The ₹250 Crore DPDP Penalty: What It Means for IT Teams Retiring Devices
The penalty schedule
The Schedule to the DPDP Act, 2023 sets maximum penalties by type of failure. These are ceilings, not fixed fines.
| Failure | Maximum penalty |
|---|---|
| Reasonable security safeguards to prevent a personal data breach (section 8(5)) | ₹250 crore |
| Notifying the Board and affected people of a breach (section 8(6)) | ₹200 crore |
| Additional obligations for children’s data (section 9) | ₹200 crore |
| Obligations of Significant Data Fiduciaries (section 10) | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
| Duties of a Data Principal (section 15) | ₹10,000 |
Which penalty a disposal failure attracts
A laptop sold with its drive intact, or a server left in a scrap yard, is a failure of security safeguards under section 8(5). That is the ₹250 crore line. If the exposure then becomes a breach and you do not report it properly, the ₹200 crore line under section 8(6) can apply as well.
If the device belonged to a school or held children’s data, the children’s obligations are also in play.
The breach clock
Rule 7 of the DPDP Rules requires you to inform affected individuals without delay, and to inform the Data Protection Board without delay and then, within 72 hours of becoming aware, with the details, the likely impact and what you have done about it. A missing laptop or an unwiped drive found on resale starts that clock.
How the Board decides
The Act asks the Board to weigh factors such as the nature, gravity and duration of the breach, the type of personal data involved, whether it was repeated, and what the organisation did to mitigate it. Documented, certified disposal is the kind of evidence that shows you took reasonable safeguards in the first place.
How IT teams reduce the exposure
- Treat every retired device as holding personal data until it is proven otherwise.
- Encrypt laptops in service, so a lost device is a smaller problem.
- Use certified erasure or destruction, with a report per drive.
- Put security terms in your disposal vendor contract.
- Keep an incident plan that covers a missing or unwiped retired device.
Most of these duties apply from 13 May 2027. The devices you retire before then are part of the record you will be judged on.
Related reading
