Archive · 8 Dec 2025
Companies Face High Costs for DPDP Compliance
Companies in India will have to spend a lot of money to follow new rules about protecting people's personal information.
Big companies will have to spend between 2.5 crore and 18 crore rupees just once, and then between 50 lakh and 10 crore rupees every year after that.
Medium-sized companies will spend between 1.5 crore and 2.5 crore rupees initially, and small companies will spend between 1 crore and 1.5 crore rupees.
These costs are for things like setting up systems to manage people's data, hiring people to oversee data protection, and making sure the company's systems are secure.
If companies don't follow the rules, they can be fined up to 250 crore rupees.
The rules started in November 2025, and companies have 18 months to make sure they are following all the rules.
Companies will incur a one-time cost ranging from Rs 1 crore to Rs 18 crore for DPDP compliance, depending on their size.
Annual costs for compliance will range from Rs 50 lakh to Rs 10 crore in subsequent years.
The costs cover data mapping, consent management, security hardening, and hiring Data Protection Officers.
Penalties for non-compliance can reach up to Rs 250 crore for data breaches and up to Rs 200 crore for failure to notify breaches within 72 hours.
The DPDP rules became operational on November 14, 2025, with an 18-month compliance window for companies.
- Who
- Companies processing personal data of Indian citizens
- What
- Compliance with Digital Personal Data Protection (DPDP) rules
- When
- DPDP rules became operational on November 14, 2025, with an 18-month compliance window
- Where
- Applies to all entities processing personal data of Indian citizens, regardless of incorporation location
- Why
- To ensure data protection and privacy for Indian citizens
- One-time cost range for large enterprises
- Rs 2.5 crore to Rs 18 crore
- One-time cost range for mid-size enterprises
- Rs 1.5 crore to Rs 2.5 crore
- One-time cost range for smaller companies
- Rs 1 crore to Rs 1.5 crore
- Annual cost range for all enterprises
- Rs 50 lakh to Rs 10 crore
- Penalty for security failure leading to data breach
- Up to Rs 250 crore
- Penalty for failure to provide breach notification within 72 hours
- Up to Rs 200 crore
- Penalty for failure to fulfill additional duties as a significant data fiduciary
- Up to Rs 150 crore
- Penalty for any other breach of the DPDP Act
- Up to Rs 50 crore
- Date DPDP rules became operational
- November 14, 2025
- Time window for full compliance
- 18 months