Schedule to Digital Personal Data Protection Act 2023: Maximum Penalties
The Schedule to the Digital Personal Data Protection Act, 2023 specifies the maximum monetary penalties that may be imposed for particular breaches of the Act or the rules made under it. The Schedule is linked to section 33(1), which empowers the Data Protection Board of India to impose a monetary penalty after an inquiry where a breach is found to be significant.
The Act received Presidential assent on 11 August 2023 as Act No. 22 of 2023. For the official statutory text, see Digital Personal Data Protection Act, 2023 on India Code. The Central Government has also notified the Digital Personal Data Protection Rules, 2025.
What is the Schedule under the DPDP Act?
The Schedule is the statutory table of maximum monetary penalties for specified contraventions. It should be read with section 33 on penalties. The amounts stated in the Schedule are maximum limits; they are not automatic fixed penalties for every breach.
Schedule: Maximum penalty for each breach
THE SCHEDULE [See section 33(1)]
| Sl. No. | Breach of the Act or rules | Maximum penalty |
|---|---|---|
| 1 | Breach of the obligation of a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach under section 8(5). | Up to Rs. 250 crore |
| 2 | Breach of the obligation to give the Board or affected Data Principal notice of a personal data breach under section 8(6). | Up to Rs. 200 crore |
| 3 | Breach of additional obligations relating to children under section 9. | Up to Rs. 200 crore |
| 4 | Breach of additional obligations of a Significant Data Fiduciary under section 10. | Up to Rs. 150 crore |
| 5 | Breach of the duties of a Data Principal under section 15. | Up to Rs. 10,000 |
| 6 | Breach of any term of a voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which proceedings under section 28 were instituted. |
| 7 | Breach of any other provision of the Act or the rules made under it. | Up to Rs. 50 crore |
Meaning of the main provisions referred to in the Schedule
Section 8(5): Reasonable security safeguards
Section 8(5) requires a Data Fiduciary to protect personal data in its possession or under its control, including processing undertaken by a Data Processor on its behalf, by taking reasonable security safeguards to prevent a personal data breach. The Schedule specifies a maximum penalty of Rs. 250 crore for breach of this obligation.
Section 8(6): Notice of personal data breach
Section 8(6) requires a Data Fiduciary, in the event of a personal data breach, to give the Board and each affected Data Principal intimation of the breach in the form and manner prescribed. The Schedule provides a maximum penalty of Rs. 200 crore for breach of this obligation.
Section 9: Processing personal data of children
Section 9 creates additional obligations for processing personal data of children and certain persons with disabilities who have a lawful guardian. Subject to the Act and applicable exemptions, it includes requirements concerning verifiable consent and restrictions on processing likely to cause detrimental effects on the well-being of a child. The maximum scheduled penalty is Rs. 200 crore.
Section 10: Significant Data Fiduciary
Section 10 permits the Central Government to notify a Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary after considering the statutory factors. Additional obligations include appointment of a Data Protection Officer based in India, appointment of an independent data auditor and other prescribed measures. Breach of these additional obligations may attract a penalty up to Rs. 150 crore.
Section 15: Duties of Data Principal
Section 15 sets out duties of a Data Principal, including compliance with applicable law while exercising rights under the Act, not impersonating another person, not suppressing material information in specified identification-related circumstances, not registering a false or frivolous grievance or complaint, and furnishing authentic information when seeking correction or erasure. The Schedule provides a maximum penalty of Rs. 10,000 for breach of these duties.
Section 32: Voluntary undertaking
Section 32 allows the Board to accept a voluntary undertaking in relation to a matter concerning observance of the Act. Breach of a term of an accepted undertaking may result in a penalty up to the extent applicable to the underlying breach for which proceedings under section 28 were instituted.
How section 33 determines a monetary penalty
Section 33 is the penalty provision connected with the Schedule. Where the Board concludes an inquiry and finds that a breach is significant, it may impose a monetary penalty after giving the person a reasonable opportunity of being heard. In determining the amount, section 33 requires consideration of statutory factors rather than treating the maximum amount in the Schedule as an automatic penalty.
- The nature, gravity and duration of the breach may be relevant.
- The type and nature of personal data affected may be considered.
- Whether the breach is repetitive may affect the assessment.
- Gain or loss resulting from the breach and steps taken to mitigate its effects may be considered.
- The proportionality and likely effectiveness of the monetary penalty are relevant statutory considerations.
Can the Schedule be amended?
Yes. Section 42 empowers the Central Government, by notification, to amend the Schedule subject to the statutory limit that an amended penalty cannot exceed twice the amount originally specified in the Schedule.
Current legal position
The DPDP Act is being brought into force in stages. The 13 November 2025 commencement notification immediately brought specified institutional and rule-making provisions into force, while other provisions were assigned later commencement dates. The Digital Personal Data Protection Rules, 2025 also use a phased commencement structure. Readers should therefore check the latest official commencement notifications and rules before relying on a particular obligation or penalty as presently enforceable.