Ceilings, not tariffs, and cumulative

The Schedule to the Act fixes a maximum penalty for each kind of default. The Board decides the amount in each case, after hearing the organisation. These ceilings are cumulative: a single incident can engage more than one head. A breach that was neither prevented nor reported answers under the first two together.

• Up to ₹250 croreFailure to take reasonable security safeguards to prevent a breach
• Up to ₹200 croreFailure to notify a breach to the Board and to affected individuals
• Up to ₹200 croreBreach of the additional obligations concerning children’s data
• Up to ₹150 croreBreach of the additional obligations of a Significant Data Fiduciary
• Up to ₹50 croreBreach of any other provision of the Act or the Rules

What the Board must weigh

The nature, gravity and duration of the default; the kind of data affected; whether it is a repeat; whether the organisation gained by it; and whether the organisation acted to mitigate, and how quickly.

Who carries the heavier burden

Significant Data Fiduciaries are designated by the Central Government by reference to the volume and sensitivity of data held and the risk it poses. They must appoint a Data Protection Officer in India, engage an independent data auditor, and complete an impact assessment and an audit every twelve months. The lists are awaited; large holders of financial, health, children’s and consumer data should plan on the footing that designation will reach them.