Lesson 9.3: Penalties and how they are decided
Know the numbers and the factors. This DPDPA 2023 course page explains penalties and how they are decided in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about penalties and how they are decided
- Memorise the penalty table
- Know the factors the Board weighs
- Understand that penalties are per breach
Section 33 and the Schedule (penalties and how they are decided)
The Board decides after an inquiry that a breach is significant. In fixing the amount it considers the nature, gravity and duration of the breach, the type and nature of the data, repetitive nature, whether the fiduciary realised a gain or avoided a loss, whether it took action to mitigate, whether the penalty is proportionate and effective, and the likely impact on the person on whom it is imposed.
Penalty ladder: click each
Select a numbered box to read more.
Mitigating and aggravating factors (penalties and how they are decided)
| Mitigating | Aggravating |
|---|---|
| Quick notice to the Board | Concealing the breach |
| Strong prior safeguards | No safeguards |
| Cooperation | Repeat offence |
| Early fix | Gain from misuse |
Worked example
Two firms have similar leaks. One had safeguards and reported fast. The other hid it for weeks. The outcomes differ sharply.
Activity (5 minutes) (penalties and how they are decided)
Write down your three strongest mitigating records.
Check your understanding of penalties and how they are decided
Q1. Highest penalty applies to:
Q2. Penalty factors include:
Q3. Breach notification failure up to:
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.