocks and recipients; the [breach guide](/dpdp-breach-response#cert-in-vs-dpdp-side-by-side) sets them side by side.

## Directors, trustees and officers

The DPDP Act creates no offences, and it has no clause making directors, trustees or officers personally liable. Penalties fall on the "person" found in breach (s. 33(1)): the company or LLP itself. For a partnership firm, partners are jointly and severally liable for the firm's obligations (Indian Partnership Act, 1932, s. 25), so a penalty on the firm can likely be recovered from them. For a trust, which is not a legal entity, the person is likely the trustees acting together (s. 2(s)(v)); whether a penalty can be recovered from trustees beyond trust property is untested. A society under the 1860 Act is not a body corporate, and, as with a trust, how a penalty is recovered from its governing body is untested.

Personal exposure comes from other laws. Under IT Act s. 85, where a company contravenes the IT Act or a direction under it, such as CERT-In's, every person in charge of and responsible for its business can be liable unless she shows she did not know or exercised all due diligence, and so can an officer whose consent, connivance or neglect caused it; "company" there includes a firm or other association of individuals. Companies Act s. 149(12), which limits independent and non-executive directors' liability, protects them only for Companies Act liability, not under IT Act s. 85. Under s. 85(1), only those actually in charge of the business are caught; a non-executive director is usually exposed only under s. 85(2), for consent, connivance or neglect. A director must also act with due and reasonable care, skill and diligence (Companies Act, 2013, s. 166(3)). [Ten questions a board should ask](/dpdp-for-boards#what-directors-and-trustees-are-exposed-to) covers what boards and trustees should oversee and minute.

## For CFOs: provisioning, insurance and contracts

- **Fixed caps, not a share of turnover.** The GDPR caps fines at a fixed euro sum or a share of worldwide turnover, whichever is higher (art. 83); the DPDP Schedule sets fixed rupee ceilings per item, the same for a ten-person NGO and a listed group. See [DPDP vs GDPR](/dpdp-vs-gdpr#penalties-enforcement-and-compensation).
- **Insurance is unsettled.** Whether a DPDP penalty can lawfully be insured has not been decided, and cyber policies differ on fines and penalties. Our view: read the exclusions with your broker before 13 May 2027, and do not budget on recovery.
- **Provisioning and disclosure.** Our view: a provision or contingent-liability disclosure becomes a question once a proceeding starts or a breach makes one likely, under the accounting standard on provisions and contingent liabilities (Ind AS 37 for companies applying Ind AS, or AS 29 for others, including most trusts and societies). Agree the trigger with your auditors in advance.
- **Penalties passed through contracts.** Enterprise customers will ask vendors to indemnify DPDP penalties. The fiduciary stays liable whatever the contract says (s. 8(1)); the contract decides only who bears the cost. See [liability, indemnity and caps](/dpdp-for-startups#liability-indemnity-and-caps-a-negotiating-position).

## If you are a processor

The duties in the Schedule are written for fiduciaries, and the fiduciary answers for its processors "irrespective of any agreement to the contrary" (s. 8(1)). A processor's exposure therefore comes mainly through its customers' contracts and indemnities. Two routes lead to the Board directly. If you use customer data for a purpose of your own, such as training your own models, you are a fiduciary for that purpose. And the Board could arguably penalise a processor under item 7 for breaching a provision that binds "a person"; that is untested, and our view is that it will be rare. Terms worth negotiating are in [processor contracts](/dpdp-processor-contracts).

## What size does to the number

The Schedule does not scale with turnover. Proportionality and the likely impact of the penalty on you are two of the seven factors (s. 33(2)(f)–(g)), so the Board must consider what a figure would do to a small NGO or an early-stage startup. That cuts both ways. A penalty sized for a ten-person organisation can still close it, and the Board must also consider what is needed to "deter breach" (s. 33(2)(f)).

For small organisations, the exposure that matters is less the cap than the cost of the response. That means the inquiry, the hearing, the lawyers, the press and the loss of funders' or customers' trust, all of which arrive whether or not a penalty follows. The cheapest protection is the same for everyone: a short list of controls with evidence behind them. The minimum versions for [NGOs](/dpdp-for-nonprofits) and [startups](/dpdp-for-startups) show what that list looks like.

## Where the law is unclear

These are our positions until the Board or the courts decide otherwise.

**When is a breach "significant" (s. 33(1))?** When its scale, the type of data, its duration, any repetition, the harm caused or a poor response make it serious. *Why:* the Act gives no test, and the s. 33(2) factors are the nearest guide to what the Board considers. *Would change if:* the first orders or published guidance set a pattern. *Confidence:* low.

**Can the Board impose more than one item's penalty for one incident?** Probably yes, where distinct duties were breached. *Why:* items 1 and 2 attach to separate obligations, s. 8(5) and s. 8(6), and each is a breach in its own right. Proportionality (s. 33(2)(f)) would then restrain the total. *Would change if:* the Board or TDSAT treats one incident as one breach. *Confidence:* medium.

**Is the cap per breach, or per affected person?** Per breach. *Why:* the Schedule describes a breach "in observing the obligation", not a breach per Data Principal, and the number of people affected appears through gravity and type of data (s. 33(2)(a)–(b)). Separate complaints by different people could, however, start separate proceedings, which is untested. *Would change if:* the Board counts separate breaches for separate people. *Confidence:* medium.

**Can conduct before 13 May 2027 be penalised?** Not the conduct itself; but a state of affairs that continues after that date can be. *Why:* the duties and s. 33 commence on 13 May 2027. Article 20(1) of the Constitution protects only against retrospective criminal penalties, so the point rests on the general presumption against retrospective penal provisions. Data still held without safeguards on 14 May 2027 is a breach on that day. *Would change if:* the Board treats a pre-commencement event discovered later as within its powers. *Confidence:* medium.

**Can a person still sue for compensation in a civil court after s. 43A goes?** Possibly, for a claim the Board cannot decide. *Why:* section 39 bars civil courts only for matters "for which the Board is empowered", and the Board has no power to award compensation; claims in contract, negligence or under consumer law may survive. The opposite reading, that the DPDP Act is a complete code, is also arguable. *Would change if:* a court rules on it. *Confidence:* low.

**Do s. 43A claims for events before 13 May 2027 survive?** Arguably yes. *Why:* section 6 of the General Clauses Act, 1897 saves liabilities incurred under a repealed provision, and the Supreme Court in Fibre Boards (2015) treated an omission as a repeal. But Kolhapur Canesugar (2000), a larger bench, took the narrower view, and the SPDI Rules lapse too. *Would change if:* a court decides a claim brought after 13 May 2027. *Confidence:* low to medium.

**Does a raised cap under s. 42 apply to breaches before the amendment?** No, in our view. *Why:* the amendment takes effect from notification (s. 42(2)), and a higher penalty is not ordinarily applied to earlier conduct. *Would change if:* a court reads s. 42(2) otherwise. *Confidence:* medium.

## A penalty-readiness file, before 13 May 2027

1. **Name the owner** of the file: the accountable owner or DPO, with a deputy.
2. **Map exposure to the Schedule.** For each item that applies to you, list the controls that address it, using the [compliance checklist](/dpdp-compliance-checklist).
3. **Build the s. 33(2) evidence.** For each factor in the table above, check that the records exist, carry dates and are kept for at least a year (Rule 6(1)(e), Rule 8(3)).
4. **Rehearse an incident** against Rule 7 and CERT-In's six hours, and keep the drill report in the file.
5. **Brief the board or trustees** on the caps, the blocking power, CERT-In and s. 85, and minute the briefing.
6. **Adapt the undertaking template** above, so that if you need one you can offer specific, dated, owned commitments quickly.
7. **Plan the dates** with [DPDP compliance deadline: 13 May 2027](/dpdp-timeline).

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), the commencement notification G.S.R. 843(E), the CERT-In Directions of 28 April 2022, and IT Act ss. 43A, 46, 70B and 85 as amended by the Jan Vishwas (Amendment of Provisions) Act, 2023. Events after November 2025 come from the linked public reports, last checked 25 October 2026. We have found no DPDP penalty imposed, and quote no enforcement figures. Statements marked "our view" or "our position" are our judgement, not the law. This guide explains the law; it is not legal advice for your situation.
{: .note }

## Questions people ask

### Does a penalty stay on hold if we appeal to TDSAT?

The Act does not say. It gives a right of appeal against any order or direction of the Board within sixty days (s. 29(1)–(2)), and lets the Tribunal confirm, modify or set aside the order (s. 29(4)), but it contains no automatic stay. Our view: assume the order stands until the Tribunal says otherwise, and ask the Tribunal for interim relief in the appeal if payment or compliance would cause harm that cannot be undone. Take advice from appellate counsel quickly.

### Can a Data Principal be penalised for a false complaint?

Yes, in two ways. Registering a false or frivolous grievance or complaint breaches her duties (s. 15(d)), and the Schedule caps the penalty for breaching any of those duties at ₹10,000 (item 5). Separately, at any stage after receiving a complaint the Board may warn or impose costs on a complainant it considers false or frivolous (s. 28(12)). Neither should be used to discourage genuine complaints, and a fiduciary cannot penalise anyone itself.

### Will penalty orders be public?

The Act does not expressly require the Board to publish its orders. It does require the Board to record reasons in writing at each stage (s. 28(4), 28(5), 28(11)), to work as a digital office (s. 28(1)), and lets an undertaking include publicising it (s. 32(2)). Orders appealed to TDSAT or beyond are likely to enter the public record. Our view: plan on any penalty, and any undertaking, becoming known to your donors, customers and staff.

### Can a government department be penalised?

On the text, probably yes. Penalties fall on 'a person' (s. 33(1)), and 'person' includes the State (s. 2(s)(vi)). The State has its own grounds for processing (s. 7(b)–(d)) and is relieved of some erasure and correction duties (s. 17(4)). It escapes the breach-notice duty only where s. 17(1) applies, for example processing to prevent or investigate offences (s. 17(1)(c)), or where an instrumentality is notified under s. 17(2)(a) or a notification under s. 17(5) covers it. Security (s. 8(5)) survives s. 17(1). The sum would go to the Consolidated Fund of India (s. 34). How the Board will approach public bodies is untested.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start