Tool · Free · No sign-up

DPDP penalty exposure calculator

Tick the gaps you have today and see which penalties in the Schedule they expose you to, item by item, with the section behind each one.

Your answers

1. Do you process the personal data of children (anyone under 18)? Yes No

2. Has the Central Government notified you as a Significant Data Fiduciary? Yes No Not yet, but we expect to be

3. Tick each gap that is true of you today.

The gaps are grouped under the item of the Schedule they fall under. Your answer updates as you tick.

Schedule item 1 · s. 8(5) and Rule 6 · Up to Rs 250 croreSecurity safeguards Personal data is not encrypted, masked, obfuscated or tokenised everywhere it is stored or sent. Some systems that hold personal data have no access control. Access logs are not kept and reviewed, or are kept for less than a year. There are no backups or continuity measures for personal data. Some Data Processor contracts have no security safeguard clauses.

Schedule item 2 · s. 8(6) and Rule 7 · Up to Rs 200 croreBreach intimation There is no written process for telling the Board and each affected person about a breach without delay. You could not file the full report to the Board within 72 hours. You do not hold a working email address or phone number for every user, to reach them after a breach.

Schedule item 7 · Any other provision · Up to Rs 50 croreOther duties under the Act and Rules Consent notices are not standalone, or do not list the data and the purpose (s. 5, Rule 3). Consent is not given by a clear affirmative action, or withdrawing it is harder than giving it (s. 6). Personal data is kept after its purpose is served or consent is withdrawn (s. 8(7), Rule 8). There is no published contact for questions about your processing (s. 8(9), Rule 9). There is no published way to make a rights request, or grievances are not answered within 90 days (ss. 11 to 13, Rule 14). There is no way for a person to nominate someone to act for them (s. 14). Some Data Processors work for you without a valid contract (s. 8(2)).

Nothing you enter leaves your browser.

Your exposure

Tick the gaps that are true of you today. Each one you tick shows here, under the Schedule item it falls under, with that item's ceiling.

Applies from 13 May 2027

How the Board sets a penalty

Every figure here is a ceiling, not a fine. The Board may impose a penalty only after an inquiry finds a breach significant, and only after hearing you (s. 33(1)). To set the amount, it weighs the factors in s. 33(2): the nature, gravity and duration of the breach; the type of personal data affected; whether the breach was repeated; any gain made or loss avoided; how quickly and how well you mitigated it; whether the penalty is proportionate and effective; and its likely impact on you.

The calculator does not add the ceilings together. The Act gives no combined figure, and the Board decides each breach on its own.

What the calculator covers

Source: DPDP Act 2023, the Schedule, as published in the Gazette of India

Item	Breach	Ceiling	Asked about	Status
1	Not taking reasonable security safeguards to prevent a personal data breachDPDP Act 2023, s. 8(5); DPDP Rules 2025, Rule 6	Rs 250 crore	Yes	Upcoming · 13 May 2027
2	Not telling the Board or an affected Data Principal about a personal data breachDPDP Act 2023, s. 8(6); DPDP Rules 2025, Rule 7	Rs 200 crore	Yes	Upcoming · 13 May 2027
3	Not meeting the additional duties for children's dataDPDP Act 2023, s. 9; DPDP Rules 2025, Rule 10	Rs 200 crore	If you process children's data	Upcoming · 13 May 2027
4	Not meeting the additional duties of a Significant Data FiduciaryDPDP Act 2023, s. 10; DPDP Rules 2025, Rule 13	Rs 150 crore	If you are, or expect to be, a Significant Data Fiduciary	Upcoming · 13 May 2027
5	A Data Principal breaching their own dutiesDPDP Act 2023, s. 15	Rs 10,000	No: it applies to individuals	Upcoming · 13 May 2027
6	Breaking a term of a voluntary undertaking the Board has acceptedDPDP Act 2023, s. 32	The ceiling for the original breach	No: it needs an accepted undertaking	Upcoming · 13 May 2027
7	Breaching any other provision of the Act or the RulesDPDP Act 2023, the Schedule, item 7	Rs 50 crore	Yes	Upcoming · 13 May 2027

Sources: DPDP Act 2023, s. 33 and the Schedule; DPDP Rules 2025, Rules 3, 6, 7, 8, 9, 10, 13 and 14

This page explains the law in plain English. It is not legal advice.