Section 34 of Digital Personal Data Protection Act, 2023 - Crediting Penalties to Consolidated Fund of India

Section 34 of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) deals with the destination of monetary penalties realised under the Act. It requires sums realised by way of penalties imposed by the Data Protection Board of India to be credited to the Consolidated Fund of India.

Commencement status: Section 34 is not yet in force as on 24 September 2026. Under the Central Government notification dated 13 November 2025, sections 28 to 34 are scheduled to come into force eighteen months from the date of publication of that notification, that is, on 13 May 2027.

Text of Section 34

"34. All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India."

Meaning of Section 34

Section 34 is a financial-disposal provision. When a monetary penalty imposed by the Board under the DPDP Act is actually realised, the amount is not retained by the Board. The realised sum is credited to the Consolidated Fund of India.

The expression "Board" refers to the Data Protection Board of India constituted under section 18 of the Act. The provision should be read with section 33 on penalties and the Schedule prescribing maximum penalty amounts.

What is the Consolidated Fund of India?

The Consolidated Fund of India is the principal government fund referred to in Article 266(1) of the Constitution of India. In practical terms, section 34 directs realised DPDP Act penalty receipts into this public fund rather than treating them as revenue of the Data Protection Board.

Section 34 and the DPDP Rules, 2025

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with phased commencement. The Act itself also has a phased enforcement timeline. For section 34, the relevant commencement notification places sections 28 to 34 in the group that takes effect eighteen months after publication of the 13 November 2025 notification.

Legal update: Readers should distinguish enactment from commencement. The DPDP Act received Presidential assent on 11 August 2023, but different provisions have been brought into force on different dates under section 1(2).

Official references

For the authoritative text and current implementation material, see the official Digital Personal Data Protection Act, 2023, the official commencement notification dated 13 November 2025, and the Digital Personal Data Protection Rules, 2025 published by the Ministry of Electronics and Information Technology.

Last reviewed: 24 September 2026. This page is intended as a general legal information resource; the Gazette notification and statutory text should be consulted for authoritative wording and commencement.