Case Studies
Real-world examples of how penalties are applied.
🎯 Learning Objectives
- ▸ Analyze hypothetical enforcement scenarios
- ▸ Understand how penalties are applied in practice
Scenario 1: The Negligent Fintech
A fintech company stores customer PAN numbers in plain text. A hacker breaches the database and exposes 100,000 records. The company had ignored warnings about its security.
Likely Outcome: Penalty of up to ₹250 crore for failure to take reasonable security safeguards. The fact that the company ignored warnings will likely increase the penalty.
Scenario 2: The Responsive E-commerce App
An e-commerce app suffers a breach due to a zero-day vulnerability in a third-party library. The app's security team detects it within 2 hours, patches it, and notifies the Board and users within 24 hours.
Likely Outcome: While a breach occurred, the company demonstrated strong safeguards and prompt notification. The Board may impose a minimal penalty or no penalty, recognizing the company's diligence.
Scenario 3: The Ignored Grievance
A user requests erasure of their data. The company ignores the request for 6 months. The user complains to the Board.
Likely Outcome: Penalty under the "general non-compliance" category (up to ₹50 crore). The Board will likely order the company to erase the data immediately and pay compensation to the user.
📖 Glossary
- Zero-day Vulnerability
- A software vulnerability that is unknown to the vendor and has no patch available.
🔑 Key Takeaways
- Intent matters. Deliberate violations attract higher fines.
- Negligence (lack of safeguards) attracts high fines.
- Cooperation can lower the fine.
📚 Further Reading
- DPDPA Enforcement Trends — Legal Galaxy (2024)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...