Penalties under the Schedule to the Act

Section 33(1) of the Act provides that, where the Data Protection Board of India determines after inquiry that a breach of the Act or the Rules is significant, it may impose a monetary penalty up to the amount specified in the Schedule. The Schedule lists seven classes of breach, each with its own ceiling.

The ceilings

• Breach of the obligation to take reasonable security safeguards, under Section 8(5): up to two hundred and fifty crore rupees.
• Breach of the obligation to give notice of a personal data breach to the Board and to affected data principals, under Section 8(6): up to two hundred crore rupees.
• Breach of the additional obligations in relation to children, under Section 9: up to two hundred crore rupees.
• Breach of the additional obligations of a Significant Data Fiduciary, under Section 10: up to one hundred and fifty crore rupees.
• Breach of the duties of a data principal, under Section 15: up to ten thousand rupees.
• Breach of any term of a voluntary undertaking accepted by the Board, under Section 32: up to the extent applicable for the breach in respect of which the proceedings were instituted.
• Breach of any other provision of the Act or the Rules: up to fifty crore rupees.

What the Board must weigh

Section 33(2) sets the factors the Board must have regard to in deciding the amount of a penalty: the nature, gravity and duration of the breach; the type and nature of the personal data affected; whether the breach is repetitive; whether the person gained, or avoided a loss, as a result of the breach; whether the person took action to mitigate the effects and consequences of the breach, and how promptly; whether the penalty is proportionate and effective; and the likely impact of the penalty on the person.

A note on reading these figures

The amounts are ceilings, not tariffs. They mark the outer limit for each class of breach and say nothing about what a particular breach will attract. No penalty has been imposed under the Act as at the date of this note, and the Forum publishes no projection of what a first penalty might be. The figures matter for a different reason: they are a statement by Parliament of the relative weight it attaches to each obligation, and security safeguards sit at the top of that order.

Back to the Bulletin, or read the standards.