DPDP compliance: a 10-point starter checklist and the penalties
Penalties under the DPDP Act are set by the duty broken, not by company size: up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not reporting a data breach, up to ₹200 crore for breaking the rules on children’s data, and up to ₹50 crore for other breaches. Start with a data-flow register, clear consent, vendor contracts and a written breach plan.
How the penalties add up
Each duty carries its own maximum, and one incident can break several. A breach that was reported late and involved children’s records could engage three heads at once. The Board also looks at how you behaved after you found the problem, so a tested response plan matters.
Consent is your default
The no-consent “legitimate uses” are narrow: employment purposes, court orders, emergencies and disclosures the law requires. Routine collection, such as a shop’s checkout details or a school’s admission form, needs consent tied to a clearly stated purpose. Marketing and sharing with partners need their own separate consent. Don’t bundle them.
The first document to build
Not a privacy policy, but a data-flow register: for each flow, what the data is, the purpose, your role and the legal ground. Everything else, from notices to retention rules, is built from it.
Key facts
| Weak security safeguards (s.8(5)) | Up to ₹250 crore |
|---|---|
| Not reporting a breach (s.8(6), Rule 7) | Up to ₹200 crore |
| Children’s data duties (s.9) | Up to ₹200 crore |
| Significant Data Fiduciary duties (s.10) | Up to ₹150 crore |
| Any other provision | Up to ₹50 crore |
| Breach report to the Board | Detailed report within 72 hours (Rule 7) |
| Settlement route | Voluntary undertaking accepted by the Board (s.32) |
Steps
- Brief the owners or board on the deadline, the penalties and the budget
- Build the data-flow register
- Check whether you are likely to be a Significant Data Fiduciary
- Make consent the default and separate each optional purpose
- Rebuild notices and consent: itemised, specific, revocable and logged
- Review vendor contracts and add breach reporting in hours
- Write a breach plan: CERT-In within 6 hours, the Board within 72 hours, affected people promptly
- Design systems so consent-based data can be erased while legally required records stay
- If you have users under 18, plan verifiable parental consent
- Plan notices for data you collected before the Act
Questions
Can I be fined if a vendor leaks my customers’ data?
Yes. As the Data Fiduciary you remain responsible for data your processor handles for you, which is why the contract with the vendor matters.
What is a voluntary undertaking?
Under Section 32, the Board can accept your written commitment to fix a problem. Once accepted, it bars proceedings on that matter, unless you break the undertaking.
Sources
- PIB explainer on the DPDP Act and Rules (Nov 2025)
- DPDP Rules, 2025 summary (S.S. Rana & Co.)
- DPDPA General Awareness guide (2026 edition), Dr. Naveen Kumar Sharma (Adv.)
Facts checked against these sources on 8 Oct 2026. Laws change; confirm before acting.
This guide is general information, not legal advice for your situation. Talk to an advocate before acting.
