Does a capped-penalty regime under the DPDP Act, 2023 provide adequate deterrence against large digital platforms? Critically analyse.

The DPDP Act, 2023 sets a fixed maximum fine for each category of default. Security-safeguard failures can draw up to ₹250 crore. Breach-notification and children's-data lapses can draw up to ₹200 crore each, and other defaults up to ₹50 crore [1]. In October 2026, New Mexico imposed a $25 billion penalty on Meta for deceptive privacy claims [2]. That raises a question: do India's caps deter large platforms, or are they just a cost of doing business?

Where the capped regime works

• Predictability: firms know their maximum exposure in advance. The Board must also weigh the nature and gravity of a default and any efforts to mitigate it [3].
• No arbitrary sums: New Mexico charged $5,000 per violation, which produced a jury figure above $219 billion. The judge then cut it to $25 billion [2].
• Graded protection: the higher tier for children's data shows special concern for vulnerable users [1].
• Proportionate burden: startups and MSMEs face lighter duties, while Significant Data Fiduciaries must carry out audits and impact assessments [3].

Where deterrence falls short

• Ceilings ignore scale: a platform with crores of users faces the same maximum as a small app. Meta's liability, by contrast, grew with the number of violations [2].
• Risk can be priced in: the court found an "extraordinary number of willful violations" backed by Meta's leadership [2]. Against such deliberate conduct, a known ceiling becomes a cost the firm can weigh against the profit from extra data.
• Harm is not regulated: the Act drops the Srikrishna Committee's harm-based approach. It also has no right to be forgotten [4].
• Enforcer's independence: Board members serve two-year terms and can be reappointed. SEBI and CCI members serve five years [4].
• Weak consumer-law route too: the CCPA fined PhysicsWallah ₹5 lakh and McAfee ₹1 lakh for dark patterns [5]. Platforms are mostly asked to self-audit [6].

Way forward

• Add turnover-linked ceilings for Significant Data Fiduciaries, and steeper fines for repeated or willful violations.
• Give Board members five-year terms [4].
• Have the CCPA and the Board run joint investigations instead of relying on self-declarations.

Overall, the caps give certainty and proportionality, but they deter large platforms only weakly. Penalties that rise with a firm's size and with deliberate intent, enforced by an independent Board, would give real effect to the right to privacy recognised in Puttaswamy (2017) and build user trust in India's digital economy.