Under the Digital Personal Data Protection Act, 2023, the PENALTY for the FAILURE of a data fiduciary to take reasonable SECURITY SAFEGUARDS to prevent a personal data BREACH may extend up to:

Section 33 of the DPDP Act, 2023 provides that a data fiduciary who fails to take REASONABLE SECURITY SAFEGUARDS to prevent personal data breaches is liable to a penalty which may extend to TWO HUNDRED AND FIFTY CRORE rupees (₹250 crore). This is the highest financial penalty tier in the Act, reserved for the security-safeguard default, alongside the graded penalties (including those for failure to notify a breach - also heavy). The quantum signals the Act's emphasis on data security. The ₹250 crore ceiling is the headline penalty figure of the DPDP regime.