DPDP penalties for data fiduciaries

The Schedule in one table

The Schedule to the Act sets a maximum penalty for each instance of breach. The Board decides the actual amount after an inquiry.

How the Board decides the amount (s.33(2))

The amounts are ceilings, not fixed fines. The Board inquires, gives the person a hearing, and then decides whether to impose a penalty and how much. Under s.33(2) it considers:

• the nature, gravity and duration of the breach;
• the type of personal data affected;
• whether the breach is repeated;
• whether the person gained, or avoided a loss, from the breach;
• any action taken to mitigate the breach, and how timely and effective it was;
• whether the penalty is proportionate and effective; and
• the likely impact of the penalty on the person.

What this means for leadership

• Security and breach response carry the highest ceilings. Reasonable safeguards (s.8(5), Rule 6) and timely intimation (s.8(6), Rule 7) are where to invest first.
• Children's data and SDF status add exposure. If you process children's data (s.9) or are designated a Significant Data Fiduciary (s.10), those duties have their own Schedule items.
• The catch-all item is not small. Breaching any other provision, such as notice, consent or grievance redressal, can attract up to ₹50 crore.
• Evidence counts. The fiduciary must prove notice and consent (s.6(10)), and mitigation is a s.33(2) factor, so keep records as you go.

Questions for your next leadership review

• Do we know where personal data sits and who can reach it? Rule 6 expects access control, logs and monitoring.
• Could we intimate the Board and every affected person without delay, and send the Board a detailed report within 72 hours (Rule 7)?
• Do we process children's data, and how do we get a parent's verifiable consent (s.9(1), Rule 10)?
• Can we show, for any customer, the notice they saw and the consent they gave (s.6(10))?
• Who owns each of these duties, and when did we last test them?

Undertakings and appeals

Section 32 provides for a voluntary undertaking that the Board may accept. Breaching an accepted undertaking can attract a penalty up to the amount that applied to the breach it covered.

A person aggrieved by a Board order can appeal to the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (s.29, Rule 22). The detailed penalty guide walks through each step, and the penalties FAQ answers common questions.

How TruePrivacy helps

TruePrivacy helps you build the evidence that matters under s.33(2). Breach management records when you became aware, runs a risk assessment, and tracks the clocks for the Board and each affected Data Principal. Data security posture shows issues and open access across your stores, with a remediation flow.

Consent records and the audit trail support s.6(10), and the SDF workspace tracks s.10 duties if you are designated. The penalty explainer maps common failures to the Schedule.