DPDP penalties are ceilings, not automatic invoices

A slide saying “one mistake costs ₹250 crore” may win attention in a budget meeting. It also gives the wrong account of the DPDP penalty framework. A maximum is not an invoice generated whenever an incident occurs.

The distinction matters for business decisions. Overstatement encourages panic purchases and makes every risk look identical. Understatement can be equally unhelpful: a ceiling is a serious potential consequence, and the law contains different categories of contravention. A useful assessment identifies the provision, the facts and the statutory decision process.

At the research cutoff of 22 October 2026, the relevant DPDP enforcement provisions are scheduled to commence on 13 May 2027 under the commencement notification. This article explains that prospective framework. It does not suggest that existing contractual, sectoral or other legal exposure disappears during the transition.

Read the process before the number

Section 33 provides for a monetary penalty where the Board determines, on conclusion of an inquiry, that a breach of the Act or Rules is significant. The person concerned must receive an opportunity to be heard. The Board may then impose a penalty within the applicable Schedule limit.

That is a sequence involving findings and judgment. It is not equivalent to a software rule that assigns the highest number to every reported event. Nor does the existence of an incident establish, without analysis, which obligation was breached or what the result of an inquiry would be.

For a hypothetical retailer that sends a customer list to the wrong recipient, the useful questions include what happened, what data was involved, which safeguards existed, how quickly access was contained and which duties apply. Calling the event a “₹250 crore breach” answers none of those questions.

Know which ceiling you are discussing

The Schedule to the Act sets different maxima. A breach of the section 8(5) security-safeguards obligation can attract up to ₹250 crore. A breach of the section 8(6) notification obligation can attract up to ₹200 crore. The children’s-data category also has a ₹200 crore ceiling, while the additional Significant Data Fiduciary obligations have a ₹150 crore ceiling.

The Schedule separately addresses Data Principal duties, voluntary undertakings and other contraventions. It is inaccurate to use the largest figure as the automatic amount for every category. It is also inaccurate to present that figure as a universal cap on every possible liability arising from a business incident.

Avoid importing numbers from abandoned proposals or another jurisdiction. A percentage-of-turnover formula from GDPR is not the DPDP Schedule. If a presentation includes a penalty figure, attach the provision and the word “maximum” or “up to” in the same place.

Facts influence the assessment

Section 33 requires consideration of factors including the nature, gravity and duration of the breach; the type and nature of personal data; repetition; gain realised or loss avoided; and whether mitigation was timely and effective. The assessment also considers proportionality, effectiveness and deterrence, and the likely impact of imposing the penalty on the person.

These factors do not create a guaranteed discount menu. A business cannot promise that a particular certificate or response time reduces a fine by a fixed percentage. They do explain why evidence about actual conduct matters more than a generic assertion that the organisation takes privacy seriously.

In the hypothetical retailer’s case, a factual chronology, preserved access evidence, containment records and an honest account of uncertainty can support later assessment. Concealing the incident or rewriting records would make the account less trustworthy. Preparation should help the team reconstruct what happened accurately.

Keep penalties separate from compensation

Section 34 directs sums realised through penalties to the Consolidated Fund of India. The statutory penalty is not an automatic compensation payment to the affected customer. Questions about other remedies require their own analysis under applicable law and facts.

A customer-facing response should therefore explain the actual incident and available grievance route. It should not promise that a complaint will produce a specified payout. An internal budget should likewise distinguish prevention spending, response costs, contractual exposure and potential regulatory consequences.

Replace the scare slide with a decision

For the next management discussion, show the relevant workflow, the failure that could occur, affected people, existing controls, unresolved weaknesses and the cost of the proposed improvement. Add the applicable legal categories as context. Give each improvement an owner and a way to demonstrate completion.

The failure to avoid is using the highest penalty as a substitute for risk analysis. A well-supported investment case explains how a control reduces a concrete exposure, even when no one can responsibly predict a future Board decision.