Penalties, and the Schedule That Fixes Them

In one line

The Board may impose a monetary penalty from the Schedule where it finds a breach significant, weighing seven listed matters, and every rupee goes to the Consolidated Fund of India rather than to the person harmed.

Section 33(1): when a penalty may be imposed

"If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule."

Four conditions, and each does work.

"On conclusion of an inquiry." So the section 28 process must be complete.

"Is significant." A threshold. Not every breach attracts a penalty; only a significant one. The word is not defined, and the section 33(2) factors are how the Board will give it content.

"It may." Discretionary even where the breach is significant.

"After giving the person an opportunity of being heard." The fourth hearing requirement, chapter 1330.

Section 33(2): the seven matters

In determining the amount the Board shall have regard to:

• (a) the nature, gravity and duration of the breach;
• (b) the type and nature of the personal data affected by the breach;
• (c) repetitive nature of the breach;
• (d) whether the person, as a result of the breach, has realised a gain or avoided any loss;
• (e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
• (f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and
• (g) the likely impact of the imposition of the monetary penalty on the person.

Three observations.

Factor (b) brings sensitivity back for a third time. The Act has no category of sensitive personal data, chapter 1160, yet the type and nature of the data matters to the Significant Data Fiduciary designation under section 10(1)(a), chapter 1280, and to the quantum of penalty here. So sensitivity governs the regulatory response while remaining absent from the substantive rules.

Factor (f) writes proportionality into the statute, and it is the only place the word appears. It ties the penalty to the twin aims of securing observance and deterring breach.

Factor (g) is the ability-to-pay factor. "The likely impact ... on the person" allows the Board to scale a penalty to a small enterprise, which matters because the Schedule figures are absolute rather than turnover-linked.

The list has no mention of harm to the Data Principal. Factor (a) covers the gravity of the breach and factor (b) the type of data, but nothing directs the Board to the consequences for the individual, and nothing gives her anything. See below.