Section 33 — Penalties

Section 33 is where the Act's obligations turn into a number. Once the Board concludes an inquiry — the process Section 28 governs — and determines that a breach of the Act or its rules is significant, it can impose a monetary penalty, but only after giving the person an opportunity of being heard. That word "significant" matters: the section doesn't make every technical lapse punishable at scale, it gives the Board a threshold judgement to make first, before any figure gets attached.

The seven factors behind the number — 33(2)

The Schedule sets a ceiling; Section 33(2) is what decides where under that ceiling the Board actually lands. It has to have regard to: the nature, gravity and duration of the breach; the type and sensitivity of the personal data involved; whether the breach is part of a repeated pattern; whether the person gained an advantage or avoided a loss because of it; whether — and how quickly and effectively — the person acted to mitigate the breach's effects; whether the penalty under consideration is actually proportionate and likely to deter future breaches, not just punitive for its own sake; and the impact the penalty itself would have on the person being fined. None of these factors raises the Schedule's ceiling — they only decide how close to it the Board goes.

What the Schedule actually caps

The Schedule, referenced directly in 33(1), sets seven entries. It's worth being precise here, because a fair amount of secondary commentary online gets two of these figures backwards:

• Up to ₹250 crore — breach of the reasonable-security-safeguards duty under Section 8(5). This is the single highest figure in the Schedule.
• Up to ₹200 crore — breach of the duty to notify the Board and affected Data Principals of a personal data breach, under Section 8(6).
• Up to ₹200 crore — breach of the additional obligations for children's data under Section 9.
• Up to ₹150 crore — breach of the additional obligations owed by a Significant Data Fiduciary under Section 10.
• Up to ₹10,000 — breach of a Data Principal's own duties under Section 15, a figure deliberately several orders of magnitude smaller than anything a Fiduciary faces.
• Breach of any term of a voluntary undertaking accepted by the Board under Section 32 — capped at whatever penalty would have applied to the original breach the undertaking was meant to resolve, not a fixed figure of its own.
• Up to ₹50 crore — the residuary entry, covering breach of any other provision of the Act or its rules not separately listed above.

Note the ordering: security safeguards under 8(5) draws the highest ceiling in the Act, ahead of breach notification under 8(6) and children's-data obligations under Section 9, which are tied at ₹200 crore, and ahead of Significant Data Fiduciary obligations under Section 10 at ₹150 crore. It's an easy pair to transpose if you're working from memory — Section 9 and Section 10 sit at different figures, and getting them swapped changes which risk a board actually treats as the costlier one.

Why this matters in practice

Section 33 is why Section 8 reads as carefully as it does — the Schedule's steepest numbers all trace back to obligations that section creates. A security-safeguards failure under 8(5) can draw a bigger penalty than a mishandled breach notification under 8(6), even though the notification failure is usually the one that becomes public first. That ordering is a signal about what the drafters actually wanted organisations to prioritise: preventing the breach in the first place, over managing it well after the fact — though obviously an organisation needs both.

Illustration: a Significant Data Fiduciary stores customer records without adequate access controls or encryption, and an unauthorised party accesses the database. If the Board's inquiry finds this was a failure of reasonable security safeguards under Section 8(5) — rather than, say, a breach of a Section 10-specific SDF obligation like the DPIA requirement — the applicable Schedule ceiling is ₹250 crore, not ₹150 crore, even though the same organisation happens to also carry SDF status. Which entry applies turns on which obligation was actually breached, not on the category of organisation involved.

How Section 33 connects to the rest of the Act

Section 28 is the inquiry process that has to conclude before Section 33 can be invoked at all. Section 32 gives a person a way to avoid this section entirely, by offering a voluntary undertaking the Board accepts — though breaching that undertaking routes straight back into Section 33 anyway. Section 34 sends whatever penalty the Board imposes here to the Consolidated Fund of India, not to the complainant. Section 37 layers a separate, non-monetary sanction on top of this one — the power to block public access to a Data Fiduciary's services once it has drawn a monetary penalty in two or more instances. And Section 42 gives the Central Government a narrow lever to raise every figure in the Schedule by notification, capped at double the amount originally enacted.