Exemptions, enforcement, penalties and appeals

DPDP — not yet effective

Most operational exemption and enforcement provisions are scheduled for 13 May 2027. Board establishment and selected machinery are already in force.

Exemptions are scoped

Section 17(1) disapplies specified Chapter II/III and section 16 provisions for exact processing contexts such as enforcing legal rights/claims, judicial/regulatory functions, offence investigation, certain India-based processing of non-India Principals under overseas contracts, approved corporate restructurings and financial-default asset/liability ascertainment.

Section 17 also addresses:

• notified State instrumentalities for listed State/public-order purposes;
• research, archiving or statistical processing where no Principal-specific decision is taken and Rule 16/Second Schedule standards are met;
• notified classes including startups, for a specific list of provisions;
• certain State-processing carve-outs;
• time-limited Central Government notifications within the statutory window.

An exemption record must name the exact paragraph, facts, disapplied provisions, controls that remain, approver and review event. It cannot be a tenant-wide switch. Section 17(1), for example, preserves section 8(1) and 8(5) in its stated carve-out.

Research/archiving/statistics

The Second Schedule standards include lawful processing, purpose limitation, data minimisation, accuracy, retention safeguards, security and accountability-shaped requirements. The product requires a project protocol, no individual decision flag, access boundary, publication/disclosure review, retention and re-identification risk assessment.

Board process

The Board is intended to function independently and, as far as practicable, as a digital office. Its powers include inquiry into breaches/complaints within commenced jurisdiction, directions, urgent mitigation in breach cases, penalties and handling Consent Manager registration conditions. The Act provides procedure, inquiry powers, voluntary undertakings and appeal to the Appellate Tribunal. Court/judicial review questions remain for counsel in a live matter.

OpenDPDP stores:

RegulatoryMatter
  authority, provision, matter_ref, received_at
  linked_incident_or_case, response_deadline
  preservation_scope, custodians, submissions[]
  directions[], undertaking_terms[], compliance_events[]
  penalty_or_appeal, counsel_owner, privilege_class

Privileged material is separated from ordinary evidence export.

Monetary penalties

Section 33 requires the Board to consider nature/gravity/duration, data type/nature, repetition, gain/loss avoided, mitigation and timeliness/effectiveness, proportionality/deterrence and likely impact on the person. The Schedule sets maximum amounts by breach category, including up to ₹250 crore for failure to take reasonable safeguards and up to ₹200 crore for breach-notification failure and certain child obligations.

The product does not calculate a “likely fine” or imply that paying a maximum replaces remediation. It presents the exact Schedule category, facts, source and counsel-owned range analysis.

Blocking and information

Sections 36 and 37 address information calls and, for repeated penalties with statutory conditions, government directions related to public access blocking through intermediaries. These powers are not product kill switches. A regulatory direction requires authenticated intake, counsel review, preservation and controlled execution.

Acceptance tests

• Given a litigation hold, when section 17(1)(a) is selected, then the record lists exactly which provisions are disapplied and retains safeguard controls.
• Given research data is used for an individual credit decision, then the research/statistics exemption fails.
• Given a voluntary undertaking, when a term is due, then evidence and escalation attach to that term without altering the original incident timeline.