What Is the DPDP Penalty for Employee Monitoring Violations?

What does the DPDP Schedule actually prescribe?

The penalty architecture of the Digital Personal Data Protection Act 2023 lives in one place: the Schedule, read with Section 33. There is no flat fine and no percentage-of-turnover formula as in the GDPR. Instead, the Schedule lists breach categories with a rupee ceiling for each, applied per instance of violation after an inquiry by the Data Protection Board of India.

• Up to Rs 250 crore — failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5)).
• Up to Rs 200 crore — failure to give the Board and affected Data Principals intimation of a personal data breach (Section 8(6)).
• Up to Rs 200 crore — breach of the additional obligations relating to children (Section 9) — rarely the employer scenario, but it exists.
• Up to Rs 150 crore — breach of the additional obligations of a Significant Data Fiduciary (Section 10).
• Up to Rs 50 crore — breach of any other provision of the Act or its rules: notice, consent, purpose limitation, erasure, grievance redressal and more.

For a CFO or CISO, the practical reading is this: the two biggest numbers attach not to monitoring itself but to how you secure and handle the data your monitoring produces. The figures below are statutory maximums, not automatic awards — verify with counsel.

Which monitoring failures map to which penalty tier?

The Schedule speaks in sections of the Act; your risk register speaks in tools and configurations. This table translates between the two for the most common employee-monitoring failure modes we see in India IT services, BPO and GCC environments.

Mapping is indicative: the Board characterises violations on the facts, several rows can apply to one incident, and each instance is penalised separately. Verify with counsel.

The Rs 250 crore tier: security failures in the monitoring store

Monitoring tools are data factories. A screenshot-heavy deployment across a 2,000-seat BPO can generate millions of images a month — each one personal data, many capturing customer records, passwords, medical portals or personal chats that happened to be on screen. The Schedule’s highest ceiling, Rs 250 crore, attaches to failing to protect that store with reasonable security safeguards.

The exposure scales with the capture surface. An unencrypted screenshot bucket, a shared admin login to the monitoring console, keystroke logs replicated to an unsecured analytics warehouse, or a vendor holding Indian employee data with undisclosed sub-processors are all variations of the same failure. The cheapest mitigation is architectural: collect less. A platform that scores productivity from outcome signals — calendar, repo, ticket and focus artefacts — rather than screen content has no screenshot store to breach. That is the design position gStride takes, and it converts this tier from a live exposure into a largely empty category.

The Rs 200 crore tier: breach-notification lapses

This is the tier that punishes silence. If monitoring data leaks — your own database, a vendor’s cloud bucket, an insider exfiltration — the Act requires intimation of the breach to the Data Protection Board and to each affected Data Principal. Your employees are those Data Principals. The DPDP Rules, 2025 prescribe the form and timelines of that intimation; the working assumption should be prompt notification with a fuller report to follow, on the timeline the Rules fix.

Two things make monitoring data nasty here. First, discovery is hard: screenshot archives are rarely inventoried, so teams often cannot say what leaked or whose data it contained. Second, notifying employees that their recorded screens leaked is an internal-trust event as much as a legal one. The lapse itself — not the breach — carries the Rs 200 crore ceiling, and it stacks on top of any Rs 250 crore security-failure finding from the same incident. Verify current Rules timelines with counsel.

Rs 150 crore: when the SDF tier catches large employers

The Central Government can notify classes of Data Fiduciaries as Significant Data Fiduciaries based on volume and sensitivity of data, risk to Data Principals and similar factors. Large IT services exporters, BPOs and GCC operators processing workforce data at scale are realistic candidates. SDF status brings additional duties: appointing a Data Protection Officer based in India, periodic independent data audits, and Data Protection Impact Assessments — which would squarely cover an employee monitoring programme.

Running an intrusive monitoring stack while skipping the DPIA, the DPO or the audit is a breach of Section 10 with a ceiling of Rs 150 crore. If SDF designation is plausible for your organisation, the monitoring DPIA is the artefact to commission first; our DPIA template and process guide walks through it. Verify designation status with counsel.

The Rs 50 crore residual tier: missing notice and stale data

Everything else lands in the residual tier — up to Rs 50 crore per instance — and this is where most everyday monitoring violations live. Deploying an agent without the itemised notice Sections 5–6 require. Holding no demonstrable consent or other lawful basis for each capture category. Using attendance data collected for payroll to feed a covert productivity score, in tension with purpose limitation. Ignoring an employee’s request to access, correct or erase their data. And the quiet classic: retaining ex-employee monitoring data — screenshots, keystrokes, scores — years after the person left and every employment purpose ended.

Rs 50 crore sounds like the “small” tier until you remember it applies per instance and that a silent deployment across thousands of employees is not obviously one instance. The fix is procedural and cheap relative to the exposure: itemised notices per capture category, a consent ledger, a retention schedule with automated deletion at exit plus any statutory holds. Verify with counsel.

How the Board sets the actual number

The Schedule gives ceilings; Section 33(2) gives the dial. After an inquiry, the Data Protection Board weighs the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether the violation is repetitive, whether the person gained or avoided loss from it, the mitigation actions taken and their timeliness, and the proportionality and deterrent effect of the penalty. Section 32 also lets a fiduciary offer a voluntary undertaking that the Board may accept, which can bar further proceedings on those facts.

Translated into a monitoring posture: an employer that captured narrowly, encrypted what it held, noticed transparently, deleted on schedule and notified fast sits at the bottom of every range. An employer running covert screenshot capture on an unencrypted store with no retention policy sits at the top of several ranges at once. The penalty regime effectively prices your architecture — which is the strongest business case for privacy-first monitoring there is. Verify with counsel.