DPDP Penalties Explained: ₹250 Crore Fine Breakdown
The DPDP Act imposes strict financial penalties. Understanding the fine structure is critical for risk assessment and compliance prioritization.
The Three-Tier Penalty Framework
Tier 1: General Violations (₹5 Crore or 5% Revenue)
What triggers this:
- Collecting data without proper consent
- Failing to honor user data rights (access, deletion, correction)
- Not maintaining data processing records
- Inadequate data minimization
- Missing or unclear privacy policies
Examples:
- An e-commerce platform collects phone numbers without consent
- A SaaS app doesn't allow users to delete their accounts
- A health app retains data beyond the stated purpose period
Penalty: Up to ₹5 crore or 5% of annual revenue (whichever is higher)
Real-world impact:
- A ₹100 crore revenue company: ₹5 crore fine
- A ₹50 crore revenue company: ₹2.5 crore fine
Tier 2: Serious Violations (₹250 Crore or 20% Revenue)
What triggers this:
- Processing sensitive data (health, financial, biometric) without consent
- Failing to report a data breach within 72 hours
- Unauthorized data sharing with third parties
- Repeated violations after a first notice
Examples:
- A HealthTech app processes patient medical records without explicit consent
- A FinTech platform experiences a breach and takes 30 days to notify users
- A manufacturing company shares employee biometric data with unknown third parties
Penalty: Up to ₹250 crore or 20% of annual revenue (whichever is higher)
Real-world impact:
- A ₹500 crore revenue company: ₹100 crore fine
- A ₹1,000 crore revenue company: ₹200 crore fine
Criminal Penalties (Imprisonment + Fine)
Severe cases result in criminal liability:
- Up to 3 years imprisonment
- Additional fines up to ₹25 crore
- Applied for intentional misuse, repeated non-compliance, or gross negligence
Criminal cases are rare but devastating to leadership.
How Penalties Are Calculated
Factors Regulators Consider
-
Severity of Violation
- Mishandling sensitive data = higher penalty
- Failure to obtain consent = higher penalty
- Late breach notification = higher penalty
-
Number of Affected Individuals
- 100 users affected ≠ 1 million users affected
- Mass breaches incur harsher penalties
-
Company Size & Revenue
- Penalties are proportional to revenue
- A startup may face ₹5 crore; an enterprise may face ₹250 crore
-
Negligence vs. Malice
- Accidental non-compliance = lower penalty
- Intentional misuse = criminal prosecution
-
History of Compliance
- First-time offender = lighter penalty
- Repeated violations = maximum penalty
Real-World Penalty Scenarios
Scenario 1: E-commerce Platform Privacy Violation
Incident: Platform collects phone numbers and location data without explicit consent (general violation).
Users Affected: 500,000
Company Revenue: ₹200 crore
Potential Fine: ₹5-10 crore (general violation tier)
Scenario 2: HealthTech Breach + Late Notification
Incident: Patient medical records leaked; company notifies users after 45 days (serious violation).
Sensitive Data: Medical histories of 50,000 patients
Company Revenue: ₹150 crore
Potential Fine: ₹30-250 crore (serious violation tier, criminal investigation possible)
Scenario 3: Third-Party Data Sharing Without Consent
Incident: SaaS platform sells anonymized user behavior data to marketers without consent (serious violation).
Users Affected: 2 million
Company Revenue: ₹500 crore
Potential Fine: ₹100-250 crore (serious violation, reputational collapse likely)
Beyond Financial Penalties
Penalties extend beyond fines:
- Operational Impact: Forced shutdown of services until compliance
- Regulatory Scrutiny: Ongoing audits and monitoring
- Reputational Damage: Customer churn, loss of trust
- Legal Liability: Users can sue separately for damages
- Leadership Accountability: Directors may face criminal charges
- Enterprise Contracts: B2B customers terminate relationships
Strategic Risk Assessment
Understand your exposure:
- Data Volume Risk: How much personal data do you hold?
- Data Sensitivity: Do you process health, financial, or biometric data?
- User Base: How many individuals are affected?
- Geographic Scope: Are all users Indian residents?
- Third-Party Sharing: Do vendors process your user data?
A single serious violation can devastate a company.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice.
Protect Your Business:
