The price of a breach
India’s data protection law lets the Data Protection Board fine an organisation up to ₹250 crore for weak security. Here is every cap in the Act, drawn to scale, and the day each one starts to apply.
Fines can be imposed from 13 May 2027, 195 days from now. Every date in the law, with a live countdown, is on the DPDP Act, explained.
Maximum penalty for each breach, to scale
| Breach | Section | What it covers | Cap |
|---|---|---|---|
| Security safeguards | s.8(5) | Failing to take reasonable security safeguards to prevent a personal data breach | up to ₹250 crore |
| Not telling anyone | s.8(6) | Failing to tell the Data Protection Board and the affected people about a breach | up to ₹200 crore |
| Children’s data | s.9 | Not meeting the extra obligations for children’s personal data | up to ₹200 crore |
| Significant fiduciaries | s.10 | Not meeting the extra obligations of a Significant Data Fiduciary | up to ₹150 crore |
| Anything else | residual | Breaching any other provision of the Act or the Rules | up to ₹50 crore |
| A person’s own duties | s.15 | Breaching the duties the Act places on a person whose data is held (for example, filing false complaints) | up to ₹10,000 |
The law is being challenged in the Supreme Court
No court has stopped the law, so the dates and penalties on this page stand. Eight petitions are pending and the case is next listed on 17 November 2026.
Who filed, what the court has ordered and what the petitioners argue
Read this before quoting a number
These are ceilings, not prices. The Act says a penalty “may extend to” the amount. The Board decides each amount case by case, weighing things such as how serious and how long the breach was and whether the organisation acted to limit harm (section 33(2)).
No penalty has been imposed. The penalty sections apply from 13 May 2027. In May 2026 the IT ministry invited applications for the Board’s chairperson and four members; we have not found an announcement that anyone has been appointed. The Supreme Court challenges above are still pending.
The ₹250 crore tower and the 72-hour clock are linked. A breach can mean both a security failure and a late report. How the reporting deadlines stack up is on the four clocks. The whole Act in plain language is on the DPDP Act explained. This is an explainer, not legal advice.
Sources, all official: DPDP Act 2023 (Schedule, section 33) · DPDP Rules 2025, G.S.R. 846(E), 13 Nov 2025 · Commencement notification, G.S.R. 843(E) · MeitY notice inviting applications for the Board, 6 May 2026 · Supreme Court cause list, 7 Aug 2026.