Schedule (Penalty Schedule)
The table at the end of the Act that lists the maximum penalty for each type of breach.
The Schedule is the table at the end of the DPDP Act that sets the highest penalty the Board can impose for each kind of breach.
Meaning of Schedule (Penalty Schedule)
The maximum amounts are Rs 250 crore for failing to take reasonable security safeguards, Rs 200 crore for failing to notify a breach, Rs 200 crore for breaching children's obligations, Rs 150 crore for breaching Significant Data Fiduciary obligations, Rs 50 crore for breaching a voluntary undertaking or any other provision, and Rs 10,000 for breaching the Data Principal's duties.
A Schedule is a part of an Act placed after the sections, usually to hold lists or tables that would clutter the main text. The Schedule to the DPDP Act is a table with two columns: the breach of the Act or Rules, and the maximum monetary penalty. Section 33(1) is the link: when the Board finds a significant breach after an inquiry and a hearing, it may impose a penalty "as specified in the Schedule". The Schedule therefore sets ceilings, not fixed fines.
The ceilings are these. Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)): up to ₹250 crore. Failure to give the Board or affected Data Principals notice of a breach (Section 8(6)): up to ₹200 crore. Breach of the additional obligations relating to children (Section 9): up to ₹200 crore. Breach of the additional obligations of a Significant Data Fiduciary (Section 10): up to ₹150 crore. Breach of a Data Principal's duties (Section 15): up to ₹10,000. Breach of a voluntary undertaking accepted by the Board: up to the amount applicable to the breach to which the undertaking relates. Any other breach of the Act or Rules: up to ₹50 crore.
Within each ceiling the Board has discretion. Section 33(2) directs it to weigh the nature, gravity and duration of the breach, the type and nature of the personal data, whether the breach was repeated, any gain made or loss avoided, mitigation steps taken and how effective they were, whether the penalty is proportionate and effective as a deterrent, and the likely impact of the penalty on the person. A first-time lapse that was quickly fixed will not normally be treated like a repeated failure to protect millions of records.
Section 42 allows the Central Government to amend the Schedule by notification, but not to raise any penalty above twice the amount in the original Act. Beyond that cap, Parliament must amend the Act. Amounts collected go to the Consolidated Fund of India under Section 34; they are not paid to affected individuals. Also, the Schedule covers penalties only, and the Board's other tools, such as directions and blocking references to the Central Government, sit elsewhere in the Act.
Examples of Schedule (Penalty Schedule)
A fiduciary that fails to report a breach faces a ceiling of Rs 200 crore, and the Board decides the actual amount.
A payments company models its risk using the Schedule. It sees that a security failure and a failure to report could each attract a very large maximum, so it moves budget towards logging, [access control](term/access-control) and a rehearsed incident process before spending on new marketing consent tools.
A learning app for children notes that the Schedule gives children's obligations a ceiling of ₹200 crore. It prioritises [verifiable parental consent](term/verifiable-parental-consent) and switches off behavioural tracking and [targeted advertising](term/targeted-advertising) on child accounts.
A manufacturer with only employee and dealer data finds that its main exposure falls in the general ₹50 crore category and in security safeguards. It focuses on access control for HR systems and a short breach-response checklist.
Why Schedule (Penalty Schedule) matters
The Schedule is the number that boards and CFOs look at first, and it works as a risk register for the Act. The two highest ceilings sit on security and breach notification, which tells an organisation where to place its budget: reasonable safeguards and a tested incident process. A fiduciary that spends heavily on consent banners but under-invests in security controls and breach readiness has misread the Schedule.
The ceilings apply per breach category and can stack when separate breaches are found in the same incident. For example, a data breach caused by weak safeguards that the company then failed to report would involve both the ₹250 crore and the ₹200 crore categories. Having an accepted voluntary undertaking, prompt reporting and clear mitigation records are the practical ways to bring the final amount down.
How it works in practice
- 1Map each Schedule category to the control that prevents it: security safeguards to your Rule 6 programme, breach notification to the Rule 7 playbook, children's obligations to age and parental consent flows, and Significant Data Fiduciary duties to the annual audit.
- 2Use the ceilings in your risk register as exposure figures, but state them as maximums. Management should know they are caps decided by the Board after an inquiry, not predictions.
- 3Record the Section 33(2) factors in your own incident reports. A written note on how quickly you detected the breach, what you fixed and how you informed people supports a lower penalty.
- 4Brief the board and senior management at least once a year on the Schedule, using your own sector's incident examples, and record that the briefing took place.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Reading the ceilings as automatic fines. The Board must first conduct an inquiry and give a hearing, and then fix an amount within the ceiling using the Section 33(2) factors.
Believing only large companies face the larger amounts. The ceilings apply to any fiduciary, though the likely impact on the person is one of the Board's factors.
Forgetting the ₹10,000 ceiling. It is for Data Principals who breach their own duties, such as filing a false complaint.
Assuming the Schedule is fixed for ever. Section 42 allows notified amendment, within a cap of twice the original amounts.
Compliance tips
Use the Schedule as a checklist when you review controls; every row should have a named owner.
Insure with care. Cyber insurance may not cover regulatory penalties, so ask your insurer what is and is not covered.
Report breaches on time even when you are unsure about severity, since failure to notify has its own ceiling.
Keep evidence of mitigation steps, as the Board is directed to consider them.
Common questions about Schedule (Penalty Schedule)
What is the maximum penalty under the DPDP Act?
The highest ceiling in the Schedule is ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach. Other ceilings include ₹200 crore for failing to notify a breach or breaching children's obligations, and ₹150 crore for Significant Data Fiduciary duties.
Are the Schedule amounts fixed fines?
No. They are upper limits. The Board decides the amount after an inquiry and hearing, weighing factors such as gravity, duration, repetition, mitigation and the likely impact on the person.
Can the Government change the Schedule?
Yes, by notification under Section 42, but it cannot raise any penalty to more than twice the amount in the Act as originally enacted. Anything larger would need an amendment passed by Parliament.
Do penalties go to the people affected by a breach?
No. Section 34 credits penalties to the Consolidated Fund of India. The penalty is a regulatory sanction rather than compensation for affected individuals.