top of page
Search

How to Build the Mitigation Case Before the Board Sets a DPDP Penalty

Writer: Kaustav Chowdhury
Kaustav Chowdhury
7 hours ago
5 min read

Most DPDP advice stops at the ceiling in the Schedule. The number that will actually be imposed is governed by seven matters listed in section 33(2), and an organisation that builds its record against those matters is doing the only useful mitigation work available. The mitigation case is assembled years before it is deployed.

Step 1: Fix the Commencement Position

Section 33 is in the group that comes into force eighteen months after publication of the commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. No penalty can be imposed before then.

The planning point is that four of the seven matters are historical by the time a penalty is considered. They are fixed by what the organisation did at the time, which means the mitigation case is built in advance or not at all.

Step 2: Note the Two Thresholds That Come First

Section 33(1) permits a penalty only where the Board determines, on conclusion of an inquiry, that the breach of the provisions of the Act or the rules is significant, and only after giving the person an opportunity of being heard. Quantum is therefore the third question, not the first.

Both thresholds are worth contesting on their own terms. A breach that is not significant attracts no penalty at all, and the hearing is the occasion at which the material going to the seven matters is actually put before the Board.

Step 3: Take the Four Historical Matters

Clause (a) is the nature, gravity and duration of the breach. Clause (b) is the type and nature of the personal data affected by the breach. Clause (c) is the repetitive nature of the breach. Clause (d) is whether the person, as a result of the breach, has realised a gain or avoided any loss.

Each is answered by records rather than by argument. Duration is a question of when detection happened and what the logs show. Type and nature of data is a question of whether the organisation can say precisely which categories were affected. Repetitive nature is a question of what the earlier incident register records. Gain or avoided loss is the one most often conceded by accident, because cost savings from a control that was not implemented sit in the organisation's own papers.

Step 4: Build the Mitigation Record Under Clause (e)

Clause (e) is whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action. It is the only matter in the list that rewards conduct after the event, and it has three parts.

Action, timeliness and effectiveness each need their own evidence. What was done, when it was done measured from detection rather than from the incident, and what the measure achieved. An incident log that records decisions with timestamps, and a short closing note on what the remediation actually prevented, is worth more at this stage than any submission.

Step 5: Make the Proportionality Argument Properly

Clause (f) is whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of the Act. Proportionality here is tied expressly to deterrence, so it is not a plea for leniency.

The argument that fits the clause is that a lower figure already secures observance, because the conduct has been corrected and the correction is verifiable. An argument that the figure is simply large does not engage the words. Nor does one that ignores deterrence, which the clause puts on the same footing as proportionality.

Step 6: Use Clause (g) Without Overreaching

Clause (g) is the likely impact of the imposition of the monetary penalty on the person. This is the clause through which the organisation's own circumstances enter, and it is the one most easily wasted.

Impact means a demonstrated consequence, so it is evidenced by financial statements and by the effect on continued operation, not by assertion. Overstating it is costly, because a claim of ruinous impact that the accounts do not support damages the credibility of the material filed under the other six matters.

Step 7: Keep the Seven Matters as a Standing Checklist

Convert the list into a standing internal format and populate it at the time of any incident, not when a notice arrives. Nature, gravity and duration. Type and nature of data. Whether anything similar has happened before. Whether anything was gained or any cost avoided. What was done, how fast, and to what effect. What correction can be demonstrated. And what the organisation can actually bear.

Kept that way, the file answers the statutory questions in the statutory order. Built after a notice, the same file is a reconstruction, and it reads like one.

Common Pitfalls to Avoid

  • Advising on the ceiling alone: The Schedule sets a maximum and section 33(2) governs the amount actually imposed.

  • Skipping the significance threshold: Section 33(1) permits a penalty only where the Board determines on conclusion of an inquiry that the breach is significant.

  • Treating the seven matters as argument: Four of them are answered by records that exist before any notice.

  • Measuring timeliness from the incident: Clause (e) is concerned with the action taken and its timeliness, which in practice runs from detection.

  • Pleading proportionality as leniency: Clause (f) ties proportionality to securing observance and deterring breach.

  • Overstating impact: Clause (g) looks to the likely impact on the person, which has to be evidenced.

  • Conceding gain by accident: Clause (d) asks whether a gain was realised or a loss avoided, and internal papers on deferred controls often answer it.

Key Statutory Provisions

  • Section 33 of the Digital Personal Data Protection Act, 2023: Sub-section (1) permits a monetary penalty specified in the Schedule only where the Board determines on conclusion of an inquiry that the breach is significant and after giving the person an opportunity of being heard. Sub-section (2) requires the Board, in determining the amount, to have regard to the nature, gravity and duration of the breach; the type and nature of the personal data affected; the repetitive nature of the breach; whether a gain was realised or a loss avoided; whether mitigating action was taken and its timeliness and effectiveness; whether the penalty is proportionate and effective having regard to the need to secure observance and deter breach; and the likely impact of the penalty on the person.

  • The Schedule to the Act: The maxima for each class of breach, which the section 33(2) matters operate within rather than against.

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page