Legal Register
ACT-SCHEDULE Tranche 3 (13 May 2027) — Core Operating Cliff
Status: scheduled, not yet operative
Schedule to Act: s33 adjudication
Not fixed fines, not summed expected exposure, and child category not joint-highest.
Regulated Actor: Board / person subject to significant breach finding
Gazette Baseline: Lines 1010–1045
Statutory Trigger
s33 adjudication
Applies to: Board / person subject to significant breach finding
Substantive Conditions
Ceilings: safeguards INR250 crore; breach notice INR200 crore; child INR200 crore; SDF INR150 crore; principal duties INR10000; undertaking per underlying breach; others INR50 crore.
Statutory Exceptions
All are maxima subject to s33; amendments require s42 notification.
Official Gazette Text (Verbatim Publication)
Ministry of Law and Justice publication, Digital Personal Data Protection Act, 2023.
THE SCHEDULE
[See section 33 (1)]
Sl. No. Breach of provisions of this Act or rules made thereunder Penalty
(1) (2) (3)
1. Breach in observing the obligation of Data Fiduciary to May extend to two
take reasonable security safeguards to prevent personal hundred and fifty
data breach under sub-section (5) of section 8. crore rupees.
2. Breach in observing the obligation to give the Board or May extend to two
affected Data Principal notice of a personal data breach hundred crore
under sub-section (6) of section 8. rupees.
3. Breach in observance of additional obligations in relation May extend to two
to children under section 9. hundred crore
rupees.
4. Breach in observance of additional obligations of May extend to one
Significant Data Fiduciary under section 10. hundred and fifty
crore rupees.
5. Breach in observance of the duties under section 15. May extend to ten
thousand rupees.
6. Breach of any term of voluntary undertaking accepted by Up to the extent
the Board under section 32. applicable for the
breach in respect
of which the
proceedings under
section 28 were
instituted.
7. Breach of any other provision of this Act or the rules May extend to fifty
made thereunder. crore rupees.
Mapped Operational Controls (1)
Enterprise obligations in the Control Master Matrix grounded in this statutory provision.