Section 33: Penalties

Section 33 empowers the Board to impose monetary penalties for significant breaches: Penalty Factors Considered: 1. Nature, Gravity, and Duration: How serious and how long the breach lasted. 2. Type of Data: Whether sensitive or high-risk data was involved. 3. Repetitive Nature: Whether the entity has breached before. 4. Gain or Loss: Whether the entity gained or avoided loss from the breach. 5. Mitigation: What steps were taken to fix the problem and how effective they were. 6. Proportionality and Deterrence: The penalty should be enough to deter future breaches. 7. Impact on the Person: How the penalty would affect the violating entity. The actual penalty amounts are listed in the Schedule (up to ₹250 crore for security safeguard failures, ₹50 crore for other breaches, and ₹10,000 for Data Principal duty breaches).