How Much Is the Fine for Violating India's DPDP Act?
The DPDP Act's penalty structure has separate fine ceilings for different violations, up to ₹250 crore — here's exactly how the numbers break down.
💡 In Simple Terms (For Beginners)
The DPDP Act doesn't have one single fine — it has separate penalty ceilings for different failures, like not reporting a breach properly or not having basic security in place, and they can add up.
- Failing to implement reasonable security safeguards carries a fine ceiling of up to ₹250 crore.
- Failing to notify a breach as required carries a separate fine ceiling of up to ₹200 crore.
- These are ceilings the Data Protection Board can impose, not automatic penalties for every incident.
COMPLIANCE · October 19, 2026 · 6 min read · By Hardik Patel
How much is the fine for violating India's DPDP Act? The DPDP Act sets separate fine ceilings for different violations rather than one flat penalty — up to ₹250 crore for failing to implement reasonable security safeguards, and up to ₹200 crore for failing to notify a breach as required, as covered in our breach notification timeline guide.
The Penalty Structure Isn't One Number
The DPDP Act treats different types of non-compliance as separate violations, each carrying its own fine ceiling that the Data Protection Board can impose — meaning a single incident that involves both a security failure and a late breach notification could theoretically draw penalties under both categories.
What Drives the Actual Penalty Amount
These figures are ceilings, not automatic fines — the Data Protection Board has discretion in setting the actual penalty for a given case, likely influenced by factors like the severity of the failure, whether it was a first-time or repeated issue, and how the business responded once the issue was identified.
This is why treating the ₹250 crore and ₹200 crore figures as "the fine" oversimplifies things — they represent the maximum exposure, not a fixed, predictable number.
Why This Matters More Than the Headline Number
The specific figures matter less practically than the underlying message: the DPDP Act treats both security failures and breach-notification failures as serious, separately punishable issues, which means a business needs both real security safeguards and a working notification process — one doesn't substitute for the other.
Key Takeaways
- Reasonable security safeguard failures carry a fine ceiling of up to ₹250 crore.
- Breach notification failures carry a separate ceiling of up to ₹200 crore.
- These are Board-imposed ceilings, not automatic fixed penalties.
- Both security and notification processes need to be in place — neither substitutes for the other.
Frequently Asked Questions
Q: Is every DPDP Act violation fined the maximum amount?
A: No — the published figures are ceilings the Data Protection Board can impose, not a fixed penalty applied automatically to every violation regardless of circumstances.
Q: Can a single incident draw multiple separate fines?
A: Potentially, yes — since security failures and breach notification failures are treated as separate categories of violation, an incident involving both could theoretically be assessed under each.
How iTechFixr Can Help
Our DPDP compliance readiness assessments help close both sides of this exposure — the security safeguards required under one penalty category, and the breach response process required under the other.
Not sure where you stand? Check your DPDP readiness free (2 minutes).
Need Help With This?
Talk to Hardik directly about your organisation's cybersecurity needs — get a tailored response within 24 hours.
