DPDP Act Penalty Calculator

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes India's comprehensive data protection framework. Schedule I of the Act prescribes significant monetary penalties for non-compliance, with fines reaching up to ₹250 crore for the most severe violations.

Key Penalty Provisions

• Section 8(5) — Security Safeguards: Failure to implement reasonable security practices to protect personal data. Penalty up to ₹250 crore.
• Section 8(6) — Breach Notification: Failure to notify the Data Protection Board and affected data principals of a personal data breach. Penalty up to ₹200 crore.
• Section 8(7) — Data Deletion: Failure to erase personal data when consent is withdrawn or the purpose is fulfilled. Penalty up to ₹150 crore (non-compliance with general obligations).
• Section 6 — Consent Requirements: Processing personal data without valid, informed, specific consent. Penalty up to ₹150 crore.
• Section 9 — Children's Data: Processing children's data without parental consent or verifiable age gating. Penalty up to ₹200 crore.
• Section 16 — Cross-Border Transfer: Transferring personal data to a jurisdiction not approved by the Central Government. Penalty up to ₹250 crore.

How This Calculator Works

This calculator estimates a likely penalty range based on five factors: company size, types of data processed, the specific violation, volume of data affected, and history of prior non-compliance. The estimates are indicative and based on the penalty schedule in the Act. Actual penalties are determined by the Data Protection Board of India on a case-by-case basis.

Reduce Your Risk with Bachao.AI

Don't wait for a breach to discover your exposure. Bachao.AI offers automated DPDP compliance assessments that map your security posture to every section of the Act — with actionable remediation steps, not just a checklist.