Section 33 of Digital Personal Data Protection Act, 2023 - Penalties

Section 33 of the Digital Personal Data Protection Act, 2023 (DPDP Act) provides the statutory framework for monetary penalties that may be imposed by the Data Protection Board of India after an inquiry into a significant breach of the Act or the rules.

Commencement status as on 24 September 2026: Section 33 is not yet in force. The Central Government notification dated 13 November 2025 provides that sections 28 to 34, including Section 33, will come into force eighteen months from publication of that notification, i.e. on 13 May 2027. Readers should therefore distinguish the enacted text of Section 33 from its present commencement status.

What Section 33 means

Section 33 deals with the Board's power to impose a monetary penalty. The power arises only after conclusion of an inquiry and only where the Board determines that a breach of the DPDP Act or the rules made under it is significant. Before imposing the monetary penalty specified in the Schedule, the person concerned must be given an opportunity of being heard.

In practical terms, Section 33 combines three safeguards: a completed inquiry, a finding of a significant breach, and an opportunity of hearing. It also requires the Board to consider specified statutory factors when fixing the amount of the penalty.

Text and structure of Section 33

Section 33 - Penalties

(1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.

(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters:

the nature, gravity and duration of the breach;
the type and nature of the personal data affected by the breach;
the repetitive nature of the breach;
whether the person, as a result of the breach, has realised a gain or avoided any loss;
whether the person took action to mitigate the effects and consequences of the breach, including the timeliness and effectiveness of that action;
whether the monetary penalty is proportionate and effective, having regard to the need to secure observance of and deter breach of the Act; and
the likely impact of the monetary penalty on the person.

Key legal requirements under Section 33

1. Conclusion of an inquiry

A penalty under Section 33 is linked to the conclusion of an inquiry by the Data Protection Board of India. The provision does not describe the monetary penalty as an automatic consequence of every breach.

2. The breach must be significant

The Board must determine that the breach of the Act or the rules is significant. This statutory threshold is important because Section 33(1) expressly connects the penalty power with a finding of significance.

3. Opportunity of being heard

Before imposing a monetary penalty, the Board must give the person an opportunity of being heard. This is an express procedural safeguard in Section 33(1).

4. Penalty must be linked to the Schedule

The monetary penalty is the penalty specified in the Schedule to the DPDP Act. The Schedule sets the maximum monetary amounts for specified categories of breaches.

5. Penalty amount is not determined by a single factor

Section 33(2) requires consideration of the nature and duration of the breach, the personal data affected, repetition, gain or avoided loss, mitigation, proportionality and deterrence, and the likely impact of the penalty on the person. These factors are relevant to determining the amount within the applicable statutory framework.

DPDP Rules, 2025 and enforcement timeline

The Central Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The Rules have a phased commencement. Rules 1, 2 and 17 to 21 commenced on publication; Rule 4 is scheduled one year after publication; and Rules 3, 5 to 16, 22 and 23 are scheduled eighteen months after publication.

The Act itself is also being commenced in phases. The notification bringing provisions into force placed Section 33 in the group scheduled for commencement eighteen months after 13 November 2025. Accordingly, the penalty provision should not be described as presently operational before that commencement date.

Note: This page explains the enacted provision and its notified commencement timeline. For a current compliance or enforcement matter, verify the latest Gazette notifications and amendments before relying on the provision.

Related provisions

Section 33 should be read with the Schedule on monetary penalties, Section 32 on voluntary undertaking, and Section 34 on crediting sums realised by way of penalties to the Consolidated Fund of India.

Last reviewed: 24 September 2026.