Section 33 Penalty Framework: Institutional Exposure
Section 33 of the DPDPA empowers the Data Protection Board of India to impose penalties as specified in the Schedule. The maximum penalty — ₹250 Crore — applies to failure to implement reasonable security safeguards under Section 8(5). Unlike the Companies Act 2013 (which contains express “officer in default” provisions under Section 149), the DPDPA does not create automatic personal liability for individual directors or officers of a Data Fiduciary. Penalties are imposed on the entity. However, the scale of these penalties makes DPDPA compliance a fiduciary governance matter that no board can delegate to the IT department alone.
Why Board-Level Governance Is Imperative
Even without an express personal liability clause in the DPDPA, directors of Indian subsidiaries face governance exposure through other routes: (a) fiduciary duties under the Companies Act 2013, including the duty of care under Section 166, which requires directors to exercise due and reasonable care in the discharge of their duties; (b) potential derivative liability if the company suffers ₹250 Crore penalties due to demonstrable governance failures; and (c) regulatory scrutiny of the board’s role when the Data Protection Board assesses the adequacy of the organisation’s compliance infrastructure under Section 33(2).
Section 10: The Significant Data Fiduciary Standard
For organisations designated as Significant Data Fiduciaries under Section 10, the governance obligations are statutory: appointment of a DPO based in India, an independent data auditor, and periodic Data Protection Impact Assessments under Rule 13. These are not discretionary — non-compliance attracts up to ₹150 Crore in penalties. For foreign subsidiaries, the SDF designation creates a structured compliance architecture that the board must oversee, resource, and document.
D&O Insurance Considerations
Most global Directors and Officers (D&O) insurance policies exclude fines and penalties imposed by regulatory authorities. DPDPA penalties — being imposed by the Data Protection Board — are regulatory penalties directed at the entity. Companies must review their D&O policies to determine whether consequential governance claims related to DPDPA exposure are covered, and if not, seek riders or standalone cyber liability coverage that explicitly addresses Indian data protection matters.
Practical Compliance Architecture
Directors of Indian subsidiaries should ensure: (a) board-level reporting on DPDPA compliance status at least quarterly, (b) documented evidence that data protection was on the board agenda, (c) a designated officer responsible for DPDPA implementation (DPO for SDF entities, or equivalent for non-SDF), (d) periodic compliance audits with findings reported to the board, and (e) board-approved budgets for data protection implementation. The Board’s assessment under Section 33(2) of the nature, gravity, and mitigating actions will turn on this documentary record.