Penalties are calibrated by breach type: failure by a Data Fiduciary to maintain reasonable security safeguards against personal data breaches may attract up to 250 crore rupees; failure to notify the Board or affected Data Principal, and non-compliance with obligations relating to children, may each attract up to 200 crore rupees. Breach of Significant Data Fiduciary obligations may attract up to 150 crore rupees, while residual breaches may attract up to 50 crore rupees.

Section 44 aligns related statutes with the Digital Personal Data Protection Act, 2023 by adding its Appellate Tribunal to the appellate tribunal references under the Telecom Regulatory Authority of India Act, 1997. It omits section 43A and a related rule-making entry from the Information Technology Act, 2000, while adding the Digital Personal Data Protection Act, 2023 to the saving proviso in section 81. It also revises the Right to Information Act, 2005 exemption concerning information relating to personal information.

Section 43 permits the Central Government to issue Official Gazette orders, consistent with the Digital Personal Data Protection Act, 2023, where necessary or expedient to remove difficulties in implementing it. This power may be exercised only within three years from the Act's commencement. Each order must be laid before both Houses of Parliament as soon as practicable after it is made.

Section 42 empowers the Central Government to amend the Schedule by notification, while limiting any increase in a scheduled penalty to no more than twice the amount specified when the statute was originally enacted. An amendment made under this power operates as though enacted within the statute and takes effect on the date of its notification.

Parliamentary scrutiny applies to every rule made and notification issued under sections 16 and 42 of the Digital Personal Data Protection Act, 2023, which must be laid before each House while in session for an aggregate thirty-day period. Both Houses may jointly modify or annul an instrument before expiry of the following session; modification or annulment does not affect the validity of anything previously done under it.

The Central Government may make rules, after previous publication, for implementing the Digital Personal Data Protection Act, 2023. Rules may regulate Data Fiduciary notices, Consent Manager accountability and registration, personal data breach intimation, verifiable consent, children's data processing, Data Protection Impact Assessments, and obligations of Significant Data Fiduciaries. They may also prescribe procedures for Data Principal information and erasure requests, grievances, nominations, exempt processing standards, Board administration, techno-legal measures, and appeals.

Bar of civil court jurisdiction excludes suits or proceedings concerning matters within the Board's statutory powers. Courts and other authorities cannot grant injunctions against actions taken, or proposed to be taken, under powers conferred by the Digital Personal Data Protection Act, 2023. The provision takes effect from 13 November 2025.

Section 38 preserves the concurrent operation of other laws by providing that the Digital Personal Data Protection Act, 2023 applies in addition to, and does not derogate from, applicable law. Where its provisions conflict with another law in force, the Digital Personal Data Protection Act, 2023 prevails only to the extent of the conflict. The framework takes effect from 13 November 2025.

Section 37 permits the Central Government or a specially authorised officer to order public-access blocking of information on a computer resource enabling a Data Fiduciary to offer goods or services to Data Principals in India. The power requires a written Board reference concerning repeated monetary penalties and advice that blocking serves the general public interest. The Data Fiduciary must be heard, and written reasons must support the finding that blocking is necessary or expedient. Intermediaries receiving such directions must comply.

Section 36 empowers the Central Government to require the Board, any Data Fiduciary, or any intermediary to furnish information for the purposes of the Digital Personal Data Protection Act, 2023. This creates a statutory information-furnishing obligation for the Board and regulated entities when information is called for.

Section 35 provides good-faith protection to the Central Government, the Board, and their Chairperson, Members, officers and employees. It bars suits, prosecutions and other legal proceedings concerning acts done, or intended to be done, in good faith under the Digital Personal Data Protection Act, 2023 or rules made under it. The provision is to take effect on 13 November 2025.

Penalties imposed by the Board under the Digital Personal Data Protection Act, 2023 must be credited to the Consolidated Fund of India. All sums realised through such penalties are required to be deposited in that fund.

Significant breaches of the Digital Personal Data Protection Act, 2023 or its rules may result in a monetary penalty specified in the Schedule. The Board may impose the penalty only after completing an inquiry, determining that the breach is significant, and giving the concerned person an opportunity to be heard. Penalty assessment considers breach severity, affected personal data, repetition, gains or avoided losses, mitigation, proportionality, deterrence, and likely impact.

At any stage of proceedings, the Board may accept a voluntary undertaking concerning observance of the Digital Personal Data Protection Act, 2023. Terms may require action within a determined time, abstention from action, or publication. Acceptance bars further proceedings concerning the undertaking's contents, subject to non-compliance. Terms may be varied with the giver's consent. Breach of an accepted term is deemed a breach of the Act and may lead to proceedings after an opportunity of being heard.

Alternate dispute resolution permits the Board, where it considers a complaint capable of resolution by mediation, to direct the concerned parties to attempt mediated resolution. The mediator may be selected by mutual agreement of the parties or in accordance with any law in force in India governing such mediation.

Appellate Tribunal orders under digital personal data protection law are executable by the Tribunal as civil-court decrees, with all powers of a civil court available for execution. The Tribunal may transmit an order to the civil court having local jurisdiction, which must execute it as though it were its own decree.

Any person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal within sixty days, subject to prescribed form, manner, and fee requirements. The Tribunal may condone delay for sufficient cause and, after hearing the parties, confirm, modify, or set aside the challenged order. Appeals should be disposed of expeditiously, with reasons recorded for delay beyond six months. Proceedings should function as far as practicable through a digital office.

Bail in allegations of fraudulent loan transactions requires assessment of the prima facie case, offence gravity and societal impact, public interest, and the risk of interference with justice. Alleged concerted siphoning of co-operative bank funds through loans was treated as seriously affecting depositors and the banking system. Temporary bail intended to enable recovery had not resulted in recovery. Alleged influence of the accused, together with a genuine apprehension of evidence tampering and interference with pending proceedings, weighed against release. Bail was therefore denied.

The Board must operate independently and, as far as practicable, through a digital office. It must determine whether sufficient grounds exist before commencing an inquiry, record reasons for closure or further action, and conduct inquiries according to principles of natural justice. The Board has specified civil-court powers for evidence gathering and inspection, but cannot disrupt day-to-day functioning by restricting premises access or taking custody of essential equipment. Interim orders require a hearing and recorded reasons, while false or frivolous complaints may result in warnings or costs.

Upon intimation of a personal data breach, the Data Protection Board may order urgent remedial or mitigation measures, inquire into the breach, and impose prescribed penalties. It may investigate specified breaches involving Data Fiduciaries, Consent Managers, and intermediaries on prescribed complaints, references, or directions. After hearing the person concerned and recording written reasons, it may issue binding directions. On an affected person's representation or Central Government reference, it may modify, suspend, withdraw, or cancel directions, subject to conditions.