DPDP Act Penalties: What Small Firms Actually Risk
Penalty figures under the DPDP Act get quoted without context, which makes them frightening and not very useful. This article sets out the maximum amounts, explains when most duties begin, and points to the failures that a small office is most likely to commit.
The maximum penalties
The Act sets maximum penalties for each type of breach. The figures below are the maximums for each contravention.
| Contravention | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards | ₹250 crore |
| Failure to give notice of a personal data breach | ₹200 crore |
| Breach of obligations relating to children's data | ₹200 crore |
| Breach of Significant Data Fiduciary obligations | ₹150 crore |
| Breach of consent obligations | ₹50 crore |
| Breach of any other provision | ₹50 crore |
These are ceilings, not automatic fines. The Data Protection Board decides what applies in each case.
When the duties start
The Data Protection Board provisions took effect when the Rules were notified on 13 November 2025. Consent manager provisions follow from 13 November 2026. Most other duties, including consent and notice, security safeguards, breach notification and erasure rights, start on 13 May 2027.
That means most of these penalties attach to duties that are not yet in force. The window until May 2027 is the time to prepare, not the time to wait.
The three failures most likely in a small office
The first is weak access. Too many people can open client files, and nobody reviews who still has access after a team change.
The second is unsafe sharing. Client identity documents travel through group chats, personal phones and public links. Each route is a potential breach, and the firm often cannot show what happened.
The third is no response plan. When a file goes to the wrong person, the team does not know who should act, whom to inform or what to record.
Each of these has a simple control. Limit access by client, use a secure link for documents, and write a one-page breach plan. Those three steps address most of the realistic risk.
Why the numbers are not the whole story
A penalty is one cost. Losing a client's trust is often worse, and a client who learns their Aadhaar was shared in a group chat rarely stays quiet. Good habits protect the relationship as well as the balance sheet.
What a reasonable safeguard looks like
The Act does not list every control a firm must have. For a small firm, a reasonable safeguard usually means four things. Client files sit in restricted folders. Access follows the assigned team. Each file has a record of who opened it. Old files are removed on a schedule. Each of these can be shown to a regulator in minutes, which counts for more than a long policy that nobody follows.
Questions people ask
Do the penalties apply now?
Most duties start on 13 May 2027. Prepare now, so your firm is in order when they begin.
Do small firms get fined for small mistakes?
The Act sets maximums, and the Board decides outcomes. Ask your lawyer how the Board would treat your firm's specific exposure.
Where should we start?
Start with access and sharing. Limit each client's folder to the people who work on that client, and stop using personal phones for client files. Then write the response plan. The DPDP checklist covers the steps in order.
