Sch. · s.33 · s.42
Penalties
The Schedule to the DPDP Act sets seven penalty bands the Board may impose under Section 33, up to Rs 250 crore for failing reasonable security safeguards, Rs 200 crore for breach intimation and children’s data failures, and Rs 50 crore for other Data Fiduciary duties.
The bands are ceilings, not fixed amounts. Section 33(2) lists what the Board weighs: the nature, gravity and duration of the breach, the type of data affected, whether it was repetitive, gains made or losses avoided, the mitigation taken, and whether the penalty is proportionate. The word significant in Section 33(1) is a threshold: minor breaches may draw a direction rather than a penalty.
The Rs 250 crore ceiling attaches to Section 8(5) alone. That is why security safeguards, which look technical, carry the largest legal exposure in the Act. Section 42 lets the Government amend the Schedule but caps any increase at twice the original amount.
Questions people ask
- Is the penalty per breach or per Data Principal?
- The Schedule sets a ceiling per contravention. The Board decides the amount within it using the Section 33(2) factors.
- Can a Data Principal sue for compensation?
- Not under the Act. The 2023 Act removed the compensation route that the earlier bills and Section 43A of the IT Act carried; penalties go to the Consolidated Fund.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.