DPDP Compliance, handled end to end
Fines up to ₹250 crore. Fixed before 13 May 2027.
Max per instance. Board decides, s.33(2).
Why DPDP compliance is urgent now
The Data Protection Board is live.
The clock is already running.
Full obligations apply 13 May 2027.
189Days
00Hours
00Minutes
00Seconds
- ₹22CrAverage breach cost
- 263DaysIdentify and contain
- 72HrsTo tell the Board
- 6HrsTo tell CERT-In
IBM Cost of a Data Breach Report 2025, India. DPDP Rules 2025. CERT-In Directions 2022.
Schedule, DPDP Act 2023
What non compliance costs
-
₹250Cr
s.8(5)Security safeguards
No encryption, access control, logs or backups to stop a breach. -
₹200Cr
s.8(6)Breach not reported
The Board and affected people were not told. Detailed report due in 72 hours. -
₹200Cr
s.9Children's data
No parental consent, or tracking and ads aimed at under 18s. -
₹150Cr
s.10Significant Data Fiduciary
No India based DPO, independent auditor or annual DPIA. -
₹50Cr
ResidualAny other breach
Notice, consent, retention, erasure and every other duty. -
≤ CAP
s.32Broken undertaking
A fix promised to the Board, not delivered. Capped at the underlying breach. -
₹10,000
s.15Individual's duties
Falls on individuals, for example a frivolous complaint.
Statutory maximum per instance. The Board sets the actual amount under s.33(2).
How the Board decides
- Nature, gravity and duration
- Type of personal data
- Repetitive nature
- Gain made or loss avoided
- Mitigation and its timeliness
- Proportionality
- Likely impact of the penalty
Exposure estimator
What is your exposure?
Exposure ceiling
500 crore rupees
- s.8(5) 250
- s.8(6) 200
- s.9 200
- s.10 150
- Residual 50
Why these heads
- Counted for everyone. Any Data Fiduciary holding personal data owes reasonable security safeguards.
- Counted: with no breach response plan, notifying the Board and each affected person in time is the likeliest failure.
- Not counted: you said you do not process children's data.
- Not counted: SDF duties apply only once the government notifies you as one.
- Counted once: missing consent records or vendor contracts breach other provisions of the Act and Rules.
- Left out: s.32 applies only to a broken undertaking. s.15 falls on individuals.
Avg breach, India
₹22Cr
IBM Cost of a Data Breach Report 2025, India
Readiness
57/ 100
Fix first
- 01Write the breach playbooks.8(6)
- 02Sign vendor DPAss.8(2)
- 03Lock down security safeguardss.8(5)
Estimate, not legal advice. Statutory maximums per instance.
Get your written gap report in 48 hours- Phone
- Aadhaar
- PAN
- Salary
- Location
- Health
- CCTV
- Chat
- Child account
- Bank
- IP address
- Resume
- Voice
Every record you hold
Mapped. Minimised. Consented.
1,24,00,000
Records / illustrative
Your data, sealed.
Gap report in 48 hours. Fixed in 4 to 6 weeks.
Book a gap auditThe Sigillo method
Gap report in 48 hours. Every fix in 4 to 6 weeks.
Every system, vendor and data flow, mapped.
Notices, consent, retention and safeguards, fixed in product.
Policies, DPO, grievance desk and consent ledger, running.
A 72 hour breach playbook, drilled monthly.
What you hold at the end.
-
01s.8(1) -
02s.8(1) Processing record
-
03s.5 Notice, 22 languages
-
04s.6 Consent flows
-
05s.8(7) Erasure schedule
-
06s.8(5) Safeguards register
-
07s.8(6) 72 hr playbook
-
08s.8(2) Vendor DPAs
-
09s.9 Children's controls
-
10s.10 DPIA file
-
11s.8(10) Grievance SOP
-
12s.8(5) Training records
01Does the DPDP Act apply to my company?
The DPDP Act 2023 applies to any company processing digital personal data in India, and to processing outside India that offers goods or services to people in India. Collecting customer or employee names, phone numbers or emails digitally is enough.
02When does the DPDP Act apply?
The Act received assent on 11 August 2023. The DPDP Rules 2025 were notified on 13 November 2025, with the Data Protection Board in force immediately. Consent Manager rules apply from 13 November 2026 and the core obligations from 13 May 2027.
03What are the penalties under the DPDP Act?
The Schedule sets maximums per instance: ₹250 crore for weak security safeguards, ₹200 crore each for unreported breaches and children's data failures, ₹150 crore for Significant Data Fiduciary failures, ₹50 crore otherwise. The Board decides the actual amount under section 33(2).
04Do B2B companies need to comply with the DPDP Act?
Yes. B2B companies hold employee records, the names, emails and phone numbers of client contacts, vendor KYC and logs with IP addresses. All of it is personal data, and clients will expect contractual safeguards from you.
05What is a Significant Data Fiduciary?
A Significant Data Fiduciary is a Data Fiduciary the Central Government notifies under section 10, based on factors such as data volume and sensitivity. It must appoint an India based DPO and an independent data auditor, and run an annual DPIA and audit.
06Do we need a Data Protection Officer under the DPDP Act?
Only a Significant Data Fiduciary must appoint a Data Protection Officer, based in India. Every other Data Fiduciary must publish a contact who can answer questions about its processing, and run grievance redressal.
07What do we have to do after a personal data breach?
Inform each affected Data Principal and the Board without delay, then send the Board a detailed report within 72 hours. The CERT-In Directions 2022 also require cyber incidents reported to CERT-In within 6 hours. Failure to notify: up to ₹200 crore.
08Does the DPDP Act apply to employee data?
Yes. Payroll, bank details, attendance and HR records are digital personal data. Employment is a legitimate use that may not need fresh consent, but security safeguards, breach intimation and retention duties still apply.
09How long does DPDP compliance take with Sigillo by Athreix?
Sigillo by Athreix delivers a written gap report in 48 hours. All fixes are completed in 4 to 6 weeks in total.
10What does Sigillo by Athreix actually do?
Sigillo by Athreix runs DPDP compliance end to end: data mapping, notices and consent flows, security safeguards, retention, vendor contracts, DPO support and a 72 hour breach playbook. Legal and engineering work together, changing your actual product, not only policies.