The ₹250 Crore Question: How India’s DPDPA Rewrites the Cost of a Data Breach

This piece analyzes India’s Digital Personal Data Protection Act (DPDPA) 2023 and its impact on breach risk and compliance, emphasizing steep penalties (up to ₹250 crore for failing to implement reasonable safeguards, ₹200 crore for notification failures) and added obligations for Significant Data Fiduciaries. Citing recent Indian breach patterns—outdated infrastructure, weak third‑party controls, and poor data minimization—it explains how the law magnifies both direct and indirect costs (regulatory fines, reputational damage, litigation, and operational disruption) and urges a shift to security-by-design, rigorous vendor risk management, data minimization, and tested incident response.