Section 33
Penalties
Empowers the Board to impose the monetary penalties in The Schedule where a breach is significant, and lists the factors that set the amount.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- On concluding an inquiry, if the Board finds the breach is significant, it may impose the monetary penalty specified in The Schedule, after giving the person an opportunity of being heard.
- (2)
- In deciding the amount the Board considers the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether the breach is repetitive, any gain realised or loss avoided, whether mitigating action was taken and how timely and effective it was, whether the penalty is proportionate and effective, and the likely impact of the penalty on the person.
In practice
Sub-section (2) is where a compliance record pays for itself. Mitigating action and its timeliness are express statutory factors, so the same incident can land at very different amounts depending on whether the fiduciary can show what it did and when. That is an evidence problem, not an argument problem.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 33 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.