If you are a Data Protection Officer, CISO, or compliance lead at an Indian company, one number should be on your radar right now: ₹250 crore.
That is the maximum penalty a business can face for a single instance of non-compliance under India’s Digital Personal Data Protection Act, 2023. And with the Data Protection Board of India (DPBI) now active since November 2025, enforcement is no longer theoretical.
This guide covers exactly what the DPDP Act says about penalties, how breach notification works, what makes India’s rules stricter than GDPR in some ways, and what your team needs to do to stay ready.
The Data Protection Board of India: Who Are They and What Can They Do?
The Data Protection Board of India (DPBI) is the regulator created under the DPDP Act. It was established in November 2025 under Phase 1 of the law’s rollout. The Board’s job is to:
- Receive breach notifications from Data Fiduciaries
- Investigate complaints from individuals (Data Principals)
- Conduct inquiries into suspected non-compliance
- Impose financial penalties
Issue directions to businesses to correct violations
Organizations can appeal the Board’s decisions to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
DPDP Penalty Structure: What You Can Actually Be Fined
The DPDP Act sets different penalty levels based on the type of violation. Here is a clear breakdown:
Up to ₹250 crore: Failing to implement reasonable security safeguards that lead to a personal data breach. This is the most serious category.
Up to ₹200 crore: Failing to notify the Data Protection Board or affected individuals about a data breach. Also applies to breaches involving children’s data and violations of obligations for Significant Data Fiduciaries.
Up to ₹50 crore: Smaller violations such as failing to maintain data principal rights processes, not providing required disclosures, or non-compliance with board directions.
Here is the critical point: these penalties apply per incident. A single large breach affecting multiple users is not treated as one fine. Each instance of non-compliance can trigger a separate penalty.
Breach Notification: India’s Zero-Threshold Rule
This is where India’s DPDP Act differs significantly from GDPR and most global privacy laws.
Under GDPR, a data breach must be reported only if it is likely to result in a risk to the rights and freedoms of individuals. Under Australia’s Notifiable Data Breaches scheme, there is a serious harm threshold. Even under US state laws, there is typically a harm test.
India’s DPDP Act has none of this.
Any personal data breach — regardless of how small, how unlikely to cause harm, or how quickly contained — must be reported to the Data Protection Board. On a strict reading of the law, even a minor misconfiguration that briefly exposed data must be reported.
The expected reporting window is ‘as soon as possible’ — in practice, the industry standard interpretation is within 72 hours, similar to GDPR. However, the Act does not specify this number explicitly. The Data Protection Board is expected to provide further clarity.
What Must Be Reported in a Breach Notification?
When a breach happens, your notification to the Data Protection Board and affected Data Principals must include:
- Nature of the breach — what happened, how, and when it was discovered
- Categories and approximate number of data records affected
- Likely consequences of the breach
- Measures taken or proposed to address the breach
- Contact details of the Data Protection Officer (DPO) or relevant point of contact
You must also notify affected individuals in language they understand — in plain terms, not legal jargon.
What Security Safeguards Are Legally Required?
The DPDP Rules 2025 specify these mandatory security measures for all Data Fiduciaries:
- Encryption and masking of all personal data in storage and transit
- Access control systems — role-based, with documented authorization levels
- Access logging and monitoring — who accessed what data and when
- Data backups to preserve continuity even after a breach
- Systems to detect unauthorized access and investigate it
- System and processing logs retained for a minimum of one year
These safeguards also apply to your vendors and data processors. If a third-party tool causes a breach, you are still responsible.
Special Obligations for Significant Data Fiduciaries
If your organization is designated a Significant Data Fiduciary (SDF) — likely based on the volume and sensitivity of data processed — you face additional compliance requirements:
- Annual data audits by an independent auditor
- A mandatory Data Protection Officer — based in India, accountable to your board
- Algorithmic transparency — you must be able to demonstrate that your algorithms do not violate data principal rights
- Cross-border transfer restrictions — data can only flow to countries on a government-approved whitelist
How to Build a Breach-Ready Organization?
Most organizations will not know they have a problem until it is too late — unless they build systems that detect breaches in real time. Here is what your team needs to put in place:
1. Maintain a Data Inventory
You cannot report a breach accurately if you do not know where your data lives. Conduct regular data discovery exercises to map personal data across all systems — databases, cloud storage, SaaS tools, and endpoints.
2. Deploy Real-Time Monitoring
Use Security Information and Event Management (SIEM) or equivalent tools to detect unusual access patterns, large-scale data exports, or unauthorized queries — before they escalate.
3. Create and Test an Incident Response Plan
Have a clear, written plan for what happens when a breach is detected: who is notified first, who assesses the scope, who contacts the Data Protection Board, and who communicates with affected users. Test this plan with tabletop exercises at least once a year.
4. Retain System Logs
Logs must be kept for at least one year. After a breach, these logs are your primary evidence for demonstrating that you acted in good faith and implemented required safeguards. Missing logs are treated as a compliance failure.
How DPDP AI Helps With Breach Response?
DPDP AI’s compliance platform includes automated breach detection alerts, pre-built notification templates for the Data Protection Board, audit-ready log retention, and real-time dashboards that give your DPO visibility across all data processing activities.
When a breach happens, the last thing you want is to be hunting through spreadsheets to figure out what data was affected. An AI-powered system gives you that answer in minutes, not days — and helps you meet the reporting window without missing it.
