Section 33: Penalties

Statutory Text (Official Gazette)

(1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.

(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:

• (a) the nature, gravity and duration of the breach;
• (b) the type and nature of the personal data affected by the breach;
• (c) repetitive nature of the breach;
• (d) whether the person, as a result of the breach, has realised a gain or avoided any loss;
• (e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
• (f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and
• (g) the likely impact of the imposition of the monetary penalty on the person.

What Section 33 Means in Plain English

Section 33 outlines the exact criteria the Data Protection Board of India uses to calculate financial penalties. Fines are not arbitrary; the Board evaluates seven specific operational factors:

1. How serious was the breach? The duration of the exposure and how many individuals were affected.
2. What kind of data leaked? Leaking sensitive financial, health, or children’s data results in significantly harsher fines than basic public directory information.
3. Is your company a repeat offender? First-time technical slips with proactive disclosure receive far lower penalties than repeat violations.
4. Did your business profit from the violation? Unlawful monetization of user data triggers higher financial clawbacks.
5. How fast did you act to fix it? Organizations that promptly detect, contain, notify, and patch vulnerabilities receive statutory mitigation credit under clause (e).
6. Is the fine proportionate and effective? The fine must be large enough to deter, but no more than needed.
7. What will the fine do to you? The Board must consider the likely impact of the penalty on the person, which matters most for small businesses.

Where the Money Goes (Section 34)

Under Section 34, all penalties go to the Consolidated Fund of India. The DPDP Act does not provide compensation to affected users; the Board can fine a business but cannot order it to pay users.

Hearing Required

The Board can only fine a breach it finds “significant”, and only after giving the business a chance to be heard. Under Section 32, a business can also offer a voluntary undertaking at any stage of an inquiry, which bars further proceedings on the matters it covers.

How to Protect Your Organization

To demonstrate proactive compliance and mitigate penalty exposure under Section 33(2)(e):

• Maintain continuous audit logs: Keep cryptographic records proving when notices were shown, when consent was granted, and how cookies were controlled.
• Run regular vulnerability & tracking audits: Use automated scanning tools to detect unauthorized tracker injection before external auditors or regulators find them.
• Document breach response drills: Maintain an auditable incident log demonstrating rapid containment procedures.