Privacy fines across India and the Gulf range from a few thousand to hundreds of crores. India's DPDP Act allows up to ₹250 crore per instance for weak security, ADGM can fine up to USD 28 million and Saudi Arabia up to SAR 5 million, doubled for repeats. Onshore UAE has not yet set any fines. This guide compares the ceilings in one table.
How to read these numbers
Penalty ceilings tell you how seriously a law treats a failure, not what a typical fine will be. Some regimes cap fines per contravention or per instance, some add criminal penalties, and one, onshore UAE, has not yet set any amounts. Where a figure could not be verified for this guide, the table says so rather than guessing.
Penalty comparison table
Amounts are in local currency or USD as stated in each law or regulation, and no currency conversion is applied. Read each ceiling alongside the notes column, since several regimes add criminal penalties, doubled fines for repeat offences or separate fines for specific failures such as a missing impact assessment.
| Jurisdiction | Maximum penalty | Notes |
|---|---|---|
| India (DPDP) | Up to ₹250 crore per instance | Security safeguard failures; from 13 May 2027 |
| India (CERT-In) | Up to one year in prison and/or fine up to ₹1 lakh | Section 70B(7) IT Act |
| UAE onshore | Not yet set | Awaits Cabinet decision and Executive Regulations |
| DIFC | Reported up to USD 100,000 per contravention (Schedule 2) | Serious contraventions uncapped; compensation claims in DIFC Courts |
| ADGM | Up to USD 28 million | Administrative breaches; larger fines possible for serious violations |
| Saudi Arabia | Up to SAR 5 million, doubled for repeats | Up to 2 years and/or SAR 3 million for harmful sensitive data disclosure |
| Qatar | Up to QAR 5 million | Missing DPIA reported at QAR 1 million |
| Bahrain | Up to one year and/or BHD 1,000 to 20,000 | Criminal, Article 58; administrative caps unverified |
| Oman | Up to OMR 500,000 | Transfer violations; OMR 20,000 for breach notice failures |
India: tiered DPDP penalties
The DPDP Act sets penalties by type of failure. Failing to keep reasonable security safeguards can cost up to ₹250 crore per instance. Failures on breach notification or children's obligations can cost up to ₹200 crore, Significant Data Fiduciary failures up to ₹150 crore, and other breaches up to ₹50 crore. These apply once the core duties start on 13 May 2027.
CERT-In penalties already apply. Non-compliance with the April 2022 Directions, such as missing the 6-hour reporting rule, is punishable under Section 70B(7) of the IT Act with up to one year in prison, a fine of up to ₹1 lakh, or both.
UAE: three regimes
Onshore UAE has no fines yet. Administrative penalties under the PDPL are to be set by a Cabinet decision and the Executive Regulations, which had not been issued as of mid 2026. In the DIFC, Schedule 2 fines are reported at up to USD 100,000 per contravention, general fines for serious contraventions are currently uncapped, and data subjects can claim compensation in the DIFC Courts. ADGM allows fines of up to USD 28 million for administrative breaches, with scope for more for serious violations.
Saudi Arabia and Qatar
Saudi Arabia allows a warning or a fine of up to SAR 5 million, doubled for repeat offences. Disclosing or publishing sensitive data with intent to harm or for personal benefit can lead to up to 2 years in prison and up to SAR 3 million, or either.
Qatar's PDPPL allows fines of up to QAR 5 million. Failure to carry out a required DPIA is reported at QAR 1 million, and in February 2026 the NCSA publicised a binding decision against a sports company after a breach.
Bahrain and Oman
Bahrain backs key duties with criminal penalties. Article 58 allows imprisonment of up to one year and a fine of BHD 1,000 to BHD 20,000, or either, for breaches of the sensitive data and transfer rules or unreasonable disclosure. Oman's PDPL sets fines of up to OMR 500,000 for cross-border transfer violations and up to OMR 20,000 for breach notification failures. The Executive Regulations add administrative fines reported at up to OMR 2,000 per violation, plus suspension or cancellation of permits.
Where the risk concentrates
Across the region, the highest ceilings attach to the same few failures: weak security, late or missing breach notices, children's and sensitive data, and unlawful transfers. Those are the areas to fund first. XDQ Labs does AI security engineering for teams that need to find and fix these weak points. For a fast first check, XDQ xAgents (https://xagents.xdqlabs.com) reviews a privacy policy for the commitments these penalty regimes target. This guide is general information, not legal advice. Confirm with a qualified lawyer.
- Security safeguards and logging
- Breach notification within each deadline
- Children's and sensitive data controls
- Cross-border transfer mechanisms
- Regulator filings and renewals
Frequently asked questions
What is the maximum DPDP penalty in India?
Up to ₹250 crore per instance for failing to keep reasonable security safeguards. Breach notification or children's failures can cost up to ₹200 crore, SDF failures up to ₹150 crore and other breaches up to ₹50 crore, from 13 May 2027.
Are there fines under the UAE PDPL yet?
Not yet. Administrative penalties are to be fixed by a Cabinet decision and the Executive Regulations, which had not been issued as of mid 2026. The DIFC and ADGM free zones have their own fines.
Which GCC data protection regimes allow the biggest fines?
ADGM allows up to USD 28 million for administrative breaches and more for serious violations, and DIFC fines for serious contraventions are currently uncapped. Saudi Arabia (SAR 5 million, doubled for repeats) and Qatar (QAR 5 million) set fixed ceilings in local currency.
Can data protection breaches lead to prison in the GCC?
Yes in some cases. Saudi Arabia allows up to 2 years for harmful sensitive data disclosure, and Bahrain allows up to one year under Article 58. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Digital Personal Data Protection Act, 2023 (India Code), India Code, Legislative Department, 2023
- Nishith Desai Associates: CERT-In Directions of 28 April 2022, Nishith Desai Associates, 2022
- Al Tamimi: UAE establishes new Federal Authority for AI and Data, Al Tamimi & Company, 2026
- Baker McKenzie: DIFC regulators, enforcement priorities and penalties, Baker McKenzie
- Taylor Wessing: New ADGM data protection law, key changes, Taylor Wessing, 2021
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Squire Patton Boggs: Qatar's new Protection of Personal Data Privacy Law, Squire Patton Boggs, 2017
- Clyde & Co: Regulatory guidelines on the Qatar Personal Data Protection Law, Clyde & Co, 2021
- Al Tamimi: Bahrain's Personal Data Protection Law comes into effect on 1 August 2019, Al Tamimi & Company, 2019
- Al Tamimi: New Omani Personal Data Protection Law comes into force, Al Tamimi & Company, 2023
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
