The short answer: the DPDP Act sets maximum penalties of up to Rs 250 crore per failure type, and the Board decides the actual amount after an inquiry. For a college, the practical risk is not a fine on day one. It is children’s data at admission, a security lapse with no records to show effort, and parents or partners who ask for proof first.
This is the second post in a series that starts with what the DPDP Act means for a college.
What are the penalties under the DPDP Act?
The Schedule to the Act lists seven kinds of breach with a maximum for each. The Act words every entry as a penalty that “may extend to” the amount.
| Failure | Section | Maximum penalty |
|---|---|---|
| Not taking reasonable security safeguards to prevent a breach | 8(5) | Rs 250 crore |
| Not notifying the Board and affected people of a breach | 8(6) | Rs 200 crore |
| Breaching the additional obligations for children’s data | 9 | Rs 200 crore |
| Breaching the additional obligations of a significant data fiduciary | 10 | Rs 150 crore |
| A data principal failing in their own duties | 15 | Rs 10,000 |
| Breaking a voluntary undertaking given to the Board | 32 | Up to the penalty for the breach it relates to |
| Any other breach of the Act or Rules | Residual | Rs 50 crore |
One incident can touch more than one row. A breach with no safeguards in place and no notice to anyone can reach both the Rs 250 crore and the Rs 200 crore ceilings.
Are these fixed fines?
No, and this matters when you explain the risk to a trustee. The Board can impose a penalty only after an inquiry and after giving the person a hearing, and only where it finds the breach significant (section 33(1)). When it sets the amount it must consider these matters (section 33(2)):
| Factor | What it asks |
|---|---|
| (a) Nature, gravity and duration | How serious, and for how long |
| (b) Type and nature of data | Health and children’s data weigh more |
| (c) Repetition | Whether it happened before |
| (d) Gain or avoided loss | Whether the fiduciary benefited |
| (e) Mitigation | What it did to reduce harm, and how fast and how well |
| (f) Proportionality | Whether the penalty is proportionate and effective |
| (g) Likely impact | The effect of the penalty on the person |
Factor (e) is the one a college controls most. A college that finds a breach quickly, tells people and fixes the cause is in a different position from one that finds out from a parent three weeks later. That is why the breach plan belongs in the preparation, not after the incident.
Why are children’s rules the first thing a college should check?
Because the Act defines a child as anyone who has not completed 18 years (section 2(f)). Many first-year applicants are 17.
Four rules apply to a child’s data:
| Rule | Source | What it means at the admission desk |
|---|---|---|
| Verifiable parent consent | Section 9(1), Rule 10 | Before processing, check the parent is an identifiable adult |
| No harmful processing | Section 9(2) | Nothing likely to harm the child’s well-being |
| No tracking, behavioural monitoring or targeted ads | Section 9(3) | Do not profile applicants or retarget them |
| Penalty up to Rs 200 crore | Schedule | The ceiling for breaking these |
Rule 10 says a college checks that the parent is an adult who can be identified, either from reliable details it already holds, or from details the parent gives voluntarily, including through a virtual token issued by an authorised entity. The Rule includes details made available and verified by a DigiLocker service provider.
What does the education exemption cover?
Less than many blogs say. Rule 12 and Part A of the Fourth Schedule switch off sections 9(1) and 9(3) for an educational institution, but only for processing that is “restricted to tracking and behavioural monitoring” either “for the educational activities of such institution” or “in the interests of safety of children enrolled”.
| Activity | Exemption covers it? |
|---|---|
| Attendance tracking for teaching | Yes, as an educational activity |
| Safety monitoring on campus | Yes, in the interest of safety |
| Transport vendor tracking a bus for safety | Yes, under a separate entry for transport providers |
| An application form with marks and ID proofs | No. Parent consent still applies |
| Retargeting an applicant’s phone number with ads | No. Targeted advertising to a child is barred |
| Section 9(2): processing that harms a child | Never exempt |
Part B adds narrow purposes, such as creating a user account used only for email. The Rules do not define where a personalised learning tool becomes “behavioural monitoring”, so write down why each use is educational.
What costs arrive before a fine?
A fine needs a staffed Board and a finished inquiry. Other costs do not.
| Pressure | How it shows up |
|---|---|
| Parents | A question at admission about how their child’s data is used and who can see it |
| Accreditation and partner reviews | Questionnaires that ask for a privacy notice, a grievance route and a vendor list |
| Vendors and auditors | Requests for a processor contract and an access log |
| An incident | A parent complaint, a social media post or a staff dispute before any regulator is involved |
A college that can answer these from records is better placed on factor (e) above and on every one of these questions.
What should a college check this week?
- Does the application form record a parent’s consent, and who gave it?
- Does anyone use applicant phone numbers for marketing?
- Is there a current list of vendors that hold student or staff data?
- Who can open student records, and is access logged?
- Who would write the first message to affected families if data leaked today?
The 24-week plan turns these into stages.
Sources
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023: section 2(f), section 9, section 33 and the Schedule. Checked 14 November 2026.
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Rules, 2025: Rules 10 and 12 and the Fourth Schedule. Checked 14 November 2026.
- PPC Land, A year after India fixed its data board at 4 members, none are appointed (trade report on the Board’s staffing, not an official source).
This post explains the law in general terms and is not legal advice.
Update log
- 14 November 2026: first published.
Frequently asked questions
What is the maximum penalty under the DPDP Act?
Rs 250 crore, for failing to take reasonable security safeguards to prevent a personal data breach (section 8(5)). Other ceilings are Rs 200 crore, Rs 150 crore and Rs 50 crore depending on the breach.
Are DPDP penalties fixed fines?
No. The Schedule sets the most the Board may impose. The amount in a case depends on seven factors in section 33(2), including the gravity and duration of the breach and how fast the fiduciary acted to mitigate it.
Are applicants under 18 children under the DPDP Act?
Yes. The Act defines a child as anyone who has not completed 18 years. Most first-year applicants are 17 or 18, so a college handles children's data from the day applications open.
Do colleges need parent consent for admission data?
Section 9(1) requires verifiable consent of the parent before processing a child's data. The educational-institution carve-out in the Fourth Schedule covers tracking and behavioural monitoring for education or safety, not ordinary admission processing.
Can a college use applicant phone numbers for marketing?
Not for a child. Section 9(3) bars targeted advertising directed at children, and the Fourth Schedule exemption for colleges is limited to education and safety. Using a 17-year-old applicant's number for ads falls outside it.
Does the education exemption remove the need for parent consent?
No. It switches off sections 9(1) and 9(3) only for processing restricted to tracking and behavioural monitoring for the institution's educational activities or the safety of enrolled children. Other processing still needs verifiable parent consent.
Has any DPDP penalty been imposed yet?
I found none. The Board must hold an inquiry and give a hearing first, and trade reports as of 1 November 2026 say no members had been appointed. Check the Board's own site for the latest position.
Facts last checked: 14 November 2026. Rules and dates change, so confirm with your own advisers before acting.
Check your admission desk against the children's rules
We walk through the application form, consent record and marketing use of applicant data with your registrar.
Book a review- DPDP Act
- Penalties
- Children's data
- College compliance