Schedule explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The Schedule is the only place in the Act that gives penalty amounts. It has seven items. Five carry fixed ceilings, from two hundred and fifty crore rupees for failing to take reasonable security safeguards down to ten thousand rupees for a Data Principal's breach of her duties. One ties the penalty to the original proceeding, and one is a residual item of fifty crore rupees for any other breach. Amounts are ceilings ("may extend to") and are imposed by the Board only under section 33. For a breach exposure review, our legal dispute resolution team can help.
Item 1: security safeguards (s.8(5)), up to Rs 250 crore. Item 2: breach notice (s.8(6)), up to Rs 200 crore. Item 3: children (s.9), up to Rs 200 crore. Item 4: Significant Data Fiduciary (s.10), up to Rs 150 crore. Item 5: Data Principal duties (s.15), up to Rs 10,000. Item 6: breach of a voluntary undertaking (s.32), up to the extent applicable to the original breach. Item 7: any other provision of the Act or Rules, up to Rs 50 crore. The Board imposes a penalty only after an inquiry, a finding that the breach is significant and a hearing.
The full table
| Sl. No. | Breach (as the Schedule words it) | Penalty | Read with |
|---|---|---|---|
| 1 | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8 | May extend to two hundred and fifty crore rupees | Section 8(5) |
| 2 | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8 | May extend to two hundred crore rupees | Section 8(6) |
| 3 | Breach in observance of additional obligations in relation to children under section 9 | May extend to two hundred crore rupees | Section 9 |
| 4 | Breach in observance of additional obligations of Significant Data Fiduciary under section 10 | May extend to one hundred and fifty crore rupees | Section 10 |
| 5 | Breach in observance of the duties under section 15 | May extend to ten thousand rupees | Section 15 |
| 6 | Breach of any term of voluntary undertaking accepted by the Board under section 32 | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted | Section 32 |
| 7 | Breach of any other provision of this Act or the rules made thereunder | May extend to fifty crore rupees | All other provisions |
How to read the Schedule
1. They are ceilings. Every fixed amount begins "may extend to". The Board sets the amount under section 33(2), weighing seven factors. See section 33.
2. Penalty is per breach item. The Schedule is organised by breach. The Act does not say whether one incident that breaches several provisions attracts several penalties, or whether they are added. Do not assume either way.
3. No item for imprisonment or compensation. The Act's penalties are monetary and go to the Consolidated Fund of India (section 34). The Schedule does not provide for compensation to a Data Principal.
4. Significant breach only. Section 33(1) requires the Board to determine on conclusion of an inquiry that the breach is significant, after hearing the person.
5. Who is liable. The Schedule speaks of "breach", and section 33(1) of "a person". Items name the Data Fiduciary (items 1 and 2), obligations in relation to children (item 3), the Significant Data Fiduciary (item 4) and the Data Principal (item 5). Item 7 is general.
Item-by-item notes
Item 1: security safeguards, up to Rs 250 crore
The highest ceiling. It attaches to the obligation in section 8(5) to protect personal data in the fiduciary's possession or control, including processing by a Data Processor on its behalf, by taking reasonable security safeguards to prevent a personal data breach. Note that section 17(1) keeps section 8(5) in force even where other obligations are exempt.
Item 2: breach notice, up to Rs 200 crore
It attaches to the duty in section 8(6) to give the Board and each affected Data Principal intimation of a personal data breach. Failing to notify is penalised separately from the breach itself. The form and manner of intimation are left to the Rules.
Item 3: children, up to Rs 200 crore
It covers "additional obligations in relation to children under section 9": verifiable parental consent, no detrimental processing, no tracking, behavioural monitoring or targeted advertising directed at children, subject to the exemptions in section 9(4) and (5). See section 9.
Item 4: Significant Data Fiduciary, up to Rs 150 crore
It attaches to the additional obligations in section 10, such as a Data Protection Officer, an independent data auditor and Data Protection Impact Assessment. See section 10.
Item 5: Data Principal duties, up to Rs 10,000
The only item with a rupee figure rather than crore, and the only one that falls on an individual in the ordinary case. See section 15.
Item 6: breach of undertaking
No fixed figure: the ceiling is whatever applied to the original alleged breach in the section 28 proceedings. An undertaking therefore does not lower the ceiling; it only changes the route.
Item 7: any other provision
The residual item, up to fifty crore rupees, covers consent, notice, the grounds for processing, the accuracy and erasure duties, grievance redressal and any provision of the Rules not covered by items 1 to 6. The Schedule has no separate item for sections 4 to 7, 8(1) to (4), 8(7) to (11), 11 to 14, 16 or 37(2); item 7 is the nearest head.
Changing the Schedule
Section 42 lets the Central Government amend the Schedule by notification, but not to more than twice the amount specified when the Act was originally enacted. The amendment takes effect from the notification. See sections 41 to 43.
What the penalties do not include
- No minimum penalty.
- No personal liability stated for directors or officers; the Schedule speaks of breach by "a person".
- No daily or continuing penalty.
- No statement on interest or recovery; see section 30 for execution of Tribunal orders.
Using the Schedule in practice
- Rank your risks. Safeguards, breach notice and children's data carry the highest ceilings; put controls there first.
- Build the mitigation file. Section 33(2)(e) looks at timely and effective mitigation.
- Avoid repeat breaches. Repetition is a listed factor.
- Know the routes out: voluntary undertaking (section 32), mediation (section 31), appeal within sixty days (section 29).
- Use the Act's words, not summaries, in board papers. Media reports often round or mix items.
Example
A company's database is breached because of weak access controls, and it does not tell the Board or users. Two items may be in play: item 1 for the safeguards and item 2 for the failure to notify. The Board decides, after an inquiry and hearing, whether each breach is significant and fixes amounts up to each ceiling using section 33(2). The Act does not say whether the two are added; read the Board's order and plan the appeal accordingly.
Need help assessing penalty exposure?
A clear view of which items apply to your operations helps you put controls and records where they count. Our legal dispute resolution team can help you review your exposure and prepare for an inquiry if one comes.
Key takeaways
- The Schedule has seven items; five have fixed ceilings, item 6 follows the original breach and item 7 is residual.
- Ceilings: Rs 250 crore, Rs 200 crore, Rs 200 crore, Rs 150 crore, Rs 10,000 and Rs 50 crore for items 1, 2, 3, 4, 5 and 7.
- Amounts are maximums; the Board applies section 33(2) factors.
- The Board must find the breach significant after an inquiry and hearing.
- Penalties go to the Consolidated Fund of India.
Read next
- Penalties under the DPDP Act
- Section 33 of the DPDP Act, 2023: monetary penalty and factors
- Sections 41, 42 and 43: laying of rules, Schedule amendment and removal of difficulties
- Section 8 of the DPDP Act, 2023: reasonable security safeguards
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.