The 250 crore rupee number gets quoted in every DPDP presentation in India. It is also the least useful thing to know, because it is a ceiling for one specific failure rather than a standard fine.
The penalty structure
The Act sets different maximums for different failures. The highest, up to 250 crore, attaches to failing to take reasonable security safeguards against a data breach. Failing to notify the Board and affected individuals carries up to 200 crore. Obligations around children data carry up to 200 crore. The extra obligations on Significant Data Fiduciaries carry up to 150 crore. A residual category sits lower.
Two things follow. Security failures and breach non-reporting are the expensive ones, and the Board sets the actual amount based on the nature, gravity and duration of the breach, the type of data involved, whether it was repetitive, and what you did to mitigate.
How enforcement will start
The Board acts on complaints and breach reports. It is not going to audit every company in India from a standing start. Your realistic risk in year one is one of two paths: someone complains that you kept marketing to them after they withdrew consent, or you have a breach and the reporting clock starts.
Both reward the same preparation, which is producing records fast. An organisation that answers a complaint with a complete consent history, a withdrawal timestamp and evidence of when suppression propagated is in a very different position from one that answers with an explanation.
The marketing-specific exposures
Contacting someone after withdrawal is the most likely complaint and the easiest to prove against you, because the complainant is holding the message.
Sharing data with partners the person never agreed to is next. Co-marketing lead swaps and joint webinars are the usual source and are almost never covered by the original consent.
Retaining data with no defined purpose is third. The habit of keeping every lead forever now has a price attached.
The cheapest useful preparation
Write down today how you would answer a Board query about one individual. Which systems would you query, who runs it, how long does it take, what could you not produce? That document is worth more than another summary of the penalty schedule, because it names the gap to close first.
General information, not legal advice. Rules current as of July 2026.