The Board may impose a monetary penalty only after an inquiry finds a significant breach and after hearing the person (section 33). The amounts in the Schedule are maximums (“may extend to”). The Central Government may amend the Schedule, but not to more than twice the original amounts (section 42).
The Schedule, quoted exactly
| Sl. No. | Breach of provisions of this Act or rules made thereunder | Penalty |
|---|---|---|
| 1. | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to two hundred and fifty crore rupees. |
| 2. | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach, under sub-section (6) of section 8. | May extend to two hundred crore rupees. |
| 3. | Breach in observance of additional obligations in relation to children under section 9. | May extend to two hundred crore rupees. |
| 4. | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to one hundred and fifty crore rupees. |
| 5. | Breach in observance of the duties under section 15. | May extend to ten thousand rupees. |
| 6. | Breach of any term of voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. |
| 7. | Breach of any other provision of this Act or the rules made thereunder. | May extend to fifty crore rupees. |
What the Board must consider
- The nature, gravity and duration of the breach.
- The type and nature of the personal data affected.
- Whether the breach is repetitive.
- Whether the person gained or avoided a loss because of the breach.
- Any action to mitigate, and how timely and effective it was.
- Whether the penalty is proportionate and effective.
- The likely impact of the penalty on the person.
Penalties are credited to the Consolidated Fund of India (section 34). After penalties in two or more instances, the Board may advise the Government to block access (section 37). Section 33 and the Schedule come into force on 13 May 2027.