Browsing: Penalties

India’s Digital Personal Data Protection Act (DPDP Act), 2023 has introduced one of the strictest penalty frameworks for data breaches in the country’s legal history. For companies handling personal data, a breach is no longer just a technical failure—it is now a serious financial and legal risk. This article explains exactly how much fine a company can face, when penalties apply, and how regulators decide the amount. Maximum Penalty Under the DPDP Act Under the DPDP Act, companies (referred to as Data Fiduciaries) can face penalties of up to: ₹250 crore for a single instance of non-compliance This is not…

Two former cybersecurity professionals in the United States have pleaded guilty in a federal court to conspiring with a ransomware group involved in cyber extortion attacks against American companies. The individuals admitted to participating in activities that helped deploy ransomware, encrypt victim networks, and demand ransom payments from targeted organizations. As part of the criminal case, both individuals now face potential prison sentences of up to 20 years each under U.S. federal law. Sentencing is scheduled to take place in 2026. The case is being treated as a significant enforcement action against individuals involved in cybercrime, particularly due to the…

India has notified the Digital Personal Data Protection Rules, 2025, bringing into force the enforcement and penalty framework under the Digital Personal Data Protection Act, 2023. The Rules empower the Data Protection Board of India to examine violations of the Act and impose financial penalties on entities that fail to comply with legal obligations related to personal data protection. Serious violations — including failure to implement required security safeguards, failure to report data breaches, or violation of core compliance requirements — can attract penalties of up to ₹250 crore. Other categories of non-compliance, such as procedural failures related to consent,…