Did You Know? · Corporate & Commercial Contracts
Do you know the maximum DPDP Act penalty is Rs. 250 crore per instance of breach, not per company per year?
Penalties under the DPDP Act, 2023 are assessed per breach, and separate heads carry further exposure of up to Rs. 200 crore each.
Under Section 33 and the Schedule to the Digital Personal Data Protection Act, 2023, a failure to implement reasonable security safeguards leading to a personal data breach attracts a penalty of up to Rs. 250 crore - assessed per breach, not capped annually per organisation. Failure to notify the Data Protection Board of a breach, and violations involving children's data, each carry separate penalties of up to Rs. 200 crore. A company can face multiple, cumulative exposures from a single underlying incident handled poorly at each stage.