What penalties can be imposed?

The Schedule to the Act sets graded penalties, with a ceiling of ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach. Failure to notify a breach to the Board or affected individuals attracts up to ₹200 crore, as does breach of obligations relating to children's data. Failure of a Significant Data Fiduciary to meet its additional obligations attracts up to ₹150 crore. Breach of a Data Principal's own duties attracts up to ₹10,000. The Board considers factors including the nature, gravity and duration of the breach when determining the amount.