DPDP Penalty Exposure Calculator

Failure to encrypt personal data at rest or in transit

No AES-256 at rest or TLS 1.2+ in transit, or weak/expired keys.

Section 8(5) · Rule 6(a) · Example: S3 bucket holding lab reports left unencrypted; database backups in plaintext.

Inadequate access controls (no RBAC / MFA)

Excessive standing access, shared admin accounts, no MFA for privileged users.

Section 8(5) · Rule 6(b) · Example: Lab technicians with full database admin rights; no MFA on cloud console.

No monitoring / breach detection capability

No SIEM, no anomaly alerts, no 24/7 detection — breach goes undetected for weeks.

Section 8(5) · Rule 6(c) · Example: Exfiltration of 5 lakh patient records discovered only when posted on the dark web.

No organisational policies or training programme

Staff handling personal data never trained on consent, breach or rights obligations.

Section 8(5) · Rule 6(g) · Example: No documented data protection policy; no DPDP training records on file.

DPA lacks Rule 6 security mandate for processor

Processors not contractually required to meet equivalent Section 8 safeguards.

Section 8(5) · Rule 6(f) · Example: Cloud / KYC processor breach — your DPA had no audit-right clause.

Processing minor data without verifiable parental consent

Self-attested age, checkbox consent or no verification at all.

Section 9 · Rule 10 · Example: Edtech account opened by a 14-year-old with no parental verification.

Behavioural tracking / profiling of children

Analytics, engagement scoring or recommendation engines running on minor sessions.

Section 9(1)(b) · Example: Recommendation engine personalises content for under-18 users.

Targeted advertising directed at children

Interest-based ads or in-product upsells served to identified minors.

Section 9(1)(c) · Example: Meta pixel firing on under-18 session triggers personalised ad targeting.

Failure to notify DPB of a breach

Either Phase-1 (without delay) or Phase-2 (72-hour detailed report) missing.

Section 8(6) · Rule 7(1)-(2) · Example: Breach discovered Tuesday, DPB notified the following Monday — over the 72-hour clock.

Failure to notify affected Data Principals

No email/SMS/app notification to people whose data was breached.

Section 8(6) · Rule 7 · Example: Lab decides to "manage media coverage" rather than notify affected patients.

No tested Incident Response Plan

IRP either does not exist or has not been tested in the last 12 months.

Section 8(5) · Rule 6(c) + Rule 7 · Example: IRP exists on paper, never drilled — team misses the 72-hour Phase-2 window.

DPA does not require processor breach notification within Fiduciary window

Processor breach reaches you too late to meet the 72-hour DPB obligation.

Section 8(6) · Rule 6(f) + Rule 7 · Example: KYC vendor breached, told you 5 days later — you missed your DPB Phase-2 window.

SDF — no India-resident DPO appointed

DPO outsourced to a firm, not an individual, or not India-resident.

Section 10(2)(a) · Rule 13 · Example: Designated SDF retained a foreign privacy firm as "DPO" instead of an individual.

SDF — DPO does not report to the Board

DPO reports through the CISO, COO or business unit instead of directly to the Board.

Section 10(2)(a) · Rule 13 · Example: DPO sits under the InfoSec org; no governance charter naming the Board reporting line.

SDF — no annual DPIA on file

DPIA not commissioned within 12 months of designation, or stale.

Rule 13(1) · Example: Designated 18 months ago, still no DPIA covering all processing activities.

SDF — no independent annual audit

Audit performed by internal team or by the same firm that ran the DPIA.

Section 10(2)(b) · Rule 13(1) · Example: DPIA and audit awarded to the same Big-4 firm; auditor not independent.

No DPDP-compliant privacy notice

Notice missing one or more Rule 3(a)-(e) mandatory items.

Section 5 · Rule 3 · Example: Notice does not list categories of personal data collected or grievance officer contact.

No withdraw-consent mechanism

Withdrawal requires more steps than giving consent, or is not findable.

Section 6(4) · Example: Banner accepts in one click; withdrawal requires emailing the company.

No Data Processing Agreement with a processor

Personal data shared with a vendor with no DPA on file.

Section 8(2) · Rule 6(f) · Example: Patient data shared with home-collection partner with no signed DPA.

Rights requests not fulfilled within 90 days

Access / correction / erasure / nomination request unanswered or refused without reason.

Section 11–14 · Rule 14 · Example: Patient access request received in March, no response by July.

No grievance redressal mechanism published

No named grievance officer or response SLA on the website / app.

Section 13 · Rule 14(3) · Example: Footer has no grievance officer contact; Data Principal escalates directly to DPB.

Cross-border transfer to a notified restricted country

Personal data continues to flow to a country on the negative list after notification.

Section 16 · Rule 15 · Example: Analytics SDK posts events to a restricted country region after the transition window.

Marketing without valid consent

Cart-recovery, newsletter or transactional-disguised marketing without specific opt-in.

Section 6 · Example: Abandoned-cart email to a user who never opted into marketing.