Data PrivacyPenalties under the Digital Personal Data Protection Act,2023

(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:—

(a) the nature, gravity and duration of the breach;

(b) the type and nature of the personal data affected by the breach;

(c) repetitive nature of the breach;

(d) whether the person, as a result of the breach, has realised a gain or avoided any loss;

(e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;

(f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and

(g) the likely impact of the imposition of the monetary penalty on the person.

THE SCHEDULE [See section 33 (1)]

Breach of provisions of this Act or rules made thereunder  –

1.Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8.- May extend to two hundred and fifty crore rupees.

2.Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8- May extend to two hundred crore rupees.-May extend to two hundred crore rupees.

3.Breach in observance of additional obligations in relation to children under section 9.-May extend to two hundred crore rupees.

4. Breach in observance of additional obligations of Significant Data Fiduciary under section 10.-May extend to one hundred and fifty crore rupees.

5.Breach in observance of the duties under section 15.-May extend to ten thousand rupees.

6. Breach of any term of voluntary undertaking accepted by the Board under section 32.-Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted.

7.Breach of any other provision of this Act or the rules made thereunder.- May extend to fifty crore rupees.

The business entities need to understand their data flow, data consents, data processing records and data storage so that the unforeseen liabilities of hefty penalty can be avoided under DPDPA,2023.

Specific Penalties for Data Fiduciaries

The Digital Personal Data Protection Act, 2023, outlines stringent penalties for Data Fiduciaries (entities responsible for processing personal data) who fail to comply with its requirements. These penalties are primarily based on non-compliance with consent management, data processing principles, and safeguarding personal data. The penalties can extend up to Rs250 crores, depending on the severity of the violation. Specific violations include failure to obtain valid consent, misuse of data, improper data retention, and failure to implement security measures, which could lead to breaches and substantial fines.

Data Fiduciaries must regularly audit their compliance frameworks, implement strong privacy practices, and ensure transparent data handling procedures. Non-compliance, particularly around data breach reporting, could result in fines, legal liabilities, and reputational damage. Maintaining strict data governance protocols is essential to avoid penalties and protect personal data in line with DPDPA 2023 guidelines.

Avoiding Penalties under DPDPA 2023

To further safeguard your organization, it’s crucial to maintain comprehensive data processing records, ensure appropriate consents, and implement robust security measures. Proactively conducting regular audits and assessments can mitigate the risk of incurring significant fines under the DPDPA, 2023.

To know more about the issues discussed above, You may please connect with dataprivacy@amlegals.com or mridusha.guha@amlegals.com.