DPDP Penalty Calculator
Enter a website and get an indicative penalty exposure under the DPDP Act, 2023 in crore rupees, broken down by obligation against the caps in the Schedule to the Act.
Enter your work email to use this tool
Get an indicative DPDP Act penalty exposure for any organization from its public website. Enter your work email to get started.
How DPDP Penalties Work
The Data Protection Board can impose a penalty only when an inquiry finds a breach significant and the organization has been heard, within the cap the Schedule to the Act sets for that breach. In setting the amount it weighs factors such as the gravity of the breach, the data affected and the mitigation taken (section 33).
Every cap and every factor is in the DPDP Act penalties table. Worked examples of one incident engaging several heads are in DPDP penalties explained.
Penalty Caps Used by This Calculator
| Obligation | Provision | Maximum penalty |
|---|---|---|
| Reasonable security safeguards to prevent a personal data breach | Section 8(5) | INR 250 crore |
| Notice of a personal data breach to the Board and to affected Data Principals | Section 8(6) | INR 200 crore |
| Verifiable parental consent and the limits on tracking and targeting children | Section 9 | INR 200 crore |
| Data Protection Officer in India, independent audits and periodic impact assessments | Section 10 | INR 150 crore |
| Notice, consent, purpose limitation, retention, Data Principal rights and grievance redressal | Any other provision of the Act or the Rules | INR 50 crore |
These five caps are the obligations this estimator prices. Together they come to INR 850 crore. The Act caps each breach separately and does not say how penalties for several breaches combine, so that total is the estimator's ceiling, not a statutory maximum.
What This Estimator Checks
Only public information about the organization, read from its website and public records:
- The privacy notice: whether it names the DPDP Act, a grievance officer, a Data Protection Officer and a way to exercise rights, and when it was last updated
- Trackers and cookies set before any consent choice, and whether a consent banner appears
- Security headers and a security.txt file
- Email authentication: DMARC and SPF
- Public breach records for the domain
- A Google Play listing linked from the site, and its install count
- The sector, the people served and the sensitivity of the data, as the site describes them
How to Read the Result
The result is an indicative figure. Within each cap, the estimator places the organization on a band from nil to the cap, using a house scale: the Schedule sets the caps, and the bands inside them are ours. The largest obligation in the breakdown is usually the place to start.
The Board decides an actual penalty on an inquiry, with the organization heard. Because the estimate sees only what is public, a gap assessment of your own processing, the first step of the DPDP implementation roadmap, places you more precisely.
Common DPDP Penalty Triggers
- A breach after weak safeguards: no encryption, broad access, no logs
- A breach the Board or the people affected hear about late, or not at all
- Tracking or behavioral monitoring of children, targeted advertising directed at them, or no verifiable parental consent step
- A notified Significant Data Fiduciary with no Data Protection Officer, independent auditor or annual DPIA
- Notices that miss Rule 3, consent without a real choice, unanswered rights requests, or data kept after its purpose ends
How to Reduce DPDP Penalty Exposure
One action for each line of the breakdown:
- Security safeguards: put the Rule 6 minimum in place, from encryption and access control to monitoring, backups and a year of logs
- Breach notification: rehearse the Rule 7 notices, so affected people and the Board hear without delay and the Board gets its report within 72 hours
- Children's data: add a parental consent step to every flow a child can reach, and turn off tracking and targeted advertising there
- Significant Data Fiduciary: if your volume and sensitivity could draw a notification, name a Data Protection Officer and plan the independent audit and annual DPIA
- Other obligations: bring notices up to Rule 3 and consent up to section 6, and answer rights requests and grievances within your published period
Whatever the line, record what you did after an incident and when, because the Board weighs the mitigation taken and how timely it was. The DPDP compliance guide sets out the full checklist and the roadmap to 13 May 2027.
DPDP Penalty FAQ
How is a DPDP penalty calculated?
The Data Protection Board sets each penalty after an inquiry, within the cap the Schedule to the Act gives that breach, weighing the factors in section 33(2). This estimator mirrors that: it reads public signals about an organization, places it on a band within each cap, and shows the total with the breakdown by obligation.
Are DPDP penalties based on turnover?
No. The DPDP Act caps each penalty at a fixed amount per breach, set out in its Schedule, whatever the organization's turnover.
Is the estimate a legal assessment?
No. It is an indicative figure built from public information, such as the privacy notice, cookies, security headers and public breach records. The Board decides an actual penalty on an inquiry with the organization heard, and a gap assessment of the organization's own processing places it more precisely.