Back to Module
2 of 6|Penalties & Enforcement
reading 15 min•Penalty Framework
Fine Calculation
How does the Board decide the exact fine amount?
🎯 Learning Objectives
- ▸ Understand the factors considered for fine calculation
- ▸ Analyze the principle of proportionality
Factors Considered
Under Section 33, the Board must consider the following factors before imposing a penalty:
- • Nature, gravity, and duration of the breach.
- • The number of Data Principals affected.
- • Whether the breach was repetitive.
- • Whether the company took corrective action.
- • Whether the breach was foreseeable.
- • Whether the company gained financially from the breach.
Proportionality
The penalty must be proportionate. If a small startup accidentally exposes 100 records due to a minor bug and fixes it immediately, the fine will be minimal. But if a large bank ignores known vulnerabilities and exposes 10 million records, the fine will be massive.
📖 Glossary
- Proportionality
- The principle that a penalty should be proportionate to the seriousness of the violation.
🔑 Key Takeaways
- The Board looks at the nature and gravity of the breach.
- The number of affected Data Principals is a key factor.
- Corrective action taken by the company can reduce the fine.
📚 Further Reading
- DPDPA Section 33 — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...