Where the Board, after an inquiry under section 28, is satisfied that a person has committed a breach of any of the provisions of this Act or the rules made thereunder, it may, after giving such person a reasonable opportunity of being heard, impose a monetary penalty as specified in the Schedule. Schedule (Financial Penalties): Item 1 — Failure to take reasonable security safeguards (Section 8(5)) resulting in a personal data breach: up to Rs 250 crore. Item 2 — Failure to notify the Board and affected Data Principals of a breach (Section 8(6) and Rule 7): up to Rs 200 crore. Item 3 — Breach of obligations relating to additional obligations of Significant Data Fiduciary (Section 10): up to Rs 150 crore. Item 4 — Breach of obligations relating to children's data processing (Section 9): up to Rs 200 crore. Item 5 — Failure to fulfil Data Principal rights obligations (Sections 11 to 14): up to Rs 50 crore. Item 6 — Breach of any other provision of the Act or Rules: up to Rs 50 crore.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 33 and the Schedule are the enforcement teeth of the DPDP Act. Three critical points: First, penalties are per-finding ceilings — a single incident can generate multiple findings (e.g., inadequate security leading to a breach is Item 1, and failure to notify is Item 2 — potentially Rs 450 crore from one incident). Second, the Board must give the organisation an opportunity to be heard before imposing a penalty — penalties are not automatic. Third, the money goes to the Consolidated Fund of India (Section 34), not to the complainant — there is no private right of action for damages under the DPDP Act.
A fintech company suffers a breach because it did not encrypt its customer database (Item 1: up to Rs 250 crore). It then fails to notify the Board within the Rule 7 timeline (Item 2: up to Rs 200 crore). It also does not notify affected customers (also Item 2). All three failures are separate findings — the total penalty exposure from one incident is up to Rs 450 crore.
Section 33 says the Board 'may impose' a penalty up to the Schedule maximum. The Board considers factors like the severity of the breach, the number of affected individuals, whether the organisation took remedial action, and whether it cooperated with the inquiry. A first-time breach by an organisation that promptly notified and took corrective action will not necessarily attract the maximum.
Section 34 routes all penalties to the Consolidated Fund — not to complainants. A Data Principal who suffered harm from a breach cannot use the DPDP Act to sue the Data Fiduciary for compensation. Their remedy is a Board complaint. Civil claims for damages arising from breach would need to be brought under separate tort law.