The Schedule to the Digital Personal Data Protection Act, 2023 sets maximum penalties by type of failure. The highest is up to 250 crore rupees for failing to take reasonable security safeguards under section 8(5). Failing to notify a breach under section 8(6) can reach 200 crore rupees. These are ceilings, not fixed amounts.
The schedule line by line
From the Schedule to the Act:
- Section 8(5), reasonable security safeguards to prevent personal data breach: may extend to 250 crore rupees.
- Section 8(6), notice of a breach to the Board and affected Data Principals: may extend to 200 crore rupees.
- Section 9, additional obligations for children: may extend to 200 crore rupees.
- Section 10, additional obligations of Significant Data Fiduciaries: may extend to 150 crore rupees.
- Section 15, duties of the Data Principal: may extend to ten thousand rupees.
- Breach of a term of a voluntary undertaking accepted by the Board: up to the extent applicable for the breach it concerned.
- Any other provision of the Act or its rules: may extend to 50 crore rupees.
What each line means for engineering
Safeguards: the rules spell out the minimum in rule 6, which is where encryption or masking, access control, logging, backups and processor contracts live.
Breach notice: rule 7 sets the content and timing. Your incident process and data inventory decide whether you can meet it.
Children: age gating and verifiable parental consent flows are product and engineering work. Rule 10 sets out the verifiable consent mechanics.
Significant Data Fiduciaries: yearly impact assessment and audit under rule 13, plus algorithmic due diligence.
The catch all line matters for everything else, including erasure under section 8(7) and the rights handling in rule 14.
What the schedule does not tell you
It gives maximums. How the Board decides an amount depends on the Act's process, including the factors it weighs. This post does not cover that, and I have not confirmed any enforcement practice because the safeguard rules have a delayed start.
Why the numbers should not drive the plan
A ceiling of 250 crore rupees makes a headline, but it does not tell you the likely outcome. The more useful reading is relative: the schedule shows which failures the Act treats as most serious. Security safeguards and breach notice sit at the top, so a team with limited time should put its first effort there and be able to show what it did and when.
Using the schedule to prioritise
Because the top two lines concern security safeguards and breach notice, most teams start there:
- Map personal data stores and processors.
- Close the rule 6 gaps.
- Rehearse the rule 7 notice process.
- Work through children, Significant Data Fiduciary and rights obligations as they apply.
Quick check
Is 250 crore rupees the standard fine?
No. The Schedule says the penalty may extend to that amount. It is a ceiling.
Do penalties apply to processors?
The security duty falls on the Data Fiduciary, including for processing done on its behalf by a Data Processor. Contract terms matter for that reason.
Sources
- Digital Personal Data Protection Act, 2023 (MeitY)
- Digital Personal Data Protection Rules, 2025 (MeitY)
Last reviewed: 19 October 2026.
