Significant data protection breaches may attract monetary penalties after hearing, assessed through severity, mitigation, deterrence, and proportionality factors.

Section 33 permits the Board, after an inquiry and an opportunity of being heard, to impose the scheduled monetary penalty for a significant breach of data protection obligations or rules. The penalty amount must reflect the breach's severity, duration, affected personal data, repetition, gains or avoided losses, mitigation measures, proportionality, deterrent effect, and likely impact on the person.

---

---

---