Compliance
Section 33 lets the Board set penalties up to ₹250 crore based on breach severity, so businesses must follow a clear step‑by‑step process to document safeguards, breach response and notification to keep penalties low.
Check your DPDP readiness — free More on the blogThe first task is to create a register of all personal data the business collects, processes and stores, noting the type of data, its source and the purpose of use. A senior officer, typically the Chief Compliance Officer or Data Protection Officer, must own this register. The register should be stored securely and updated whenever new data flows are introduced, ensuring that the board can later demonstrate knowledge of the data landscape during an inquiry.
Next, the business must adopt technical and organisational measures that are reasonable for the data it handles. This includes encryption, access controls, regular patching and staff training. The IT head, together with the Data Protection Officer, should document each safeguard, the rationale for its selection and the date of implementation. Keeping a security‑safeguards log makes it easier to prove compliance if the Board questions the adequacy of the measures.
A written breach‑response plan is mandatory. It should outline the steps to detect, contain, assess and remediate a breach, as well as the communication chain. The plan must assign roles – for example, the IT team handles containment, the legal team drafts notifications and the senior manager authorises public statements. The document should be reviewed annually and any changes recorded in a version‑control register.
If a breach occurs, the Data Protection Officer must inform the Board and, where the breach is significant, the affected persons. The notification must include the nature of the breach, categories of data involved, likely consequences and steps taken to mitigate harm. A template for this notice should be pre‑approved by legal counsel and stored in the breach‑response repository for quick deployment.
Throughout the incident lifecycle, the business should retain all evidence – logs, emails, forensic reports and minutes of internal meetings. This evidence must be organised chronologically and indexed, allowing the Board to assess the nature, gravity and repetition of the breach. The Data Protection Officer is responsible for the evidence archive, ensuring it is immutable and accessible for any Board inquiry.
After a breach is resolved, the organisation must review its security policies and breach‑response plan. Any gaps identified should be addressed, and the changes documented with a clear rationale. The senior management team must sign off on the updated policies, demonstrating that mitigation actions were taken, which the Board will consider when fixing any penalty.
Periodic audits of the data register, security safeguards and breach‑response readiness help prove that the business is not complacent. Audits should be conducted by an independent internal audit function or external consultant, with findings reported to the board. Ongoing staff training on data protection obligations reinforces a culture of compliance and reduces the risk of repetitive breaches, a factor the Board weighs when determining penalties.
Every major decision – from selecting a security tool to deciding not to notify a breach – must be recorded with the reasoning behind it. This decision‑log should capture the factors listed in Section 33, such as the type of data, potential gain avoided and proportionality of the response. Having a clear audit trail demonstrates that the business considered the Board’s criteria, which can lead to a lower monetary figure.
The Board looks at the breach’s nature, gravity, duration, data type, repetition, any gain avoided, mitigation steps taken and whether the amount is proportionate and effective. These factors guide the final figure, which can be up to the schedule ceiling but is not automatic.
Yes. Separate heads in the Schedule apply to different failures – for example, lacking security safeguards and failing to notify the Board each attract their own ceiling. The Board may impose penalties for each head if the breach covers multiple obligations.
Mitigation is a statutory factor. Prompt containment, remedial actions and documented steps to prevent recurrence are weighed by the Board. Effective mitigation can lower the penalty, whereas ignoring it may increase the amount within the ceiling.
The business should have the data register, security‑safeguards log, breach‑response plan, breach notification copies, forensic reports, internal meeting minutes, audit reports and a decision‑log showing how each factor in Section 33 was considered.
Published 20 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.