Data protection · Provision
The Board fixes the amount against the Schedule, where the ceiling for a security-safeguards failure is ₹250 crore. (Section 33, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Under Section 33 of the DPDP Act 2023, the Data Protection Board of India (DPBI) is empowered to impose monetary penalties set by the Schedule, up to ₹250 crore for the most serious head. Penalties are determined based on the nature, gravity, duration, repetitive character of the breach, and mitigation steps taken, with the highest penalties reserved for security safeguard failures and failure to notify personal data breaches.
33. Penalties.— (1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule. (2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:— (a) the nature, gravity and duration of the breach; (b) the type and nature of the personal data affected by the breach; (c) repetitive nature of the breach; (d) whether the person, as a result of the breach, has realised a gain or avoided any loss; (e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action; (f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and (g) the likely impact of the imposition of the monetary penalty on the person.
| Contravention Category | Governing Section | Maximum Statutory Penalty | Statutory Focus & Enforcement |
|---|---|---|---|
| Failure to take reasonable security safeguards to prevent data breach | Section 8(5) | Up to ₹250 Crore | Inadequate encryption, missing MFA, unpatched systems |
| Failure to notify Board & affected users of personal data breach | Section 8(6) | Up to ₹200 Crore | Concealing or delaying breach disclosure |
| Non-fulfillment of obligations in relation to children | Section 9 | Up to ₹200 Crore | Tracking, behavioural monitoring & unverified parental consent |
| Breach of obligations of Significant Data Fiduciary | Section 10 | Up to ₹150 Crore | Failure to appoint India DPO, conduct DPIA or independent audit |
| Breach of the duties of a Data Principal | Section 15 | Up to ₹10,000 | Impersonation, or a false or frivolous complaint |
| Breach of a voluntary undertaking accepted by the Board | Section 32 | Up to the amount for the breach the proceedings were about | Failing to keep the terms the Board accepted |
| Breach of any other provision of the Act or the Rules | Residuary head | Up to ₹50 Crore | Includes the rights in sections 11 to 13, such as ignoring an access or erasure request |
up to ₹250 crore. A ceiling for the most serious head, not an amount owed automatically. The Board fixes the figure case by case.
The Schedule provides up to ₹250 crore for a failure to take reasonable security safeguards to prevent a personal data breach. Other heads carry their own ceilings, including up to ₹200 crore for failing to notify a breach.
No. It is a maximum. Section 33(2) requires the Board to fix the amount having regard to the nature, gravity and duration of the breach, the data affected, repetition, gain or loss avoided, mitigation and proportionality.
The Data Protection Board of India, at the conclusion of an inquiry, and only where it determines that the breach is significant.
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 33 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.