What is your maximum DPDP penalty exposure?

The Schedule to the Digital Personal Data Protection Act 2023 prescribes the following maxima per failure: up to ₹250 crore for a Data Fiduciary failing to take reasonable security safeguards to prevent a personal-data breach; up to ₹200 crore for failure to notify the Data Protection Board and affected Data Principals of a breach; up to ₹150 crore for failure to fulfil additional obligations in relation to children (Section 9) or as a Significant Data Fiduciary (Section 10); and up to ₹50 crore for breach of any other provision of the Act or Rules. The Board determines the actual quantum based on nature, gravity, duration, impact and willfulness of the breach.

No. This is an educational fear-mapping tool that visualises the upper-bound statutory penalty exposure if every weakness you disclose were treated as a separate breach. The Data Protection Board exercises discretion under Section 33 of the DPDP Act 2023 when fixing the actual quantum. Always consult qualified Indian counsel before relying on any output of this tool in regulatory proceedings or board reporting.

Section 9 of the DPDP Act 2023 imposes additional obligations on Data Fiduciaries processing personal data of children (under 18) — verifiable parental consent, prohibition on behavioural monitoring and on targeted advertising. Failure to meet these obligations attracts a separate ₹150 crore band and the Board has signalled in published guidance that child-data breaches will be treated as aggravating. Our model applies a conservative 3x multiplier on top of the base exposure to surface that aggravation.

Section 10 lets the Central Government notify a Data Fiduciary as Significant based on volume, sensitivity, risk and impact. Significant Data Fiduciaries owe extra duties — appointing a DPO, conducting DPIAs, undergoing independent audits. A failure to discharge these duties opens the same ₹150 crore band as the children clause and the Board has indicated heavier sanction. Our model doubles your base exposure if you are (or are likely to be) an SDF.

Section 16 of the DPDP Act 2023 adopts a "negative list" regime — transfer is permitted to every country EXCEPT those restricted by Central Government notification. Sectoral regulators (RBI, IRDAI, SEBI, MeitY) may impose stricter India-only residency on payment, insurance, securities or health data on top of Section 16. The DPB has signalled it will issue an initial restricted-country list; treat any country not yet on a public allow-list with caution and route through a contractual model evaluation. A non-whitelisted transfer adds a ₹50 crore Section 17 band to your exposure.

Only if you click the gated PDF download CTA at the bottom of the calculator. Your 8 answers, your computed exposure and your WhatsApp number are then POSTed to /api/v1/leads so we can WhatsApp you the remediation playbook. The slider movement, your in-flight answers and any back-and-forth in the calculator never leave your browser unless you choose to download. We hold the lead under DPDP Section 6 consent until you withdraw via [email protected].