Breaches and penalties under the DPDP Act
What India's DPDP Act asks you to do after a personal data breach, and the most the Board may impose for each kind of failure.
After a personal data breach you tell the people affected and the Board. The Act also caps the penalty for each kind of failure.
Not legal advice
This page is a summary, not legal advice. It leaves out detail and exceptions, and the law may change. Read the Act and the Rules, and ask your own counsel.
What to do after a breach#
When a personal data breach happens (section 8(6), Rule 7), you must:
- tell each affected person without delay, through their account or a contact they registered with you
- tell the Board without delay
- send the Board a detailed report within 72 hours of becoming aware of the breach
The Board may allow a longer period for the report if you ask in writing. The Rules set no minimum size for a breach to count.
How the product helps#
The Breach register records each incident. It counts down the 72 hours from when you became aware. It warns your systems 12 hours before the report is due. It drafts both the Board report and the notice to people.
The register does not send anything. You send the report to the Board. You send the notices, because you hold the contact details. Then you record in the register when you did. See Record a breach.
An example#
Kaveri Stores learns on Monday at 10:00 that an export of customer data was exposed. The privacy lead records the breach with that time under Became aware. The register shows the Board report as due on Thursday at 10:00.
If no report date is recorded by Wednesday at 22:00, the breach.report_due webhook is sent.
Penalties#
The Board may impose a penalty after an inquiry. The Schedule to the Act sets the most it may impose for each kind of failure.
| Failure | Up to |
|---|---|
| Not taking reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Not telling the Board or the affected people about a breach | ₹200 crore |
| Not meeting the duties about children | ₹200 crore |
| Not meeting the extra duties of a Significant Data Fiduciary | ₹150 crore |
| Any other breach of the Act or the Rules | ₹50 crore |
| Breach of a voluntary undertaking given to the Board | The amount that applies to the breach the undertaking was about |
| A Data Principal not meeting their own duties under section 15 | ₹10,000 |
The Schedule has no separate line for notice, rights requests or retention. As we read it, a failure there falls under "any other breach".