How to Explain Where a DPDP Penalty Goes and Why It Is Not Compensation
A data principal who complains to the Board, and whose complaint ends in a penalty, receives none of it. Section 34 of the Digital Personal Data Protection Act, 2023 says where the money goes, and the answer disposes of a misconception that a DPDP penalty is a remedy for the individual whose data was mishandled.
Step 1: Fix the Commencement Position
Section 33 and section 34 make up Chapter VIII of the Act, and that Chapter comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. Neither provision is operative today.
The reason to settle the point now is that the expectation forms early. A client told at the outset what the statutory route can deliver will not have to be told later that it cannot deliver something else.
Step 2: Read Section 34
Section 34 is one sentence, headed crediting sums realised by way of penalties to Consolidated Fund of India. It provides that all sums realised by way of penalties imposed by the Board under the Act shall be credited to the Consolidated Fund of India.
Three expressions in it do the work. All sums, so there is no carve out. Realised, so the direction attaches to money actually recovered rather than to money ordered. And credited to the Consolidated Fund of India, which is not a fund held for any class of claimant and out of which the Act provides no payment to anybody.
Step 3: Place It Against Section 33 and the Schedule
Section 33 is the penalty provision and the Schedule to the Act sets out the breaches and the amounts, the Schedule being keyed to sub-section (1) of section 33. Section 34 does not deal with whether a penalty is imposed or how much it is; it deals only with the destination of what is collected.
Read in sequence, the three provisions answer three different questions: whether there is a breach, what the penalty may be, and where the proceeds go. Confusing the third with the first two is how a client comes to believe that a successful complaint produces a payment to her.
Step 4: State the Consequence Plainly
No provision of the Act is directed to compensating a Data Principal. Every sum realised is credited to the Consolidated Fund of India, the Act contains no mechanism by which any part of it reaches the individual, and section 34 is the provision that puts the point beyond argument.
Say that in the first conversation rather than the third. A complainant who understands that the Board route is regulatory rather than compensatory can decide whether it is the route she wants, and a complainant who does not understand it will measure the outcome against a yardstick the Act never offered.
Step 5: Identify What the Act Does Give the Individual
What the Act gives a Data Principal is in Chapter III: rights exercisable against the Data Fiduciary, with a grievance route, and duties that attach to her as well. Those are the provisions that operate in her favour, and like Chapter II they commence eighteen months after publication.
So the honest answer to what the statute does for her is that it gives her rights to exercise and a complaint to make, not a sum to recover. Where a monetary outcome is the object, the question becomes whether some other body of law supplies one, and that is a different question from the one the Act answers.
Step 6: Advise the Other Side of the Same Point
A Data Fiduciary should understand the provision for the same reason in reverse. Paying a penalty into the Consolidated Fund of India satisfies the penalty and nothing else. It is not a settlement with any individual, it does not discharge an obligation owed to one, and it buys no release.
An internal note that treats a penalty as closing the matter with affected individuals is therefore wrong on the face of section 34. The two exposures are distinct and should be recorded as distinct from the start.
Step 7: Keep the Expectation in Writing
Record, in the advice and in the file, that the statutory route is regulatory and that no part of any penalty is payable to the complainant. Put it in the engagement correspondence as well as in the opinion.
This is the cheapest possible protection against a dispute about what was promised. It costs one sentence at the outset and it answers a question that is otherwise asked after the outcome is known, which is the worst moment to be answering it.
Common Pitfalls to Avoid
Treating the provision as live: Chapter VIII commences eighteen months after publication of the commencement notification.
Reading a carve out into section 34: It directs all sums realised by way of penalties imposed by the Board.
Confusing the destination with the determination: Section 34 says nothing about whether a penalty is imposed or how much it is.
Telling a complainant she may recover the penalty: It is credited to the Consolidated Fund of India.
Describing the Board route as compensatory: What the Act gives a Data Principal is the rights and the grievance route in Chapter III.
Treating payment of a penalty as a settlement: It satisfies the penalty and does not discharge anything owed to an individual.
Leaving the expectation unrecorded: The point belongs in the engagement correspondence as well as in the advice.
Key Statutory Provisions
Section 34 of the Digital Personal Data Protection Act, 2023: Crediting sums realised by way of penalties to Consolidated Fund of India. All sums realised by way of penalties imposed by the Board under the Act shall be credited to the Consolidated Fund of India.
Section 33 of the Act: Penalties. The provision under which the Board imposes a penalty, to which the Schedule is keyed by sub-section (1).
Chapter III of the Act: Rights and duties of a Data Principal, which is where the provisions operating in her favour sit, and which commences eighteen months after publication.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Places Chapter III and Chapter VIII, including section 33 and section 34, in the group commencing eighteen months after publication.
Sources and References
Section 34 of the Digital Personal Data Protection Act, 2023, bare text
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapters III and VIII and the Schedule
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments