Section 33 — Penalties

What this section requires

If the Board concludes, on an inquiry, that a breach of the Act or its Rules is significant, it can — after a hearing — impose the monetary penalty the Schedule specifies for that breach. In fixing the amount within the Schedule's ceiling, the Board must weigh: the breach's nature, gravity and duration; the type and sensitivity of the personal data involved; whether the breach was repeated; whether the person gained or avoided a loss because of it; whether and how effectively the person mitigated it; whether the penalty is proportionate and would actually deter future breaches; and the penalty's likely impact on the person.

Who it applies to

Any person the Board has found, after inquiry, to have significantly breached the Act or Rules — most directly, Data Fiduciaries, Data Processors, and Consent Managers.

Checklist

• Know the Schedule's seven penalty items and which section each maps to — Section 8(5) security safeguards (up to ₹250 crore), Section 8(6) breach notification (up to ₹200 crore), Section 9 children's data (up to ₹200 crore), Section 10 SDF obligations (up to ₹150 crore), Section 15 Data Principal duties (up to ₹10,000, on the Data Principal), Section 32 voluntary-undertaking breach (tied to the original breach), and any other provision (up to ₹50 crore).
• Document mitigation steps taken after any breach — sub-section (2)(e) makes timely, effective mitigation something the Board must actually weigh in fixing the amount.
• Don't assume a first-time or minor breach automatically draws the Schedule ceiling — gravity, repetition, and proportionality are all statutory factors the Board must consider, not just the maximum figure.

Penalty exposure

This section is the penalty mechanism itself; the seven specific figures live in the Schedule referenced above and were already extracted precisely for this guide's penalties overview.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).