DPDP Penalty Exposure Calculator

Estimate your indicative Digital Personal Data Protection Act 2023 financial exposure band in under 3 minutes. Answer 6 questions on headcount, employee data categories, Significant Data Fiduciary status, and your current controls — get an instant Low / Moderate / High / Severe band, framed against the headline INR 250 crore upper penalty tier. Built for India CISOs, DPOs, and COOs.

The DPDP Penalty Exposure Calculator is a free interactive tool that estimates an indicative financial-exposure band under India's Digital Personal Data Protection Act 2023 from six inputs: workforce headcount band, categories of employee personal data processed, likelihood of Significant Data Fiduciary status, and the controls already in place (consent capture, completed DPIA, breach-notification SLA, and data localization). It returns a qualitative band — Low, Moderate, High, or Severe — mapped against the headline penalty tier of up to INR 250 crore per breach category. The output is indicative only and is not a precise rupee figure or legal advice; verify your exposure with qualified counsel before acting.

Questions6 (headcount, data, SDF, 4 controls)

OutputExposure band + remediation steps

TimeUnder 3 minutes

FrameUp to INR 250 crore upper tier

How to use this

Pick one option per question — the exposure band updates the moment all six are answered. Q1 sets your headcount band, Q2 lets you tick every category of employee personal data you process, Q3 asks whether you may be designated a Significant Data Fiduciary, and Q4–Q6 ask which controls are already in place. Every figure is indicative only. The Act's headline penalty tier runs up to INR 250 crore per breach category, but the band you see is a directional risk read, not a calculated rupee liability — verify your exposure with qualified counsel before quoting any number.

Key facts (for citation)

Fact. The Digital Personal Data Protection Act 2023 is India's first cross-sector data-protection statute; operative DPDP Rules are expected to be notified in late 2025 or 2026 (subject to revision).

Fact. The Act's headline penalty band runs up to INR 250 crore per breach category in the statute; the exact penalty for any situation is determined by the Data Protection Board on the facts — verify with counsel.

Fact. Significant Data Fiduciary designation (DPDP Section 10) adds obligations such as a Data Protection Officer, independent audits, and DPIAs — raising both compliance cost and potential exposure.

Fact. This calculator returns a qualitative exposure band from six inputs; it does not produce a precise rupee figure and is not a substitute for legal advice.

✓

Instant exposure band
Low / Moderate / High / Severe as you answer

✓

Free to score
no email needed to see your band

✓

Full report (PDF)
exposure breakdown + remediation checklist

DPDP Penalty Exposure Calculator — 6 questions

The interactive calculator above requires JavaScript. The six inputs are reproduced below. All output is indicative only and must be verified with qualified counsel; the Act's headline penalty band runs up to INR 250 crore per breach category.

Q1. Workforce headcount band — how many employees' personal data do you process? (Under 100 / 100–500 / 501–2,000 / Over 2,000)

Q2. Categories of employee personal data processed (tick all): contact and identity, financial / payroll, biometric or health, location or device telemetry, children / minor-employee data, screenshot / keystroke / webcam / mic capture.

Q3. Could you be designated a Significant Data Fiduciary under DPDP Section 10? (No / Possibly / Likely or already designated)

Q4. Do you capture free, specific, informed consent per purpose for employee data processing? (Yes, documented / Partial / No)

Q5. Have you completed a documented Data Protection Impact Assessment for your employee-data processing? (Yes / In progress / No)

Q6. Do you have a documented breach-notification SLA and keep personal data within compliant data-residency boundaries? (Both in place / One in place / Neither)

Indicative exposure band Not yet scored

Answer all 6

Framed against the Act's headline tier of up to INR 250 crore per breach category.

Pick one option on each question — your indicative exposure band appears once all six are answered. Indicative only; verify with counsel.

Next step — close the gaps, then email the full report

Start free with the DPDP Vendor Risk Assessment Worksheet to score your current vendor against 14 procurement questions, then read the DPDP Act India workforce-monitoring buyer guide for the full picture. Also exposed to EU data subjects? Size both regimes at once with the GDPR + DPDP Dual Fine Exposure Estimator. Want the exposure breakdown and remediation checklist as a PDF? Email it to yourself below, or book a 30-minute readiness review with the gStride team.

Book a 30-min readiness review