DPDP Act Penalty Exposure
The DPDP Act 2023 sets statutory penalty ceilings for data-protection failures - up to ₹250 crore. This free check shows which obligations you are exposed under and how ready you are. Indicative, not a predicted fine.
DPDP Exposure Check
Answer honestly to see which DPDP Act obligations you are exposed under, the statutory penalty ceilings that apply, and how ready you are.
Volume shapes how the Board weighs gravity under s.33(2) - it is not a penalty multiplier.
How this is calculated
- Each obligation you flag as a gap adds its Schedule ceiling: reasonable security safeguards (s.8(5)) up to ₹250 crore, breach intimation to the Board and affected people (s.8(6)) up to ₹200 crore, children’s data (s.9) up to ₹200 crore, and Significant Data Fiduciary duties (s.10) up to ₹150 crore.
- The headline is the sum of the flagged ceilings - the Act sets no aggregate cap, so penalties under separate heads could add up - or "Well positioned" when nothing is flagged. Any other breach of the Act or Rules carries a residual ceiling of up to ₹50 crore, shown for context.
- Obligations in place counts the four answers that are not gaps; "not applicable" counts as in place.
- The data-volume answer is not a multiplier. It only sets a gravity label (Lower under 10,000 people, Moderate up to 10 lakh, High from 10 lakh), because s.33(2) asks the Board to weigh the nature and gravity of a breach, and it flags possible SDF designation from 10 lakh people when you answered "not applicable".
- Colour: no exposure is green, up to ₹200 crore amber, above that red.
Constants the tool uses
Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.
- Gravity label by people affected
- Lower under 10,000; Moderate to 10 lakh; High from 10 lakh
- Possible SDF flag
- From 10 lakh people, when SDF was answered "not applicable"
Worked example
The calculator run on its default inputs:
- Reasonable security safeguards across all personal data (s.8(5))
- Yes
- Breach-response process to notify the Board and affected people (s.8(6))
- Yes
- Children's (under-18) personal data (s.9)
- No
- Significant Data Fiduciary status (s.10)
- Not applicable
- People whose personal data you process
- 10k - 1 lakh
You meet the key obligations
Well positioned
- Key obligations in place
- 4 of 4
- Data-volume gravity (context for s.33(2))
- Moderate
- Reasonable security safeguards (s.8(5))
- In place / N/A - ceiling up to ₹250 crore
- Breach notification to the Board and affected people (s.8(6))
- In place / N/A - ceiling up to ₹200 crore
- Children's data obligations (s.9)
- In place / N/A - ceiling up to ₹200 crore
- Significant Data Fiduciary obligations (s.10)
- In place / N/A - ceiling up to ₹150 crore
- Any other breach of the Act or Rules (residual)
- Ceiling up to ₹50 crore
With the defaults (safeguards and a breach-response process in place, no children’s data, not an SDF, 10,000 to 1 lakh people) no head is flagged, so the result is "Well positioned": 4 of 4 obligations in place, Moderate gravity. Answer No to the safeguards question alone and the same inputs return up to ₹250 crore, the s.8(5) ceiling; add a children’s-data gap and it becomes up to ₹450 crore, because penalties under separate Schedule heads could add up.
Sources
- Digital Personal Data Protection Act, 2023 (MeitY) - obligations in ss.8(5), 8(6), 9 and 10, the s.33(2) factors, and the penalty ceilings in the Schedule
- DPDP Rules, 2025 - G.S.R. 846(E), 13 November 2025 (MeitY) - phased commencement (Rule 1) and the breach-intimation duty, including the 72-hour report to the Board (Rule 7)
- DPDP Act commencement notification - G.S.R. 843(E), 13 November 2025 (MeitY) - which sections are in force now and which start on 13 May 2027
Sources last checked September 2026.
Limitations
Schedule amounts are maximums the Board may impose per instance, not predictions; the Board sets the amount case by case under s.33(2). The check covers four heads only - notice and consent, retention and Data Principal rights fall under the residual ₹50 crore head. Most obligations and the penalty provisions start on 13 May 2027, so until then this is a readiness check. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.
Don't wait for a breach.
The DPDP Act provides for penalties of up to ₹250 crore for failing to take reasonable safeguards to protect personal data. VITI Security helps you put those safeguards in place - encryption, access control and security monitoring - alongside your privacy counsel.