Director and Board Liability Under the DPDP Act
The DPDP Act fines only the company, but a serious breach still reaches directors through company law, listing rules, RBI governance rules and the IT Act, and the board's own record decides how far.
- CATEGORY
- Article · Corporate governance
- POSITION AS OF
- October 2026
- READING TIME
- 9 min read
- TAGS
- Corporate governance, Directors' duties, SEBI LODR, Health-tech, DPDP Act
Introduction
After a large breach, directors ask what the company will pay and whether any of it can reach them. The Digital Personal Data Protection Act, 2023 (the DPDP Act) answers the second question by silence: it penalises the company alone. Yet the breach will be tested in board minutes, the responsibility statement, exchange filings and, if incident reporting fails, proceedings under the Information Technology Act, 2000 (the IT Act).
The Act's duties fall on the data fiduciary, the business that decides why and how personal data is processed; the data principal is the person the data is about. The Data Protection Board of India enforces it; we call it the Data Protection Board to avoid confusion with a company's board.
The legal position
The DPDP Act: penalties on the person in breach
Section 33(1) lets the Data Protection Board, after an inquiry and a hearing, impose a penalty specified in the Schedule where a person's breach of the Act or Rules is significant. Under section 2(s), "person" includes a company. The Schedule sets maximums by obligation: up to ₹250 crore for security safeguard failures, ₹200 crore each for breach intimation and children's data, ₹150 crore for a significant data fiduciary's (SDF's) extra duties and ₹50 crore otherwise. Section 34 sends the money to the Consolidated Fund of India.
We checked sections 33 to 39. Section 35 protects only the government, the Data Protection Board and its members and staff; sections 36 and 37 cover calls for information and blocking after penalties in two or more instances; section 39 bars civil courts from matters the Data Protection Board may decide. None creates an offence, provides for imprisonment or deems an officer liable for the company's breach, unlike section 85 of the IT Act.
Only section 10(2)(a)(iii) refers to a board of directors: an SDF's Data Protection Officer (DPO) must be "an individual responsible to the Board of Directors or similar governing body". Directors may still be summoned as witnesses, since section 28(7) gives the Data Protection Board a civil court's powers.
The IT Act route
Section 72A covers disclosing personal information obtained under a lawful contract, without consent or in breach of contract and with intent to cause (or knowing it is likely to cause) wrongful loss or gain. Section 70B(7) covers failure to follow CERT-In's directions, including six-hour incident reporting under the Directions of 28 April 2022. Both were offences; the Jan Vishwas (Amendment of Provisions) Act, 2023 reportedly made them penalties of up to ₹25 lakh and ₹1 crore from 30 November 2023. Both survive the DPDP Act. Section 85 then makes every person "in charge of, and was responsible to, the company for the conduct of business" liable for the company's contravention unless they prove lack of knowledge or due diligence, and section 85(2) reaches any director or officer whose consent, connivance or neglect is shown.
The Companies Act: duties and statements
- Section 166(3): a director must act "with due and reasonable care, skill and diligence" and exercise independent judgment; section 166(7) sets a fine of ₹1 lakh to ₹5 lakh.
- Section 134(5)(e) and (f): the directors' responsibility statement says, for listed companies, that internal financial controls were adequate and operating effectively, and, for all companies, that the directors "had devised proper systems to ensure compliance with the provisions of all applicable laws". Section 134(8) penalises the company and every officer in default.
- Section 177(4)(vii): the audit committee evaluates "internal financial controls and risk management systems"; section 177(10) gives users of the vigil mechanism direct access to its chair in appropriate cases.
- Section 149(12): independent directors, and non-executive directors who are not promoters or key managerial personnel, are liable only for acts occurring "with his knowledge, attributable through Board processes, and with his consent or connivance or where he had not acted diligently". Under section 149(8) and Schedule IV they must seek clarification or amplification of information, take outside advice where needed, and ensure a functional vigil mechanism.
SEBI listing rules
Under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (LODR), regulation 17(9)(b) makes the board responsible for the risk management plan. Regulation 21 requires a risk management committee for the top 1,000 listed entities and high value debt listed entities, and its role "shall specifically cover cyber security". Regulation 25(10) requires the top 1,000 to buy directors and officers (D&O) insurance for independent directors.
SEBI's 2023 cyber amendment sits in regulation 27, not regulation 30. Regulation 27(2)(ba), inserted by the Second Amendment Regulations of 14 June 2023 with effect from 14 July 2023, requires details of "cyber security incidents or breaches or loss of data or documents" in the quarterly corporate governance report. Schedule III lists no cyber event, so event-based disclosure under regulation 30 turns on the materiality criteria in regulation 30(4)(i), including value thresholds, or on Part B's item for disruption of operations. Material events go out within 12 hours if they emanate from within the company and 24 hours otherwise.
RBI: board-level IT oversight
The RBI's Directions of 31 July 2026 on cybersecurity and technology risk for commercial banks require a board-level IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise and meeting at least quarterly (paras 16 to 18). The board approves IT and cybersecurity policies (para 7), and the CISO reviews cyber risk with the board or a committee quarterly (para 28(7)).
Analysis
Board conduct sets the company's penalty
Directors do not pay a DPDP penalty, but they shape it. Section 33(2) directs the Data Protection Board to weigh, among other things, the "repetitive nature of the breach" and whether the company acted to mitigate it, including "the timeliness and effectiveness of such action". A board that tested its breach plan and can prove it acted within hours reduces the company's exposure.
The responsibility statement in the first DPDP year
The main DPDP duties commence on 13 May 2027, so for most companies the first section 134(5)(f) statement that must cover them is in the board's report for 2027-28. A breach does not make it false; the test is whether systems were adequate and operating effectively. In our view a board that cannot evidence this should qualify the statement, because the statement, not the DPDP penalty, carries the directors' own signatures.
Independent and nominee directors
Section 149(12) opens with "Notwithstanding anything contained in this Act", meaning the Companies Act, so in our view it does not limit IT Act liability. But section 85(1) targets those in charge of the conduct of business, usually executives, so a non-executive director's IT Act exposure lies mainly in section 85(2): consent, connivance or neglect. Under both laws the question is what the director knew and did.
Section 39 is not a shield for directors
Section 39 bars civil courts only in matters the Data Protection Board is empowered to determine. In our view a company's claim against its directors for breach of section 166 duties is not one, because that Board has no power over directors' duties.
D&O insurance
The DPDP penalty is the company's own liability, so whether insurance responds depends on any entity cover and the wording. Check whether "claim" includes a regulatory inquiry, whether defence costs reach Data Protection Board proceedings and IT Act proceedings, how fines are treated and whether cyber exclusions apply. We found no Indian decision on whether a statutory penalty may lawfully be insured. Regulation 25(10) leaves the quantum and risks of independent directors' cover to the board, so the board should decide the data-protection question expressly.
Boards of significant data fiduciaries
No SDF has been designated. When one is, its board gains a direct report in the DPO, and the annual data protection impact assessment and data audit under Rule 13 (the DPDP (Removal of Difficulties) Order, 2026 changed "audit" to "data audit" in section 10(2)(c)(ii)). In our view the board should review both before the Data Protection Board receives them.
Practical implications
Worked example: a listed health-tech board after a breach
In July 2027 a listed health-tech company in the top 1,000 learns that a cloud vendor's misconfigured storage exposed prescriptions and lab reports of about four lakh patients (figures illustrative).
- Within six hours, the CISO reports to CERT-In and alerts the managing director and the risk committee chair.
- The same day, the company informs the Data Protection Board and each affected patient under Rule 7, and starts the detailed report due within 72 hours.
- In parallel, the company secretary runs the regulation 30 test: did operations stop, and do the value or market-reaction tests apply? The decision and reasons are recorded, and any disclosure goes out within 12 or 24 hours.
- Within a week, a special board meeting hears the facts. Independent directors ask what data was involved, whether the vendor contract met Rule 6, and when management first knew; the answers are minuted. The board approves remediation, action against the vendor and evidence preservation, and the company notifies its insurers.
- At quarter end, the regulation 27(2)(ba) disclosure lists it.
- Before year end, the audit committee reviews vendor controls under section 177(4)(vii), and the board tests its 2027-28 responsibility statement against that review.
Any DPDP penalty falls on the company; steps 1 to 6 are the record that sections 33(2) and 149(12) examine.
Checklist by role
| Role | Where exposure comes from | What protects them | Basis |
|---|---|---|---|
| Managing and whole-time directors | In charge of the business for IT Act contraventions; duty of care | Tested six-hour reporting; documented delegation | IT Act ss.70B(7), 72A, 85(1); CA s.166 |
| Independent and non-executive (including nominee) directors | Knowledge through board processes; consent, connivance or neglect | Minuted questions; outside advice where needed | CA s.149(12), Sch IV; IT Act s.85(2) |
| Whole board | Responsibility statement on compliance systems and controls | Annual DPDP evidence pack | CA s.134(5)(e)-(f), 134(8) |
| Audit committee | Evaluation of controls and risk systems; vigil mechanism | Internal audit of vendor and security controls | CA s.177(4)(vii), 177(9)-(10) |
| Risk management committee | Cyber security within its remit | Quarterly incident and data-risk report | LODR reg 21 |
| Company secretary | Disclosure timing and content | Materiality decision log | LODR regs 27(2)(ba), 30 |
| SDF board, once designated | DPO responsible to the board | Direct DPO line; DPIA and data audit tabled | DPDP s.10(2)(a)(iii); Rule 13 |
| Bank boards | IT Strategy Committee; board-approved cyber policies | Quarterly CISO review | RBI Directions 2026, paras 7, 16-18, 28(7) |
Key takeaways
The DPDP Act keeps directors out of its penalty provisions, not out of the consequences. Company law, listing rules, RBI rules and the IT Act each ask what the board knew and did, and section 33(2) makes the same record relevant to the company's penalty. Boards that put data protection on the agenda before May 2027 protect the company and themselves.
- The DPDP Act penalises the person in breach, in practice the company; sections 33 to 39 contain no offence and no officer-liability clause, unlike section 85 of the IT Act.
- Directors' exposure comes from the Companies Act (ss.166, 134(5), 177, 149(12)), SEBI LODR (regs 17, 21, 25(10), 27(2)(ba), 30), the RBI's IT Strategy Committee rules for banks and IT Act ss.70B(7) and 72A read with s.85.
- Section 33(2) makes the board's breach response, including the timeliness and effectiveness of mitigation, part of the company's penalty calculation.
- In our view the first responsibility statement that must cover DPDP duties is in the 2027-28 board's report, and a board that cannot evidence adequate systems should qualify it.
- Whether D&O insurance responds turns on entity cover and wording; we found no Indian ruling on insuring statutory penalties.
Anonymisation and Pseudonymisation Under the DPDP Act
The DPDP Act never mentions anonymisation, so whether a dataset escapes it turns on one word in section 2(t), 'identifiable', and on who could do the identifying.
SDKs, Pixels and Trackers: Who Is Responsible Under the DPDP Act?
Every SDK in an app sends data to someone, and the DPDP Act holds the app answerable for what its code collects while making a vendor that uses the data for itself answerable too.
DPDP Act vs Singapore's PDPA: Taking Your Programme Into Asia
An Indian company with a DPDP programme already has most of what Singapore's PDPA asks for, but breach triage, transfers back to India, a DPO and Do Not Call checks are new work.