DPDP Act Penalties: How the Board Will Set Fines, and What Europe's New Fining Guidelines Reveal

Most conversations about DPDP Act penalties start and end with one number: ₹250 crore. It makes a scary slide but tells a founder very little. The more useful question is how the Data Protection Board of India will decide what a specific breach is worth, and whether anything you do today can bring that figure down.

Europe has just given us a preview. On 17 September 2026, the European Data Protection Board (EDPB) adopted Guidelines 04/2026, a five-step method regulators should follow before deciding whether to fine a company at all. The draft is open for public comment until 13 November 2026. India's law is different, but the logic overlaps with Section 33 of the DPDP Act far more than most people expect. Read together, they show Indian SMEs what will help in front of a regulator.

What the EDPB's new fining guidelines say

The guidelines replace older Article 29 Working Party guidance and sit alongside the EDPB's 2022 rules on calculating fine amounts. The new step comes first: deciding whether a fine is warranted at all. Authorities are asked five questions in order:

1. Can this infringement lead to a fine under the GDPR or national law?
2. Is the organisation under investigation actually liable?
3. Was the infringement intentional or negligent?
4. Taking the aggravating and mitigating factors together, is it minor?
5. Would a fine be effective, proportionate and dissuasive?

A minor infringement will usually end in a reprimand. Anything more serious carries what the EDPB calls a "strong presumption" that a fine follows.

Three details matter for business owners. First, ordinary cooperation with the regulator earns you nothing, because cooperation is already required. Only cooperation that "goes beyond that obligation and materially limits harm" counts in your favour. Second, a clean record and routine compliance work are treated as baseline expectations, not credit. Third, fixes made spontaneously, before you know an investigation exists, carry far more weight than fixes made after the notice arrives. Self-reporting on your own initiative can also count.

How DPDP Act penalties are actually decided

India's framework already has its own version of this thinking. The Schedule to the DPDP Act sets maximums by type of failure: up to ₹250 crore for not maintaining reasonable security safeguards, up to ₹200 crore each for failing to notify a personal data breach or breaching children's data obligations, up to ₹150 crore for Significant Data Fiduciary failures, and up to ₹50 crore for other breaches of the Act or Rules.

Those are ceilings. Section 33(2) tells the Board how to arrive at an actual figure. It must consider:

• the nature, gravity and duration of the breach
• the type and nature of the personal data affected
• whether the breach is repetitive
• whether the company made a gain or avoided a loss because of it
• whether it took action to mitigate the effects, and how timely and effective that action was
• whether the penalty is proportionate and effective in securing compliance and deterring breaches
• the likely impact of the penalty on the person

Put this next to the EDPB list and the overlap is plain. Duration, data sensitivity, repetition and timely mitigation drive the outcome in both systems. Proportionality and the impact of the fine on the business are explicit factors in both. For a 40-person company, that last point matters. The Board is required to weigh what a penalty would do to you, which is why the ₹250 crore headline is rarely the relevant number for an SME.

Section 32: the voluntary undertaking

The DPDP Act also has a tool GDPR lacks in this form. Under Section 32, the Board may accept a voluntary undertaking from any person "at any stage of a proceeding under section 28." The undertaking can commit you to take specific action within a time the Board sets, to stop doing something, or to publicise the undertaking.

Once accepted, it operates as a bar on further proceedings about the matters it covers. Break it, though, and Section 32(5) treats that as a breach of the Act itself, which sends you straight back to Section 33 penalties after a hearing.

An undertaking is only credible if you can show you understand the problem and can fix it. A company with a data map, a named privacy owner and a remediation plan can offer one. A company starting from zero cannot.

Five things Indian SMEs can do now to lower penalty exposure

The core obligations under the DPDP Rules, 2025 take full effect around 13 May 2027. Here is what both regimes suggest will count when a regulator looks at you.

1. Shorten the duration of any breach. Duration appears in both lists for a reason. Set up monitoring that would catch an exposed database or a misconfigured storage bucket in days rather than months. Our breach notification playbook covers the 72-hour reporting clock.

2. Fix things before anyone asks. The EDPB is explicit that spontaneous remediation counts more than reactive fixes, and Section 33(2)(e) asks how timely your mitigation was. Keep dated records of every fix: a ticket, a commit, an email to the vendor. "We fixed it in March" is weak. A screenshot of the closed ticket dated 4 March is evidence.

3. Know which data is sensitive. The type of personal data affected is a penalty factor. Health records, financial details and children's data will be treated more seriously than a newsletter list. A privacy impact assessment tells you where your high-risk data sits.

4. Audit your processors. If your payroll provider, CRM or cloud host leaks data, you are the Data Fiduciary and the Board will look at you first. Put DPDP-ready clauses into vendor contracts and keep evidence that you checked.

5. Avoid being a repeat case. Repetition is an aggravating factor in both systems. If you have already had one incident, a written root-cause review and the change it led to are your best defence against the next one being treated harshly.

The real takeaway

Neither system is likely to hit a small company with the maximum for an honest mistake it caught quickly, fixed and documented. Both will come down hard on a company that let a problem run for months and only paid attention once a regulator called. If a penalty does land, Section 29 allows an appeal to TDSAT within 60 days, but the record you build beforehand decides how strong that appeal is. Most of that record can be built in the next six months. If you want a structured starting point, our DPDP Act compliance service maps these factors to your actual systems.

This article is general guidance and not legal advice. For decisions about your specific situation, please consult a qualified professional.

Not sure where your penalty exposure sits? Work through our free DPDP compliance checklist, or talk to us about a quick gap review.