Section 34 — Crediting Sums Realised by Way of Penalties to Consolidated Fund of India

Section 34 is the shortest operative provision in the Act, and it does exactly one thing: every sum the Data Protection Board realises as a penalty under Section 33 is credited to the Consolidated Fund of India. Nothing in the text carves out any share for the Data Principal whose complaint triggered the inquiry in the first place.

Why this is easy to assume otherwise

A lot of people's mental model of "you complain, the company is fined, you get something" comes from consumer-protection proceedings or from how compensation works in other legal systems — the GDPR, for instance, lets a data subject separately sue for compensation under Article 82, alongside whatever a supervisory authority fines a controller. The DPDP Act doesn't build an equivalent right into its own machinery. The Board's remedy under Section 33 is a penalty against the person who breached the Act; it isn't damages awarded to the person who was harmed by the breach.

What a Data Principal actually gets from a Board complaint

A complaint can still get real outcomes — an urgent remedial direction from the Board under its Section 27 powers, or a monetary penalty against the Fiduciary that deters the same conduct going forward. What it doesn't get the complainant is a share of that penalty. If a Data Principal wants personal compensation for harm suffered, that has to come from a separate route entirely — a route the Act doesn't foreclose, but doesn't provide either.

Why this matters in practice

This shapes how an organisation should actually think about complaint risk. A Board complaint isn't primarily a financial claim against you from the individual who filed it — the individual has no direct financial stake in the outcome beyond whatever remedial direction addresses their specific situation. The financial exposure sits entirely between the organisation and the Board, scaled by the Schedule and the seven factors in Section 33(2). Framing internal risk assessments around "what could this complainant recover from us" misreads how the Act is actually built.

Illustration: a Data Principal complains that a company failed to notify her of a breach affecting her financial data, as Section 8(6) requires. If the Board finds the breach and imposes a ₹40 crore penalty, that money goes to the Consolidated Fund of India in full. The Data Principal's own outcome is whatever remedial direction the Board separately issues on her specific grievance — not any portion of the ₹40 crore.

How Section 34 connects to the rest of the Act

Section 33 is where the penalty this section talks about actually gets set. Section 39 reinforces the same point from a different angle — it bars civil courts from entertaining any suit over a matter the Board is empowered on, so a complainant can't route around Section 34 by asking a court for damages instead. Section 38 is the provision that keeps this from being the end of the story: it preserves whatever other laws a Data Principal might separately rely on for a damages claim, meaning that route exists outside the DPDP Act's own machinery, not inside it.