Monetary Penalty
The money the Data Protection Board can order a person to pay after finding a breach.
A monetary penalty is a sum of money the Data Protection Board orders a person to pay after finding a significant breach of the Act or Rules. The Schedule sets the upper limit for each kind of breach.
Meaning of Monetary Penalty
The Schedule sets the maximum amounts. The Board decides the actual sum after an inquiry, considering factors such as the nature, gravity and duration of the breach, the type of data, repeated breaches, steps to reduce the harm and the likely impact of the penalty. Penalties are paid into the Consolidated Fund of India.
Section 33 is the penalty provision. It says that if the Board determines, at the conclusion of an inquiry, that a breach of the Act or the Rules is significant, it may, after giving the person an opportunity of being heard, impose a monetary penalty specified in the Schedule. Two gates therefore stand before every penalty: the breach must be found to be significant, and the person must be heard. Not every technical lapse will lead to a penalty.
The amount is not formulaic. Section 33(2) lists seven factors: the nature, gravity and duration of the breach; the type and nature of the personal data affected; whether the breach was repeated; whether the person realised a gain or avoided a loss; whether the person took action to mitigate the effects and how timely and effective it was; whether the penalty will be proportionate and effective, having regard to the need to secure compliance; and the likely impact of the penalty on the person. The last factor means the same breach may draw different amounts from a small business and a large conglomerate.
The penalty is different from other consequences. It is not damages for the people harmed; Section 34 credits all sums to the Consolidated Fund of India. It is also separate from the Board's power to issue directions, from criminal law and from civil remedies under other statutes. Section 39 bars civil courts from deciding matters the Board can decide, so a penalty challenge goes by appeal to the Appellate Tribunal under Section 29, within sixty days, rather than to a civil court.
A person who gives and keeps a voluntary undertaking under Section 32 can avoid proceedings on the matter covered by it, so a penalty is generally not the first outcome for an organisation that acts early and openly. A repeat pattern, on the other hand, is a statutory factor and also matters under Section 37: if the Board has penalised a fiduciary in two or more instances, it can advise the Central Government to block public access to the services through which it operates.
Examples of Monetary Penalty
After an inquiry, the Board fines a company for failing to secure customer data. The company may appeal.
A health-tech company suffers a data leak because a storage bucket was left open. It reports to the Board promptly, closes the gap within a day and commissions an independent review. These steps are the kind of mitigation the Board must weigh when deciding the amount.
A small marketing agency repeatedly mails lists without checking consent and ignores two complaints. Because the breach is repetitive and the agency made gains from it, those two factors would count against it, even though its capacity to pay is limited.
A bank subsidiary that failed to report a breach receives a Board notice. Its counsel prepares a response showing the detection time and the fix, and considers offering an undertaking, since a penalty could also lead to regulator scrutiny from RBI.
Why Monetary Penalty matters
The financial exposure can be very large: up to ₹250 crore for security safeguard failures and up to ₹200 crore for failing to report a breach, and a single incident can engage more than one category. But the penalty is only part of the cost. An inquiry brings legal fees, management time, reporting to customers, loss of trust and, for regulated entities, parallel scrutiny from RBI, IRDAI, SEBI or other regulators.
For individuals, the lesson runs the other way. A penalty on the company does not put money in the Data Principal's hands, so complaints should be made to get a correction or erasure or a changed practice, not in the expectation of compensation from the Board.
How it works in practice
- 1Build an evidence file before there is any problem: security policies, access reviews, test results, training logs, vendor contracts and breach drills. These are the documents the Board will examine on the questions of gravity and mitigation.
- 2If an incident occurs, act on all three fronts at once: contain it, notify the Board and affected Data Principals under Section 8(6) and Rule 7, and keep a time-stamped log of each action taken.
- 3When a notice from the Board arrives, appoint a response lead, gather facts, and prepare a written reply. Consider whether a voluntary undertaking under Section 32 is appropriate.
- 4If a penalty order is made, check the appeal period of sixty days under Section 29 and decide promptly with counsel whether to appeal. File the appeal digitally as Rule 22 describes.
- 5After any order, run a lessons-learned review and change the controls, then record the change so that a repeat is not found to be "repetitive" in the Section 33(2) sense.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming the headline figure is what will be charged. The Schedule gives ceilings and the Board fixes the amount after considering seven factors.
Thinking a penalty can be imposed without a hearing. Section 33(1) requires an opportunity of being heard.
Expecting the penalty to compensate affected individuals. It goes to the Consolidated Fund of India.
Missing the sixty-day appeal window under Section 29, which can be extended only for sufficient cause.
Compliance tips
Document your reasoning for each safeguard. A written risk assessment is persuasive evidence that your measures were reasonable.
Notify early and accurately; delay is itself a breach with its own ceiling.
Review the factors in Section 33(2) in your post-incident reports so the facts are captured while memory is fresh.
Do not make public admissions before legal review, but do not delay notifications required by law.
Common questions about Monetary Penalty
Who decides the penalty under the DPDP Act?
The Data Protection Board of India, after an inquiry and a hearing, under Section 33. The Board applies the Schedule ceilings and the Section 33(2) factors. Its order can be appealed to the Appellate Tribunal within sixty days.
Will a small business pay the same penalty as a large company?
Not necessarily. The Schedule fixes only the maximums, and the Board must consider the likely impact of the penalty on the person, proportionality and the nature of the breach. Those factors allow different outcomes.
Can I be penalised for a minor mistake?
A penalty needs a breach that the Board finds significant. Small, quickly fixed lapses may be resolved through directions or a voluntary undertaking, but nothing is guaranteed, so documenting your fix matters.