Chapter 8 · Penalties & Adjudication
Section 33 - Penalties
Financial penalties up to ₹250 crore per breachThis is the enforcement backbone of the Act.
Download full Act (PDF)In plain English
This is the enforcement backbone of the Act. If the Board concludes after an inquiry that a person's breach is significant, it can - after giving them a hearing - impose the monetary penalties set out in the Schedule, which run up to ₹250 crore for failing to keep data secure. In fixing the amount, the Board weighs the nature, gravity and duration of the breach, whether it was repeated, any gain made or loss avoided, and what steps the person took to mitigate it.
A company that suffers a breach because it skipped basic security safeguards can face a penalty of up to ₹250 crore.
Key points
- The Board imposes the monetary penalties listed in the Schedule for significant breaches.
- The top penalty is up to ₹250 crore, for failure of reasonable security safeguards.
- A penalty follows only after an inquiry and an opportunity to be heard.
- The amount reflects gravity, duration, repetition, gain or loss, and mitigation.
Official section text
Section 33. Penalties.
If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.
While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely: -
the nature, gravity and duration of the breach;
the type and nature of the personal data affected by the breach;
repetitive nature of the breach;
whether the person, as a result of the breach, has realised a gain or avoided any loss;
whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and
the likely impact of the imposition of the monetary penalty on the person.