Calculator

What could a client-data breach actually cost your firm?

Not a magic formula - your own numbers for the part only you know (what your clients are worth), plus two real, cited figures for the part that's public record (India's 2025 breach-cost average, and the DPDP Act's actual penalty ceilings).

Your client-relationship math

This is your estimate, not ours - a firm with tight, sole-source relationships might reasonably put this lower or higher than one with easily-replaceable engagements.

A simple relationship-value multiplier, not a discounted-cashflow model - adjust to match how long your typical engagement actually runs.

Estimated client-relationship value at risk
₹36,00,000
40 clients × 15% affected × ₹3,00,000/year × 2 years

Two numbers that are public record, not our estimate

₹22 crore
India's average total cost of a data breach, 2025 - across organizations of every size and industry, not scoped to firms your size specifically.
Source: IBM Cost of a Data Breach Report, India findings, published 7 Aug 2025
Up to ₹450 crore
DPDP Act statutory maximum: ₹250 crore for inadequate security safeguards (§8(5)) plus ₹200 crore for failing to notify a breach (§8(6)) - these are ceilings the Data Protection Board can impose, not what a typical firm would actually be fined.
Source: DPDP Act, 2023, Schedule (penalty provisions for §8(5) and §8(6))

What this doesn't include, on purpose: reputational damage beyond client attrition, litigation costs, regulatory investigation time, and the actual (likely much lower than the statutory ceiling) penalty a Data Protection Board would set for a specific incident based on its severity, duration, and your mitigation efforts. Those are real costs too - just not ones we can honestly reduce to a single number without more assumptions than we're comfortable making for you.

Methodology

The client-relationship figure above is: active clients × the percentage you estimate would leave after a serious, publicly disclosed breach × your average annual fee per client × the number of years of future revenue a lost client represents. It's a transparent worksheet using your own inputs, not a predictive model - we don't know your actual client concentration or churn risk, and wouldn't presume to.

The two reference figures are quoted directly from their sources, not derived or adjusted. Neither is scoped to firms your specific size - use them as context for the scale of what's at stake nationally and statutorily, not as a prediction for your firm.

Related reading

Lower the odds this number ever applies to you

No credit card to start. Intrusive features stay off until your own DPIA is recorded.

Try for free