DPDP Fine Calculator — free penalty exposure estimator

Pick your breach scenario, answer half a dozen questions about volume, sensitivity and how you responded, and the calculator returns an estimated fine range. The maths follows Section 33(2)'s six weighing factors as best as we can guess before the Data Protection Board has issued any actual orders. Runs entirely in your browser, nothing hits our server. Save the result as a PDF if you need to walk your board through the exposure.

Client-side compute Section 33 + Schedule 2 min to complete Not legal advice

Step 01

Which breach scenario are you modelling?

Pick the single scenario that best describes the incident. If more than one applies, run the calculator once per scenario.

Security safeguard failure Personal data breach because reasonable safeguards were not in place. Sec. 8(5). Breach notification failure You had a breach and did not notify the Board or Data Principals. Sec. 8(6). Children's data obligation breach Failure of Sec. 9 obligations: VPC, behavioural tracking ban, or targeted ads to children. Significant Data Fiduciary obligation breach Sec. 10 additional obligations, Rule 12 or 13 failure. Applies only if you are a designated SDF. Other DPDP violation Consent hygiene, DSR handling, retention, DPO publication, grievance mechanism.

Step 02

What sensitivity is the affected personal data?

Higher sensitivity moves the Board toward the top of the applicable cap.

High Financial, health, biometric, government IDs, children's data. Medium Contact details linked to purchase history, location, employment. Low Standalone email, name, or publicly available information.

Step 03

How many Data Principals were affected?

Order of magnitude is enough. The Board weighs scale under Sec. 33(2).

Under 10,000 Small incident scope. 10,000 to 1 million Mid-scale incident. 1 million to 10 million Large-scale incident. Over 10 million National-scale incident.

Step 04

Is this a repeat pattern?

Section 33(2)(c) weighs the repetitive nature. First-time honest failures attract lower penalties.

First incident No prior Board orders or findings against you. Second incident One prior Board order or a similar earlier failure. Repeat pattern Multiple prior Board orders or findings.

Step 05

How did you respond?

Section 33(2)(e) reduces the number for prompt mitigation and cooperation. Section 33(2)(d) increases it if you gained financially or avoided compliance cost.

Proactive and cooperative Rapid notification, full remediation, transparency with the Board and affected Data Principals. Reactive but honest Delayed but complete response, cooperation once discovered. Poor or evasive Concealment, obstruction, or evidence of financial gain from the failure.

Step 06

What is your organisation's scale?

The Board weighs proportionality under Sec. 33(2)(f). A small organisation with limited turnover typically faces smaller absolute numbers, but the same cap applies.

MSME or startup Revenue under Rs. 100 crore per annum. Mid-market Revenue Rs. 100 crore to Rs. 5,000 crore. Large enterprise Revenue over Rs. 5,000 crore, or a designated SDF.

Statutory ceiling per breach: . Estimate is within this ceiling based on Section 33(2) factors.

Which cap applies

How the estimate was reached

Primary sources

DPDP Act 2023, Section 33 read with the Schedule to the Act.
DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025) where operational rules referenced.

Not legal advice. Estimate for board-level scenario planning only. Actual Board orders will depend on the full evidentiary record and reasoned application of Section 33(2). Sec. 33(3) mandates the Board to provide reasons in every order.

Turn the estimate into a plan. dcomply's Gap Assessment module runs the same weighting across every DPDP obligation you have and generates a prioritised remediation roadmap.