DPDP Act Part 5: Penalties up to ₹250 Crore, the Board, Appeals & Your Compliance Roadmap
DPDP Act penalties up to ₹250 crore, how the Data Protection Board enforces, TDSAT appeals, and a 10-step compliance roadmap for startups and manufacturers.
“What’s the worst that can happen?” is the question every founder and plant head asks about a new law. For the DPDP Act, the answer is concrete. A penalty of up to ₹250 crore for a single type of failure, decided by a digital regulator, with an appeal only to TDSAT and no route to the civil courts. This final part explains how enforcement works and gives you a step-by-step plan to be ready by 13 May 2027.
- Part 1 — What the DPDP Act is, who it covers, and when it bites
- Part 2 — Consent, notice and the nine legitimate uses
- Part 3 — Your obligations: security, breach reporting, retention
- Part 4 — Rights, duties, children’s data, cross-border, exemptions
- Part 5 — Penalties, the Board, appeals and your compliance roadmap (you are here)
DPDP Act penalties: the Schedule
| # | Breach | Maximum penalty |
|---|---|---|
| 1 | Failure of a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach (s.8(5)) | ₹250 crore |
| 2 | Failure to notify the Board or affected Data Principals of a breach (s.8(6)) | ₹200 crore |
| 3 | Non-fulfilment of additional obligations for children (s.9) | ₹200 crore |
| 4 | Non-fulfilment of additional obligations of a Significant Data Fiduciary (s.10) | ₹150 crore |
| 5 | Breach of Data Principal duties (s.15) | ₹10,000 |
| 6 | Breach of a voluntary undertaking accepted by the Board (s.32) | Up to the amount applicable to the original breach |
| 7 | Breach of any other provision of the Act or Rules | ₹50 crore |
How the Board fixes the amount (section 33(2))
Penalties are ceilings, not fixed fines. The Board must consider:
- The nature, gravity and duration of the breach.
- The type and nature of the personal data affected.
- Whether the breach is repetitive.
- Any gain made or loss avoided because of the breach.
- Action taken to mitigate the effects, and how timely and effective it was.
- Whether the penalty is proportionate and effective, while securing compliance and deterring breach.
- The likely impact of the penalty on the person penalised.
Two points follow. Mitigation counts, so a documented, fast breach response directly reduces exposure. And the type of data matters, so health, financial and children’s data warrant your strongest controls.
The Data Protection Board of India
The Board is established under section 18 as an independent body. It works as a “digital office” (s.28(1)): complaints, hearings and proceedings are designed to run online, with a dedicated portal and app. Its powers under section 27 include:
- Directing urgent remedial or mitigation measures after a breach.
- Inquiring into breaches and imposing penalties.
- Inquiring into Consent Manager breaches, and suspending or cancelling registration.
- Issuing directions, which must be followed.
Status check: the Board’s constitution provisions commenced on 13 November 2025, and recruitment of the Chairperson and Members was advertised in 2026. In October 2026, the Government informed the Kerala High Court that the Board had been constituted but was yet to become functional (confirm current status). Its inquiry and penalty powers are scheduled to apply from 13 May 2027.
The enforcement journey
- Mediation (s.31): if the Board thinks a complaint can be resolved by mediation, it may direct the parties to it.
- Voluntary undertaking (s.32): at any stage, a business may offer an undertaking, such as fixing a system or notifying users. If accepted, it bars proceedings on the matters it covers. Breaching it attracts the original penalty.
- Appeal (s.29): an aggrieved person may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days of the Board’s order. TDSAT may condone delay for sufficient cause and endeavours to decide within six months.
- Blocking (s.37): after penalties in two or more instances, the Board may advise the Government to block public access to a fiduciary’s platform.
Share your business model, systems and vendor list. We’ll assess gaps against the Act and Rules and give you a prioritised plan.
WhatsApp us Email Call 99595 36391Your 10-step DPDP compliance roadmap
The sequence matters. You cannot write an accurate notice without a data map, and you cannot answer an access request without knowing who your processors are. Steps 6 and 7 carry the highest penalties, so do not leave them until the end.
What a manufacturer’s checklist looks like
- HR: employee files, biometric attendance, contract-labour records, medical fitness data. Mostly s.7(i), but secure and retain correctly.
- Security gate: visitor logs and CCTV. Post a short notice, set footage retention, restrict access.
- Sales and service: dealer and distributor KYC, warranty registrations, service-engineer apps. Consent for marketing; contracts with your DMS and CRM vendors.
- B2B contacts: individuals at customer and supplier companies are Data Principals too.
What a startup’s checklist looks like
- Onboarding and checkout flows with separate, unticked marketing consent.
- Analytics, ad pixels and CDPs reviewed. Many need consent, and none may target children.
- A processor register covering cloud, email, payments, KYC and support tools.
- Production-data access logs retained for one year.
- Investor due-diligence readiness. DPDP compliance is increasingly a diligence item, like the protections in a shareholders’ agreement.
The whole series in one table
| Part | Core takeaway |
|---|---|
| 1. Basics | Almost every business is a Data Fiduciary; core duties apply from 13 May 2027 |
| 2. Consent | Two grounds only: valid consent with a Rule 3 notice, or one of nine legitimate uses |
| 3. Obligations | Rule 6 security, 72-hour breach report, erase when done, liable for vendors |
| 4. Rights | Access, correction, erasure, grievance, nomination, with 90 days to respond |
| 5. Enforcement | Penalties up to ₹250 crore; Board, then TDSAT; start the roadmap now |
Why work with ComplianceKart
DPDP readiness is a cross-functional project: legal drafting, record-retention law, governance and operations. ComplianceKart is a boutique practice bringing CAs, CSs and advocates under one roof, like a multi-speciality hospital where the specialists plan the treatment together instead of sending you from clinic to clinic. For startups and manufacturers in Hyderabad and across India, we run gap assessments, draft notices and processor agreements, build retention schedules and help with Board-related correspondence. We do not guarantee any regulatory or appellate outcome.
Frequently asked questions
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Other ceilings are ₹200 crore, ₹150 crore and ₹50 crore depending on the breach.
Can individuals claim compensation under the DPDP Act?
No. Penalties are paid to the Government. Section 44(2) omits section 43A of the IT Act once it commences. Other legal remedies may still be available.
Where do I appeal a Data Protection Board order?
To TDSAT, within 60 days of receiving the order (s.29).
Is the Data Protection Board functional?
As at 24 October 2026, the Government had told the Kerala High Court that the Board was constituted but not yet functional. Its penalty powers apply from 13 May 2027 (confirm current status).
Can I settle a DPDP matter without a penalty?
The Board may refer a complaint to mediation (s.31) or accept a voluntary undertaking (s.32). An accepted undertaking bars proceedings on the matters it covers.
Where should a small business start?
With a data map. Every other step, including notices, contracts, rights responses and retention, depends on knowing what personal data you hold and where.
Sources
- DPDP Act, 2023: sections 18, 27–34, 37, 39, 44 and the Schedule — MeitY
- DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- PIB release on DPDP Rules, 14 November 2025 — pib.gov.in
Start from the beginning: Part 1 — the basics. Related: how to respond to a legal notice and employer compliance limits for 2026.
This article is general information on the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as at 24 October 2026. It is not advice on any specific situation. Phased commencement dates and pending government notifications can change; check the official text on meity.gov.in before acting.
Need this done for your business?
Send us one message. A CA, CS or Advocate replies within a working day — no forms, no obligation.