DPDP Act Penalties Beyond ₹250 Crore: How Section 33 Decides the Real Amount, and What Europe's New Fining Guidelines Signal

Most conversations about DPDP Act penalties start and end with one number: ₹250 crore. That figure is a ceiling per instance of breach, and the Data Protection Board of India will not reach for the ceiling by default. Section 33 of the Digital Personal Data Protection Act, 2023 tells the Board how to decide the actual amount, and those factors are where an SME can make a real difference to its exposure.

There's a useful outside reference point from Europe. On 17 September 2026 the European Data Protection Board (EDPB) adopted Guidelines 04/2026 on when GDPR regulators should impose fines rather than use other corrective powers, and the draft is open for public comment until 13 November 2026. The EDPB has no authority in India. But the way European regulators are reasoning about mitigation, self-reporting and "ordinary compliance" gives Indian businesses a sharp preview of the questions our own Board is likely to ask.

How DPDP Act penalties are calculated under Section 33

Section 33(1) lets the Board impose a monetary penalty only after it concludes an inquiry, finds the breach "significant", and gives the business a chance to be heard. The Schedule then sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify the Board and affected people of a personal data breach, and lower caps for other failures.

Section 33(2) lists seven matters the Board must weigh when fixing the amount:

1. The nature, gravity and duration of the breach.
2. The type and nature of the personal data affected.
3. Whether the breach is repetitive.
4. Whether the business realised a gain or avoided a loss because of the breach.
5. Whether it took action to mitigate the effects, and how timely and effective that action was.
6. Whether the penalty is proportionate and effective as a deterrent.
7. The likely impact of the penalty on the business.

Factors 6 and 7 matter to smaller companies. The Act expects a penalty to fit the entity paying it. That is not a promise of leniency, though. Factors 1 to 5 are about your conduct, and you control most of them.

What the EDPB's new fining guidelines signal

The EDPB draft sets out a five-step test. Is the infringement fineable? Is this party liable? Was it intentional or negligent? Is it minor once aggravating and mitigating factors are weighed? Would a fine be effective, proportionate and dissuasive? If an infringement is minor, the general rule is no fine, possibly a reprimand instead. If it is not minor, a fine becomes the default outcome.

Three points from the commentary on the draft, published by law firms Hunton and Faegre Drinker, map neatly onto India's Section 33(2)(e):

• Timing counts. The EDPB gives "particular weight on the timeliness and effectiveness" of remedial steps, and measures taken before an investigation starts are more likely to count as mitigation. Fixes made after a regulator calls you earn less credit.
• Doing what the law already requires is not mitigation. Ordinary cooperation and a clean enforcement record carry no mitigating weight, because the law requires them anyway. Only cooperation that goes beyond the legal duty and materially limits harm counts.
• Sensitive data and scale aggravate. Involving special-category data makes a fine more likely. Regulators may also compare the number of affected people with the relevant population to judge whether a problem is systemic.

Read alongside the DPDP Act, the message is plain: a business that discovers a problem, contains it quickly and can show its work is in a very different position from one that waits to be asked.

Section 32: the voluntary undertaking most SMEs haven't heard of

The DPDP Act has a tool GDPR lacks in this form. Under Section 32, the Board may accept a voluntary undertaking from a business at any stage of proceedings under Section 28. The undertaking can commit you to take, or stop, specific actions within a set time, and to publicise that commitment. Once the Board accepts it, further proceedings on the matters it covers are barred.

There's a catch. If you fail to honour any term, Section 32(5) deems that failure a breach of the Act, and the Board can move to a penalty after hearing you. An undertaking is useful only if you can deliver on it. You need an accurate picture of your data flows, your vendors and your fix timeline before you offer one.

Where the Board stands today

The Data Protection Board has been constituted in law, but as of mid-October 2026 no chairperson or members had been appointed. A recruitment advertisement for one chairperson and four members ran in Employment News on 6 June 2026, and on 7 October 2026 the Kerala High Court observed that the Board had yet to be made functional. The Board's core inquiry and penalty powers under Section 28 come into force with the main obligations around 13 May 2027.

That gap is not a holiday. It is the window in which mitigation evidence is cheapest to create. Records written now, before any complaint exists, are exactly the "before an investigation" measures that regulators in Europe say deserve weight.

A practical penalty-readiness file for Indian SMEs

For each Section 33(2) factor, ask what evidence you could hand the Board on day one of an inquiry:

• Gravity and duration: logging and monitoring that show when an incident started and when it stopped.
• Type of data: a data inventory that marks financial, health, children's and identity data, so you can show what was and was not affected. A privacy impact assessment on high-risk processing helps here.
• Repetition: a dated issue register showing that past findings were closed, not parked.
• Gain or loss avoided: documented decisions on security spending and retention, so nobody can argue you saved money by cutting corners.
• Mitigation: an incident response plan that meets the 72-hour reporting expectation in Rule 7, plus a record of drills.
• Proportionality and impact: clean financial and organisational records, so the Board can see your real size.

If you have never mapped your obligations end to end, our DPDP Act compliance programme starts with exactly this kind of gap analysis.

The short version

The ₹250 crore cap is real, but the Board will set any actual penalty through Section 33's seven factors, and most of those factors reward preparation you can do this quarter. Europe's regulators are spelling out that early, documented, above-minimum effort is what earns credit. India's Board is likely to look for the same.

This article is general guidance, not legal advice. For decisions about your specific situation, please consult a qualified professional.

Want to see where you stand? Run through our free DPDP compliance checklist, or talk to our team about building your penalty-readiness file before May 2027.