What are the DPDP Act penalty limits?

What ceilings does the DPDP Schedule set?

Seven ceilings, and they are ceilings, not fixed fines. The Schedule to the Digital Personal Data Protection Act, 2023, read with section 33(1), is the list the Board uses when it imposes a monetary penalty.

The words in the Schedule are "may extend to". A ₹250 crore figure is the top of the safeguards row, not the amount the Board must impose for every incident.

When can section 33 impose a penalty?

After an inquiry, and only if the breach is significant. Section 33(1) says that if the Board determines, on conclusion of an inquiry, that a breach of the Act or the rules by a person is significant, it may, after giving that person an opportunity of being heard, impose the monetary penalty specified in the Schedule.

That sentence sets two conditions. The Board has to finish an inquiry and find the breach significant. The person has to be heard. A newspaper report of a leak is not, by itself, a section 33 penalty.

Which factors does section 33 list?

Seven, and the Board shall have regard to them when it sets the amount. Section 33(2) lists the nature, gravity and duration of the breach; the type and nature of the personal data affected; whether the breach is repetitive; whether the person realised a gain or avoided a loss; whether the person acted to mitigate the effects, and how quickly; and whether the penalty is proportionate and effective as a deterrent. The last factor is the likely impact of the penalty on the person.

That list is why two fiduciaries with the same row can face different amounts. The Schedule sets the ceiling. Section 33(2) sets the reasoning that has to sit under the number.

When do the DPDP Rules commence?

In three groups, counted from publication of G.S.R. 846(E) on 13 November 2025. Rule 1 of the Digital Personal Data Protection Rules, 2025 says rules 1, 2 and 17 to 21 come into force on the date of publication in the Official Gazette. Rule 4 comes into force one year after that publication. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after that publication.

The first group is the Board's own machinery: appointment and procedure, not the day-to-day duties of a Data Fiduciary. The eighteen-month group is where consent, security safeguards, breach intimation and erasure sit. Eighteen months after 13 November 2025 is 13 May 2027. One year after that publication is 13 November 2026.

Those dates govern the rules. They do not, by themselves, appoint section 33 of the Act. Section 1(2) of the Act still requires a gazette notification before a provision of the Act is in force, and different provisions may be appointed on different dates.

What is the DPDP 72-hour report?

The detailed report to the Board, due within seventy-two hours of the fiduciary becoming aware of a personal data breach. Rule 7(2) splits the Board intimation in two. Without delay, the fiduciary sends a description of the breach: nature, extent, timing, location, and likely impact. Within seventy-two hours, or a longer period the Board allows on a written request, it sends the updated description, the facts and reasons, mitigation, any findings on who caused the breach, remedial measures, and a report of the intimations given to affected Data Principals.

The intimation to each affected Data Principal is separate, and it is not on the seventy-two-hour clock. Rule 7(1) says that intimation goes out without delay, in a concise and plain form, through her user account or any mode of communication she has registered. It covers the nature and timing of the breach, the consequences relevant to her, the measures the fiduciary is taking, the steps she may take, and a business contact who can answer her questions.

Rule 7 is in the eighteen-month group under rule 1(4). The seventy-two hours are the content of the rule. They are not a deadline that started on 13 November 2025.

Which Schedule row does a late intimation hit?

Schedule item 2, up to ₹200 crore, once section 8(6) and section 33 are in force. That row is the failure to give the Board or the affected Data Principal notice of the breach. It is not the ₹250 crore row, which is the failure to take reasonable security safeguards under section 8(5). A late letter and a missing safeguard are different breaches.

How do I confirm DPDP commencement?

1. Read section 1(2) of the Act. A provision is in force only from the date the Central Government appoints in the Official Gazette.
2. Open G.S.R. 846(E) of 13 November 2025 and rule 1. Sort the rule you care about into the publication-date wave, the one-year wave, or the eighteen-month wave.
3. Do not treat a Schedule ceiling as payable until the notification appointing section 33, and the section the row cites, is in the gazette.
4. For a breach intimation, read rule 7 against that commencement, not against a slide that quotes ₹250 crore for every incident.

Where is the DPDP Schedule published?

In the Act, not in a circular. The ceilings are the Schedule, applied through section 33. The phased start of the duties those rows describe is in G.S.R. 846(E). Gazette notifications that appoint the Act's own provisions show up on the e-Gazette updates feed. Read the notification before you treat a ceiling as a live demand.