Home/DPDP Act/Chapter VIII — Penalties and Adjudication

DPDP Act, 2023 · Chapter VIII of IX

Chapter VIII: Penalties and Adjudication

Chapter VIII is the money chapter: how penalties are decided and where they go. The maximum amounts themselves sit in the Schedule to the Act.

Sections 33–34 · 2 sectionsAll 2 sections effective 13 May 2027Reviewed September 2026

Back to the Full DPDP Act Guide Chapter IX — Miscellaneous

Chapter summary

In plain terms: Section 33 lets the Board impose a monetary penalty after an inquiry, up to the amount listed in the Schedule for the breach concerned, having regard to factors such as the nature, gravity and duration of the breach, the type of data affected, whether it repeats, any mitigation, and proportionality. Section 34 sends the sums realised to the Consolidated Fund of India.

How the sections fit together

Chapter VIII has two sections but connects to the Schedule at the end of the Act. Section 33 allows the Board to impose a penalty after inquiry, up to the amount the Schedule lists for the breach, and sets the factors it must weigh. Section 34 sends the money to the Consolidated Fund of India.

The practical reading is that penalties scale with conduct. The same breach can lead to very different outcomes depending on how serious it was, how long it lasted, what data was involved, whether it was repeated and how quickly the organisation responded.

Sections at a glance

Sections 33–34 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 33PenaltiesEffective 13 May 2027

Section 33 is where a Board inquiry can end in real financial consequence — monetary penalties up to the ceilings set in the Act's own Schedule, determined only after a hearing and only by weighing seven specific factors, from the breach's gravity to its actual deterrent impact on the person penalised.

Read the full explanation Sec. 34Crediting Sums Realised by Way of Penalties to Consolidated Fund of IndiaEffective 13 May 2027

Section 34 is a single, simple sentence: every rupee the Board collects in penalties goes to the Consolidated Fund of India, not to the Board itself or to any complainant.

Read the full explanation

Penalty ceilings in the Schedule

Section 33 works with the Schedule to the Act. These are maximum amounts. The Board decides the actual penalty after an inquiry.

Breach	Maximum penalty
Failure to take reasonable security safeguards to prevent a personal data breach	Up to ₹250 crore
Failure to give the Board or affected Data Principals notice of a personal data breach	Up to ₹200 crore
Breach of the additional obligations in relation to children	Up to ₹200 crore
Breach of the additional obligations of a Significant Data Fiduciary	Up to ₹150 crore
Breach of the duties of a Data Principal	Up to ₹10,000
Breach of the terms of a voluntary undertaking accepted by the Board	Up to the amount applicable to the matter the undertaking covered
Breach of any other provision of the Act or Rules	Up to ₹50 crore

Key terms in this chapter

Schedule: The table at the end of the Act listing the maximum penalty for each category of breach.
Maximum penalty: The ceiling the Board cannot exceed. It is not a fixed or default amount.
Mitigation: Steps taken to reduce harm after a breach, which the Board must consider.
Consolidated Fund of India: The government account into which sums realised as penalties are credited.

Why this chapter matters

The headline numbers — up to ₹250 crore for failing to maintain reasonable security safeguards, and up to ₹200 crore for failing to report a breach or to meet obligations about children's data — are what bring DPDP compliance to board-level attention. They are ceilings, not fixed fines, and the factors in Section 33 mean good-faith efforts and quick mitigation are weighed.

Who needs to care about this chapter

Boards, CFOs and risk teams sizing exposure.
Compliance leaders building the business case for a DPDP programme.
Legal teams advising on breach response and mitigation.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

Map each Schedule category to the processes and controls that guard against it.
Document security safeguards so you can show them if a breach occurs.
Record mitigation steps with timestamps after any incident.
Brief the board and senior management on the ceiling for each category.
Review repeat-incident risk, since repetition is a factor in assessing penalties.

Common mistakes to avoid

Reading the highest figure as the standard fine.
Treating penalty exposure as only a security-team issue. Notification and children's data failures also carry high ceilings.
Overlooking that individuals can be penalised too, for breach of their duties.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 7 — Intimation of Personal Data Breach

Read the Rule

Rule 6 — Reasonable Security Safeguards

Read the Rule

Common questions

Is ₹250 crore a fixed fine?

No. It is the maximum the Schedule allows for one category of breach. The Board decides the actual amount after an inquiry, considering the factors listed in Section 33.

Where do DPDP penalties go?

Section 34 provides that sums realised as penalties are credited to the Consolidated Fund of India. They are not paid to the complainant.

Can penalties be reduced by acting quickly after a breach?

Mitigation steps taken by the Data Fiduciary are among the factors the Board must consider, so prompt action can influence the outcome.

Who decides the amount of a penalty?

The Board, after an inquiry and a chance for the person to be heard, within the ceiling in the Schedule and having regard to the Section 33 factors.

Are there penalties apart from those in the Schedule?

Breach of a voluntary undertaking the Board has accepted can also be penalised, up to the amount applicable to the matter it covered.

Can penalties be appealed?

Yes. Orders of the Board, including penalty orders, can be appealed to the Appellate Tribunal under Chapter VII.

What's the maximum penalty the Board can impose?

It depends on the category of breach, per the Act's Schedule - the highest ceiling, for failing to take reasonable security safeguards to prevent a breach, is up to ₹250 crore. See DPDP Penalties for the full table.

Does every breach of the Act result in a monetary penalty?

No - sub-section (1) only authorises a penalty where the Board has determined the breach is significant, following an inquiry and a hearing.

Does the Data Protection Board keep the penalties it collects?

No - this section requires all penalty amounts to be credited to the Consolidated Fund of India, the government's general treasury, not retained by the Board.

Do affected Data Principals receive any share of a penalty imposed on a Data Fiduciary?

No - the penalty goes to the Consolidated Fund of India, not to the individuals affected by the breach; it functions as a regulatory sanction rather than a compensation mechanism.