This is the breakdown across our framework, drawn directly from the Schedule to the Act. There is no survey and no sample. This is plain arithmetic.
The method and source evidence
Our framework codifies 211 obligations across 18 domains (DPDP Auditing Framework 1.0, pp. 17, 270, 286), drawn from four source documents and cited to the page across 740 indexed pages. Each obligation carries its DP-F code, its governing statutory provision, and its penalty tier. The tiers come directly from the Schedule to the Act. We simply counted them.
Compliance is a claim until evidence proves it.
What the arithmetic shows
| Tier | Provision | Domain(s) | DP-F range | Obligations | Maximum |
|---|---|---|---|---|---|
| P1 | S.8(5) | 5 | DP-F-5.1 to DP-F-5.11 | 11 | ₹250 crore |
| P2 | S.8(6) | 6 | DP-F-6.1 to DP-F-6.13 | 13 | ₹200 crore |
| P2 | S.9 | 9 | DP-F-9.1 to DP-F-9.15 | 15 | ₹200 crore |
| P3 | S.10 | 10 | DP-F-10.1 to DP-F-10.15 | 15 | ₹150 crore |
| P5 | S.15 | 13 | DP-F-13.1 to DP-F-13.5 | 5 | ₹10,000 |
| Variable | S.32 | 18 | DP-F-18.6 | 1 | at breach tier |
| P4 | all other provisions | 1 to 4, 7 to 8, 11 to 12, 14 to 17 | various | 151 | ₹50 crore |
| 211 |
Three structural facts emerge from this count, and each one changes operational priorities.
First, the ₹250 crore headline covers 11 obligations. While it is the highest number in the Act and the figure quoted across public commentary, it governs the smallest domain in the framework by count. Teams that construct compliance programmes around the headline are focusing their resources on 11 items.
Second, the operational volume sits in the ₹50 crore tier, which accounts for 151 obligations. That represents over 70% of the entire framework. It is rarely discussed in executive briefings, yet this tier contains the bulk of the operational obligations and where most audit findings will occur.
Third, the top three tiers together total 54 obligations across four domains: 5, 6, 9, and 10. These represent ₹150 to ₹250 crore of statutory exposure. This concentration is small enough to assign to a dedicated owner, and significant enough to warrant immediate audit-grade evidence.
Why the distribution matters more than the headline
An audit is not a checklist of legal clauses. It is an examination of verifiable artifacts. Each obligation in our framework is proven by one or more of five test types: DOC (a written document), TECH (a technical system setting), PROC (a verifiable process that ran), E2E (an end-to-end user experience), or LOG (an immutable record that an event occurred).
A superficial checklist treats these proof types as interchangeable. An auditor does not. An organisation can produce a DOC policy in an afternoon. It cannot backfill a LOG for a consent event or security check that never ran. The tier with the most obligations is not automatically the tier with the most work. The required test type determines the operational effort.
The honest limit
We hold our reporting to two operational ceilings:
- A scan shows a control is present, never that it operates. Pointing an automated scanner at a web property confirms that a consent notice exists. It cannot prove that personal data collection pauses until that consent is recorded. Presence and operation are fundamentally different audit findings, and our reports separate them.
- An assertion is not evidence. Sufficiency must be verified against an exact quoted passage or verifiable system artifact. Within our engine, an assessment without a specific quote or source record is refused.
What to do with this
- Sort by penalty tier, then by test type. Begin with domains 5, 6, 9, and 10, which contain 54 obligations. For each obligation, identify whether documentation alone is sufficient. Where technical logs or end-to-end verification are required, schedule those engineering tasks first.
- Address the ₹50 crore tier systematically. With 151 obligations located in this tier, regulatory exposure accumulates across multiple operational failures.
- Assign the concentrated exposure to a single operational lead. Four domains can be managed under one owner with an audit deadline.
- Produce primary artifacts instead of descriptive summaries. A data retention policy satisfies a DOC requirement, while an automated deletion record satisfies a LOG requirement. Both are required, but generating reliable execution records requires substantially more preparation.
The headline penalty is ₹250 crore. The statutory workload spans 211 obligations, and the vast majority of those obligations sit outside the headline.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. 18 domains, 211 obligations, 740 cited source pages, evidence-gated findings, and a signed, verifiable report. Not legal advice, not a certification scheme. www.dpdpdone.com