Section 33: Penalties
Section 33 is where a Board inquiry can end in real financial consequence — monetary penalties up to the ceilings set in the Act's own Schedule, determined only after a hearing and only by weighing seven specific factors, from the breach's gravity to its actual deterrent impact on the person penalised.
Quick summary
What Section 33 says
- Sub-section (1) — if the Board determines, on concluding an inquiry, that a breach of the Act or rules by a person is significant, it may, after giving that person an opportunity of being heard, impose such monetary penalty as specified in the Schedule.
- Sub-section (2) — in determining the amount of monetary penalty to be imposed, the Board shall have regard to the following factors:
- Factor (a) — the nature, gravity and duration of the breach.
- Factor (b) — the type and nature of the personal data affected by the breach.
- Factor (c) — the repetitive nature of the breach.
- Factor (d) — whether the person, as a result of the breach, has realised a gain or avoided any loss.
- Factor (e) — whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of that action.
- Factor (f) — whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the Act's provisions.
- Factor (g) — the likely impact of imposing the monetary penalty on the person.
Breaking it down
The “significant” threshold is a gate before any penalty question arises at all. Sub-section (1) only authorises a penalty where the Board has determined the breach is significant — not every technical non-compliance automatically leads to a monetary penalty; the Board first has to reach that significance finding.
A hearing is mandatory before any penalty is imposed. This is consistent with the natural-justice requirements running throughout the Board's process under Section 28 — the penalty stage specifically requires its own opportunity to be heard before an amount is actually set.
The Schedule sets the outer ceilings, not fixed amounts. The Act's own Schedule (linked from Section 33(1)) lists seven categories of breach with maximum penalties — from ₹250 crore for failing to take reasonable security safeguards, down to ₹10,000 for a Data Principal's own duty breach under Section 15 — but the Board determines the actual amount within that ceiling using the seven factors in sub-section (2), not a fixed formula.
The seven factors split into backward-looking and forward-looking considerations. Factors (a) through (d) look at what actually happened — the breach's severity, what data was affected, whether it recurred, and whether the person profited or avoided loss. Factors (e) through (g) look at response and consequence — how well the person responded once the breach occurred, whether the penalty amount actually serves its deterrent purpose, and what impact it would realistically have on that particular person or organisation.
Factor (g) means the same breach could draw a different penalty from different-sized organisations. Considering “the likely impact of imposing the monetary penalty on the person” builds in a degree of proportionality to the person's own capacity to absorb the penalty, rather than applying a purely mechanical, one-size-fits-all calculation.
Why this section matters
Section 33 is where the Act's obligations meet real financial stakes, and understanding the seven-factor test matters for two audiences: organisations trying to gauge their actual exposure if something goes wrong, and organisations that have already had a breach and are deciding how to respond — since factor (e)'s weight on mitigation timeliness and effectiveness means a fast, genuine remedial response can meaningfully affect the eventual penalty.
Real-world example
How the same type of breach could lead to different outcomes
Two companies each suffer a security-safeguard breach exposing customer data (the Schedule's highest-ceiling category, up to ₹250 crore).
- Company A — detects the breach quickly, intimates the Board and affected customers promptly, deploys an effective fix within days, and has no history of prior breaches. Under factors (c) and (e), this responsiveness and clean history would likely weigh toward a lower penalty within the ceiling.
- Company B — has had two prior similar breaches, took weeks to even notice this one, and shows no evidence of an effective remedial response. Under factors (c) and (e), this repetitive pattern and poor mitigation would likely weigh toward a penalty much closer to the statutory ceiling.
- In both cases — the Board still has to give each company a hearing under sub-section (1) before finalising any penalty amount.
Who needs to care about this section
- Boards and senior leadership assessing regulatory risk — the Schedule's ceilings and the seven-factor test together define the outer bounds and likely shape of financial exposure.
- Incident-response teams — factor (e)'s emphasis on timely, effective mitigation is a direct, concrete incentive to respond to a breach quickly and genuinely, not just for its own sake but because it can affect the eventual penalty.
- Legal teams preparing for a Board hearing on penalty — understanding which of the seven factors are most favourable or unfavourable to a specific case shapes how to present it.
Common questions
What's the maximum penalty the Board can impose?
Does every breach of the Act result in a monetary penalty?
Does responding quickly to a breach actually reduce the eventual penalty?
Related sections
Section 34 — Crediting Sums Realised by Way of Penalties to Consolidated Fund of India
Continue to the next section in sequence.
Read Section 34Section 32 — Voluntary Undertaking
Go back to the previous section.
Read Section 32Chapter VIII — Penalties and Adjudication
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsDPDP Penalties
The full penalty table by breach category, and how the enforcement process leads up to a penalty.
See the full penalty table