When do the DPDPA obligations commence?

DPDPA section 1(2) provides that different provisions come into force on the dates the Central Government appoints by notification. Check the commencement notifications and the DPDP Rules for the dates that apply to you.

Has the Data Protection Board taken enforcement action?

Section 18 of the Act provides for the establishment of the Data Protection Board of India. Check the Board's current published material for enforcement updates; this article does not assert a case history.

What extra duties do Significant Data Fiduciaries have?

Under DPDPA section 10, a designated Significant Data Fiduciary must appoint a Data Protection Officer based in India, conduct periodic Data Protection Impact Assessments and undergo independent audits.

Does notifying CERT-In about a breach satisfy DPDPA notification?

No. Direction (ii) of the CERT-In Directions dated 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, requires the covered entities to report the listed cyber incidents to CERT-In within six hours of noticing them; a personal-data breach can also trigger a separate DPDPA notification to the Data Protection Board and affected Data Principals under DPDPA section 8(6). Treat them as different recipients with different content requirements.

DPDPA Penalties: What the Act Sets and How to Prepare

Q: What is the maximum penalty under the DPDPA?

The DPDPA Schedule sets the monetary penalties by category. It provides a penalty of up to ₹250 crore for failure to take reasonable security safeguards. Confirm the current Schedule text for the full list of categories and amounts.

The Digital Personal Data Protection Act, 2023 sets obligations for Data Fiduciaries (DPDPA sections 5–10) and a schedule of monetary penalties. This article explains what the Act and its Schedule say, with citations. It does not assert an enforcement history; check the Data Protection Board's published material for that.

The penalty structure

The DPDPA Schedule sets monetary penalties by category. The Schedule provides a penalty of up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach. Confirm the current Schedule text for the full list of categories and amounts.

Two points follow from the Act's text:

The security category is explicit. DPDPA section 8(5) requires reasonable security safeguards, and the Schedule attaches a penalty category to failure of that obligation.
Read the Schedule itself. Do not rely on a summary of the categories or amounts; the Schedule is the authority.

For the platform's DPDPA programme overview, see the DPDPA framework guide.

What the Act requires

Consent and notice — consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (DPDPA section 6(1)); a notice must be given with or before the request for consent (DPDPA section 5(1)) and must be available in English or any language specified in the Eighth Schedule (section 5(3)).
Security safeguards — reasonable security safeguards for personal data (DPDPA section 8(5)).
Breach notification — personal data breaches must be notified to the Data Protection Board and affected Data Principals in the prescribed manner (DPDPA section 8(6)).
Data Principal rights — access, correction, completion, updating, erasure and grievance redressal (DPDPA sections 11–14).
Significant Data Fiduciary duties — where designated: an India-based Data Protection Officer, periodic Data Protection Impact Assessments and independent audits (DPDPA section 10).

The two-notification problem: DPDPA and CERT-In

One personal-data breach can trigger two separate notification obligations to two separate recipients — direction (ii) of the CERT-In Directions dated 28 April 2022 and DPDPA section 8(6):

CERT-In — direction (ii) of the CERT-In Directions dated 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, requires the covered entities to report the listed cyber incidents to CERT-In within six hours of noticing them.
DPDPA — notify the Data Protection Board and affected Data Principals of the personal data breach under DPDPA section 8(6).

Treat them as different recipients with different content requirements, and run them as parallel workstreams from a single incident record, each with a named owner. The CERT-In guide gives the platform's CERT-In programme overview.

If you are a Significant Data Fiduciary (or might be)

Significant Data Fiduciary designation brings a heavier duty set under DPDPA section 10:

An India-based Data Protection Officer — a named, accountable individual in India.
Data Protection Impact Assessments — periodic DPIAs, documented and reviewable.
Independent audits — periodic external scrutiny of the data protection programme.

If there is a plausible case that your organisation is designated, build to that level now.

Preparing, without relying on an assumed date

A sensible sequence:

Close the consent gap. Review every consent touchpoint against DPDPA sections 5 and 6: granularity, clarity, withdrawal and records.
Make the security programme demonstrable. Complete the risk assessment, implement safeguards, test the breach response against both notification tracks and organise the evidence, so each control can be demonstrated to a regulator.
Bring the full obligation set to production quality. Data Principal rights handling, retention and erasure, processor contracts and SDF duties where applicable.
Put the programme on an internal audit cycle so it stays true after the launch push.

Records to keep before an incident

Consent records — per Data Principal: what was consented to, when, against which notice, and whether it was withdrawn.
A data inventory — what personal data you hold, where it lives, why you process it and who it is shared with.
A security safeguards map — each safeguard linked to the risk it addresses, with implementation evidence.
Breach response records — the playbook, drill reports and, for a real incident, the timeline showing when it was noticed and when each notification went out.
Training records — evidence that the people who handle personal data were trained.

Where Compliance Enablers fits

DPDPA is one of the 30 standards Compliance Enablers runs as a guided programme, and the DPDPA framework record page on the new pattern is rolling out this month. The privacy, incident, document, training and audit modules are included in every plan. The obligations and penalties above are set by the Act, not the platform.

This is general information, not legal advice. Penalty exposure and obligations depend on your specific facts — consult counsel.