DPDP Act penalties in full
The Schedule to the Digital Personal Data Protection Act, 2023, read with section 33.
What is the maximum penalty under the DPDP Act? Rs 250 crore, for failing to take reasonable security safeguards under section 8(5). Every figure is a ceiling: the Act says “may extend to”. A penalty may only be imposed if the Data Protection Board finds, on conclusion of an inquiry, that the breach is “significant” under section 33(1). That word is undefined and there is no Board jurisprudence yet.
THE SCHEDULE
[See section 33 (1)]
| Sl. No. | Breach of provisions of this Act or rules made thereunder | Penalty |
|---|---|---|
| 1. | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to two hundred and fifty crore rupees. |
| 2. | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. | May extend to two hundred crore rupees. |
| 3. | Breach in observance of additional obligations in relation to children under section 9. | May extend to two hundred crore rupees. |
| 4. | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to one hundred and fifty crore rupees. |
| 5. | Breach in observance of the duties under section 15. | May extend to ten thousand rupees. |
| 6. | Breach of any term of voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. |
| 7. | Breach of any other provision of this Act or the rules made thereunder. | May extend to fifty crore rupees. |
Signed: DR. REETA VASISHTA, Secretary to the Govt. of India.
How the Board sets the amount
Section 33(2) lists seven factors the Board must weigh:
- the nature, gravity and duration of the breach;
- the type and nature of the personal data affected;
- the repetitive nature of the breach;
- whether the person realised a gain or avoided a loss;
- whether the person acted to mitigate, and how timely and effective that was;
- whether the penalty is proportionate and effective as a deterrent;
- the likely impact of the penalty on the person.
Factors 5, 6 and 7 are where mitigation arguments live.
Where the money goes
All penalties are credited to the Consolidated Fund of India (section 34). The DPDP Act gives affected individuals no right to compensation, civil courts are barred from these matters (section 39), and section 43A of the IT Act, which used to provide a compensation route, was repealed by section 44(2)(a).
Appeals
An appeal lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days of receiving the order, extendable for sufficient cause (section 29). TDSAT endeavours to dispose of appeals within six months.
Blocking orders
After the Board has penalised a Data Fiduciary in two or more instances, it may advise the Central Government to block public access to the service in the interests of the general public (section 37). Intermediaries are bound to comply.
Is there jail time under the DPDP Act?
No. There are no criminal offences and no imprisonment anywhere in the DPDP Act.
Last updated . Report an error.