The Schedule: The Schedule: penalties
- Status
- Upcoming
- Applies from
- 13 May 2027G.S.R. 843(E)
- Penalty
- Up to Rs 50 croreSchedule, item 7
- Binds
- Every Data Fiduciary
In plain English
Sets the ceiling for each kind of breach: up to Rs 250 crore for failing to take reasonable security safeguards under s. 8(5); up to Rs 200 crore for failing to notify the Board or affected Data Principals of a breach under s. 8(6); up to Rs 200 crore for breaching the duties on children's data under s. 9; up to Rs 150 crore for a Significant Data Fiduciary's additional duties under s. 10; up to Rs 10,000 for a Data Principal's duties under s. 15; the amount a voluntary undertaking would have covered where the undertaking is broken; and up to Rs 50 crore for any other breach. Every figure is a ceiling the Board applies using the factors in s. 33.
What you must do
Treat security safeguards (s. 8(5)) and breach intimation (s. 8(6)) as the two highest-exposure duties: together they carry the two largest ceilings in the Schedule.
Gazette text · The Schedule[See section 33 (1)]
- [See section 33 (1)]
| Sl. No. | Entry | Penalty: |
|---|---|---|
| 1. | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to two hundred and fifty crore rupees. |
| 2. | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. | May extend to two hundred crore rupees. |
| 3. | Breach in observance of additional obligations in relation to children under section 9. | May extend to two hundred crore rupees. |
| 4. | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to one hundred and fifty crore rupees. |
| 5. | Breach in observance of the duties under section 15. | May extend to ten thousand rupees. |
| 6. | Breach of any term of voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. |
| 7. | Breach of any other provision of this Act or the rules made thereunder. | May extend to fifty crore rupees. |
Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)
Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, the Schedule · Change log