Chapter 13: Inquiry, Penalties, and Appeals

Enforcement and penalties for non-compliance

chapter · 2 min read · Updated 14-Feb-2026 · 13 of 14

Executive Summary

•The Board may impose monetary penalties after inquiry, taking the statutory factors into account. The Schedule sets different maximum amounts for different contraventions.

Institutional Impact

•The Menu Card: (1) Breach Prevention failure: up to ₹250 Cr. (2) Failure to notify breach: up to ₹200 Cr. (3) Breach of duties towards children: up to ₹200 Cr.
•Mitigation: The Board looks at steps you took *to prevent* the breach. If you were negligent, the fine goes up. If you did everything right and it still happened, the fine might be lower.

Data Principal Rights

•User Penalties: Yes, users have duties too. If you file false/frivolous grievances or impersonate others, you can be fined up to ₹10,000.

Practical application

What this looks like in practice

Use these examples to distinguish a defensible process from a common mistake.

Right

✓A fiduciary keeps evidence of preventive safeguards, incident response, and remediation so it can demonstrate responsible compliance.

Incorrect

×An organization treats a penalty as a cost of doing business and cannot show what it did to prevent or address a violation.

Official Reference & Scope

•Sections 27-28: Board inquiry and orders
•Section 29: Appeals
•Section 33: Penalties
•Schedule to the Act: Maximum monetary penalties
•Rules 19(9) and 22: Inquiry timing and digital appeals

Details the penalty framework and adjudication process for DPDP Act violations.

Penalty amounts: Financial penalties for different violations
Adjudication process: How penalties are determined and imposed
Factors considered: Mitigating and aggravating circumstances
Payment and enforcement: Penalty collection mechanisms

Rule 13 concerns additional SDF obligations, not adjudication. Board procedure is addressed principally by the Act and rule 19, while rule 22 addresses appeals.

Primary sources: sections 27-33 and the Schedule to the DPDP Act and rules 19 and 22 of the DPDP Rules.

Related resources

DPDP penalties at a glance

Back to list

Chapter 12: Data Protection Board Next: Chapter 14: Transfers, Exemptions, and Commencement