← Back home
| Breach | Maximum penalty |
|---|---|
| Breach of provisions of the Act or rules | Up to ₹50 crore |
| Failure to take reasonable security safeguards | Up to ₹250 crore |
| Failure to notify a personal data breach | Up to ₹200 crore |
| Breaches concerning children's data | Up to ₹200 crore |
| Breach of Significant Data Fiduciary obligations | Up to ₹150 crore |
| Breach of Data Principal duties | Up to ₹10,000 |
| Breach of a voluntary undertaking | Up to the applicable penalty |
| Other breaches | Up to ₹50 crore |
These are maximums, not automatic fines
Before deciding a penalty, the Data Protection Board is required to weigh factors including:
- The nature, gravity, and duration of the breach
- The type and sensitivity of personal data affected
- Whether the breach is repetitive
- Gains realised or losses avoided
- Mitigation efforts taken
- Whether the penalty would be proportionate and effective
- The likely impact of the penalty on the person or organisation
This is a reference summary, not legal or financial advice. The actual penalty in any case depends on the Board's assessment of the specific facts.