DPDP Penalties: What a Data Breach Can Cost Your SaaS

A data breach at a SaaS company processing Indian user data can trigger penalties of up to ₹250 crore under the Digital Personal Data Protection Act 2023 for failure to implement adequate security safeguards, and a separate penalty of up to ₹200 crore for failing to notify the Data Protection Board and affected users within the required window. These are per-incident figures, not annual caps, and they can stack across separate violations arising from the same breach.

For most SaaS companies, the penalty exposure is not the only cost. Regulatory investigation, customer churn, enterprise contract termination clauses triggered by a breach notification, and the direct cost of incident response compound the regulatory fine into a business event of a different order of magnitude.

Here is the full penalty structure, what actually triggers each tier, and what a realistic total cost of a DPDP-related breach looks like for a mid-sized SaaS.

The DPDP Penalty Schedule in Full

The ₹250 crore figure gets quoted frequently in DPDP coverage, but it rarely comes with the context that matters: what exactly triggers it, what the Board considers when setting a penalty within the range, whether penalties stack, and how the regulatory exposure sits alongside the non-regulatory costs of a breach.

Understanding all of that changes how a SaaS leadership team should be thinking about DPDP investment, not as a compliance cost, but as a risk management calculation.

The penalties under the DPDP Act 2023 are set out in Schedule 1 of the Act. Each penalty tier corresponds to a specific failure, and the Data Protection Board has discretion to set the actual penalty within the maximum based on factors including the nature and gravity of the breach, the number of individuals affected, and the Data Fiduciary's prior compliance history.

Two things in this table matter more than the headline numbers.

First, the Section 8(5) and Section 8(6) penalties are independent. A breach that results from inadequate security safeguards and is not notified within the required window creates exposure under both sections simultaneously. The ₹250 crore and ₹200 crore penalties are not alternatives, they apply to separate failures that a single incident can trigger at once.

Second, the Board sets the actual penalty within the maximum. A first-time breach at a company with a documented compliance programme in place is likely to attract a lower penalty than a repeat failure at a company with no evidence of compliance effort. That distinction has direct implications for how SaaS companies should be documenting their DPDP programme.

What "Reasonable Security Safeguards" Actually Means

The ₹250 crore penalty attaches to failure to implement reasonable security safeguards under Section 8(5). The DPDP Rules 2025 give that phrase operational content, the safeguards the Rules specify include:

• Access controls limiting who can access personal data

• Access logging and monitoring to detect unauthorised access

• Data backups to preserve availability in the event of a breach

• Methods for detecting unauthorised access attempts

• Processes for investigating and remediating breaches to prevent recurrence

This list is not exhaustive, and "reasonable" is assessed relative to the nature and volume of data being processed. A SaaS platform processing financial data for millions of Indian users is held to a higher standard of reasonableness than a startup with a few thousand users. But the obligation exists regardless of scale. There is no size threshold below which security safeguards are not required.

The security control framework this maps to access management, monitoring, detection, response is exactly what a mature security programme covers. Our guide on Zero Trust architecture implementation covers the access control and network segmentation layer in depth, and our piece on attack surface management addresses the external exposure monitoring that feeds into breach detection.

According to Seclore's analysis of the DPDP Rules, the ₹250 crore penalty for security safeguard failures is the highest in the Act and represents the clearest signal of where the government considers the most consequential risk to data principals to lie.

What the Breach Notification Window Requires

The Section 8(6) penalty up to ₹200 crore applies to failure to notify the Data Protection Board and affected users of a personal data breach within the required window.

The DPDP Rules 2025 set a two-stage notification process:

Stage 1, Board notification: Immediately upon discovering a breach, the Data Fiduciary must notify the Data Protection Board. The initial notice must include a description of the breach, the categories and approximate number of Data Principals affected, the likely consequences, and the measures taken or proposed to address it.

Stage 2, User notification: Within 72 hours of Board notification, affected Data Principals must be notified in plain language describing what data was exposed, what protective measures they should take, and the Data Fiduciary's contact details for queries.

Two aspects of this requirement create operational risk for SaaS companies whose incident response processes were built around GDPR.

First, the DPDP notification obligation has no harm threshold. Unlike GDPR, which requires notification only when a breach is likely to result in risk to the rights and freedoms of individuals, DPDP requires notification of any personal data breach. A misconfiguration that briefly exposed a handful of user records triggers the same notification obligation as a large-scale exfiltration.

Second, the 72-hour window to users runs from Board notification, not from discovery. The total window from discovery to user notification is compressed, immediate Board notification, then 72 hours to users.

Recording Law's comprehensive DPDP analysis confirms that the notification timeline under DPDP is among the most demanding of any data protection regime globally, specifically because the no-threshold approach means far more incidents trigger the obligation compared to GDPR.

SaaS companies need a dedicated incident response track for Indian user data breaches that bypasses the harm-assessment filter most GDPR processes include. Our ransomware incident response playbook covers the broader incident response discipline, and the DPDP notification obligation needs to be built as a specific trigger within that process.

How Penalties Can Stack in a Single Incident

Consider a realistic breach scenario for a mid-sized SaaS:

A misconfigured API endpoint exposes personal data of 50,000 Indian users for 18 hours before detection. The security team, following a GDPR-influenced process, conducts a harm assessment before deciding whether to notify. That assessment takes four days. The Board is notified on day five. Users are notified on day seven.

In this scenario:

• Section 8(5) exposure: The misconfigured API represents a failure of reasonable security safeguards, specifically, inadequate access controls and monitoring that would have detected the exposure faster. Penalty exposure: up to ₹250 crore.

• Section 8(6) exposure: Board notification on day five is not immediate. User notification on day seven exceeds the 72-hour post-Board-notification window. Penalty exposure: up to ₹200 crore.

• Total maximum exposure from a single incident: Up to ₹450 crore across two separate violations.

The Board would not necessarily impose the maximum in this scenario. But the exposure exists, and it exists because of two process failures, one technical, one procedural that are both addressable before an incident occurs.

The Non-Regulatory Costs That Compound the Penalty

Regulatory fines are the headline. They are not the full cost.

Incident response and forensics: Investigating the breach, containing it, and producing the evidence the Board will require costs money regardless of penalty outcome. According to IBM's Cost of a Data Breach Report 2024, the average cost of a data breach in India is approximately ₹19.5 crore and that figure covers direct costs only, before any regulatory penalty.

Enterprise customer impact: B2B SaaS contracts typically include data breach notification obligations and, increasingly, termination rights triggered by a breach affecting customer data. A breach that requires you to notify enterprise clients under DPDP may simultaneously trigger contract review clauses that affect your revenue.

Reputational exposure: The Data Protection Board maintains a public record of enforcement actions. A breach resulting in a Board investigation becomes publicly visible, which affects customer confidence in ways that are harder to quantify but tend to persist longer than the regulatory process itself.

Investor and M&A implications: A company under Data Protection Board investigation or with a recent enforcement action on record faces materially harder due diligence conversations. Our cybersecurity due diligence guide for M&A covers how acquirers and investors are increasingly treating data breach history as a valuation-affecting factor.

What Reduces Penalty Exposure

The Data Protection Board has discretion in setting penalties within the maximum. The factors it considers work in both directions, they can increase or decrease the penalty from the theoretical maximum.

Factors that reduce penalty exposure:

• A documented DPDP compliance programme that demonstrates genuine effort before the breach occurred

• Prompt voluntary notification, even if the window was not fully met, proactive Board engagement is treated differently than notification only after investigation

• Evidence of security safeguards that were reasonable relative to the company's scale and the data being processed, even if they were not sufficient to prevent this specific breach

• Remediation steps taken before Board investigation, not only in response to it

• No prior enforcement history with the Data Protection Board

Factors that increase exposure:

• No documented compliance programme or evidence of prior investment in security safeguards

• Delayed notification, particularly where the delay was caused by an internal harm assessment process rather than a genuine operational constraint

• Large number of affected Data Principals

• Sensitive nature of the exposed data

• Prior enforcement history

The practical implication is that building a DPDP compliance programme, gap assessment, consent architecture, security safeguards, breach response process, documented evidence is both a regulatory obligation and a penalty mitigation strategy. A company that can show the Board a documented programme and rapid voluntary notification is in a fundamentally different position than one that cannot.

Digisecuritas' DPDP Compliance Services builds the documented compliance programme that serves both regulatory requirements and penalty mitigation with evidence packs structured to demonstrate to the Board that reasonable safeguards were in place before an incident occurred.

Practical Steps to Reduce Your Breach Cost Exposure

Run a security safeguards gap assessment against the DPDP Rules requirements: Access controls, access logging, monitoring, backups, and breach detection are the specific safeguards the Rules name. Assess where your current security programme covers these and where gaps exist.

Build a dedicated DPDP breach notification track: Separate from your GDPR incident response process, this track should trigger immediately on discovery of any breach affecting Indian user data, with no harm assessment gate before Board notification.

Document everything: The compliance programme that reduces your penalty exposure is only useful to the Board if it is documented and evidenced. Undocumented safeguards carry no weight in a penalty assessment.

Test your incident response: An untested breach response process that fails under real conditions is not a defence. Annual testing, at minimum, is both a DPDP Rules expectation and the only way to know whether your notification window can actually be met.

Review your vendor contracts for upstream notification: Your data processors, cloud providers, analytics tools, customer support platforms, need contractual obligations to notify you immediately of any breach affecting your data. That upstream notification is what enables you to meet your own 72-hour window. Our third-party vendor risk management guide covers the vendor contract discipline in full.

Conclusion

The ₹250 crore headline gets attention. The more operationally relevant number is what a realistic total exposure looks like when regulatory penalties, incident response costs, and commercial consequences compound across a single event.

For a SaaS company with a meaningful Indian user base, a breach that is handled badly, inadequate safeguards, delayed notification, no documented compliance programme is a company-level event, not a compliance line item.

The investment required to build genuine DPDP compliance is a fraction of that exposure. The gap assessment, consent architecture, security safeguards, and breach notification process that the Act requires are also the controls that, when in place, change the nature of a breach event from a potential company-ending penalty to a managed incident with a defensible regulatory outcome.

Digisecuritas helps SaaS companies build the security safeguards, breach notification processes, and documented compliance evidence that the DPDP Act requires and that the Data Protection Board looks for when assessing penalty levels. Book a Discovery Call to understand where your current exposure sits and what it would take to close it.