At a glanceWhen the Data Protection Board finds a breach, it imposes a financial penalty — up to ₹250 crore for the most serious failures — set by weighing the breach’s gravity, duration and impact. The money goes to the government, not to affected people. A company (or a complainant) unhappy with a Board order can appeal to the Telecom Disputes Settlement and Appellate Tribunal within 60 days. Penalties can also run the other way: a person who files a false or frivolous complaint can be fined up to ₹10,000.
Educational resource only. This explains how enforcement and appeals work under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
How the Board enforces: penalties, not payouts
The Board’s main enforcement tool is a financial penalty on the company — a deterrent, not compensation. The Act sets tiered ceilings (Section 33 and its Schedule), with the cap depending on which duty was broken:
- Up to ₹250 crore — failure to take reasonable security safeguards, where that leads to a personal data breach.
- Up to ₹200 crore — failure to notify a breach to the Board and affected people, or breach of the extra obligations around children’s data.
- Up to ₹150 crore — breach of the additional obligations placed on a Significant Data Fiduciary (a larger, higher-risk company named by the government).
- Up to ₹50 crore — for other breaches of the Act’s duties.
These are maximums, not fixed fines. The Board decides the actual amount case by case.
How the size of a penalty is decided
The Board weighs the seriousness of what happened, not just the size of the company. The Act lists the factors it must consider, which include:
- the nature, gravity and duration of the breach;
- the type and sensitivity of the personal data affected;
- whether it was a one-off or a repeated pattern;
- any gain the company made or loss it avoided by breaking the rule; and
- what the company did to mitigate the harm once it knew.
The effect is that a small, quickly-fixed lapse and a large, ignored, repeated failure are treated differently — the same ceiling, very different outcomes.
Can a Board decision be appealed?
Yes — a Board order isn’t the last word. Either side can appeal to a specialist tribunal within 60 days. An appeal against an order or direction of the Board lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which the Act designates as the Appellate Tribunal (Section 29).
The essentials:
- Who can appeal: any person aggrieved by the Data Protection Board’s order — the penalised company, and in principle a complainant unhappy with the outcome.
- The window: within 60 days of receiving the order. The Tribunal can allow a later appeal only if satisfied there was sufficient cause for the delay.
- What the Tribunal can do: after hearing both sides, confirm, modify, or set aside the Board’s order.
- Digital by design: like the Board, the Tribunal is expected to work largely through electronic means for these appeals.
A Tribunal decision can itself be challenged higher up, so the appeal route doesn’t necessarily end at the Tribunal — but that’s the rung directly above the Board.
Where the penalty money actually goes
Straight to the government — penalties are not compensation for victims. All sums the Board collects as penalties are credited to the Consolidated Fund of India (Section 34). This is the single most misread part of DPDP enforcement: winning a complaint can get a company penalised and forced to comply, but it does not put money in the affected person’s pocket. If personal compensation is the goal, that’s a separate legal track, not this one.
The other direction: penalties on complainants
Enforcement isn’t one-way — misusing the complaint system carries its own penalty. The Act guards against abuse: a Data Principal who files a false or frivolous complaint, impersonates someone, or furnishes false particulars can be penalised up to ₹10,000. The point isn’t to discourage genuine complaints — it’s to keep the Board’s digital docket from being clogged with bad-faith ones. A real, evidenced grievance is exactly what the system is built to hear; a fabricated one is what this provision is aimed at.
FAQ
What’s the biggest penalty under the DPDP Act?
Up to ₹250 crore, for failing to take reasonable security safeguards where that causes a personal data breach. Other breaches carry lower ceilings.
Are DPDP penalties fixed amounts?
No. The figures are maximums. The Board sets the actual penalty by weighing factors like the breach’s gravity, duration, the data involved, repetition, and mitigation.
Can a company appeal a Board penalty?
Yes — to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), within 60 days of the order.
Do penalties get paid to the people whose data was breached?
No. They go to the Consolidated Fund of India. Enforcement penalises the company; it does not compensate individuals.
Can I be penalised for complaining?
Only for a false, frivolous, or fraudulent complaint — up to ₹10,000. A genuine, honestly-made complaint doesn’t attract this.