India DPDPA: Article 33 – Penalties
33. Penalties
(1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.
(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:—
(a) the nature, gravity and duration of the breach;
(b) the type and nature of the personal data affected by the breach;
(c) repetitive nature of the breach;
(d) whether the person, as a result of the breach, has realised a gain or avoided any loss;
(e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
(f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and
(g) the likely impact of the imposition of the monetary penalty on the person.
What Article 33 Means for Your Business
Article 33 contains the penalty framework under the DPDPA. Penalties are tiered by severity of breach and can reach ₹250 crore (approximately USD 30 million) for the most serious violations. The Board must consider multiple factors when determining the appropriate penalty, including gravity, duration, type of personal data involved, and whether the breach was repetitive.
- Failure to implement reasonable security safeguards leading to a data breach, penalty up to ₹250 crore.
- Failure to notify the Board and affected Data Principals of a breach, penalty up to ₹200 crore.
- Processing children’s personal data in violation of Article 9, penalty up to ₹200 crore.
- Breach of additional obligations by Significant Data Fiduciaries, penalty up to ₹150 crore.
- Breach of any other provision of the Act or Rules, penalty up to ₹50 crore.
- Failure by a Data Principal to comply with their duties under Article 15, penalty up to ₹10,000.
- When determining the penalty quantum, the Board will consider the nature, gravity and duration of the breach; the type and volume of personal data affected; repetitive breaches; and whether the breach was intentional or negligent. Proactive remediation, voluntary disclosure, and cooperation with the Board are likely to be treated as mitigating factors.