Financial penalties are graded for personal-data non-compliance. A Data Fiduciary may face penalties for inadequate security safeguards or failure to notify the Board or affected Data Principal of a breach. Additional penalties apply to obligations concerning children and Significant Data Fiduciaries, while Data Principal duties, voluntary undertakings, and residual contraventions carry separate penalty exposure.

Section 44 makes consequential amendments connected with the Digital Personal Data Protection Act, 2023. It revises the listed Appellate Tribunals under telecom regulation, omits section 43A and a rulemaking provision under the Information Technology Act, 2000, and extends the section 81 proviso to preserve operation of the Digital Personal Data Protection Act, 2023. It also substitutes the Right to Information exemption with wording covering information relating to personal information.

The Central Government may issue Official Gazette orders necessary or expedient to address obstacles in implementing the Digital Personal Data Protection Act, 2023, provided the orders remain consistent with its provisions. The power cannot be exercised after three years from commencement, and every order must be laid before each House of Parliament as soon as practicable.

Central Government may amend the Schedule by notification, subject to a ceiling preventing any specified penalty from exceeding twice the amount originally specified. Each notified amendment has statutory force and takes effect on its notification date. The power permits revision of scheduled penalties within the prescribed ceiling, with immediate commencement through notification.

Parliamentary laying procedure requires rules and specified notifications to be placed before both Houses for an aggregate thirty-day period. Both Houses may jointly modify an instrument or determine that it should not be made or issued before expiry of the immediately following session. Modified instruments operate only in revised form, while annulment does not invalidate actions previously taken under them.

Section 40 authorises the Central Government, following previous publication and by notification, to make rules consistent with the Digital Personal Data Protection Act, 2023. Rules may govern Data Fiduciary notices, Consent Manager accountability and registration, personal data breach intimation, verifiable consent, children's personal data processing, Data Protection Impact Assessments, Significant Data Fiduciary measures, Data Principal requests and grievances, exemption standards, Board administration, and appeal filing and procedure.

Section 39 bars civil courts from entertaining suits or proceedings concerning matters within the Board's powers under the Digital Personal Data Protection Act, 2023. It further prohibits courts and other authorities from granting injunctions concerning action taken or proposed in exercise of powers under that framework, thereby excluding civil litigation and injunctive restraint in those matters.

Section 38 makes the Digital Personal Data Protection Act, 2023 supplementary to existing laws and preserves their concurrent operation. Where a provision under that framework conflicts with another law in force, the digital personal data protection provision prevails only to the extent of the inconsistency. It therefore combines cumulative legal application with a limited conflict-resolution rule favouring the data protection regime.

Public-access blocking may be directed after the Board reports monetary penalties against a Data Fiduciary on two or more occasions and advises blocking in the interests of the general public. Blocking may target information in a computer resource enabling the Data Fiduciary to offer goods or services to Data Principals in India. The Data Fiduciary must be heard, reasons must be recorded in writing, and intermediaries must comply with issued directions.

Section 36 empowers the Central Government to require the Board, any Data Fiduciary, or any intermediary to furnish information for the purposes of the Digital Personal Data Protection Act, 2023. This creates a statutory information-furnishing obligation for the Board and regulated entities when information is called for.

Good-faith actions or intended actions under the Digital Personal Data Protection Act, 2023 and its rules are protected from suits, prosecutions and other legal proceedings. The protection covers the Central Government, the Board, its Chairperson, Members, officers and employees for conduct undertaken or intended in good faith while exercising functions under the statutory framework.

Penalties imposed by the Board under the Digital Personal Data Protection Act, 2023 must be credited to the Consolidated Fund of India. All sums realised through such penalties are required to be deposited in that fund.

Significant breaches of the Digital Personal Data Protection Act, 2023 or its rules may result in a monetary penalty specified in the Schedule. The Board may impose the penalty only after completing an inquiry, determining that the breach is significant, and giving the concerned person an opportunity to be heard. Penalty assessment considers breach severity, affected personal data, repetition, gains or avoided losses, mitigation, proportionality, deterrence, and likely impact.

Voluntary undertakings may be accepted during compliance proceedings and may require specified action, restraint from action, or publication within a Board-determined period. Their terms may be varied with the undertaking giver's consent. Acceptance bars further proceedings on matters covered by the undertaking. Non-compliance with an accepted term is deemed a breach of the Act, following which action may proceed after an opportunity of hearing.

Alternate dispute resolution permits the Board, where it considers a complaint capable of resolution by mediation, to direct the concerned parties to attempt mediated resolution. The mediator may be selected by mutual agreement of the parties or in accordance with any law in force in India governing such mediation.

Appellate Tribunal orders under digital personal data protection law are executable by the Tribunal as civil-court decrees, with all powers of a civil court available for execution. The Tribunal may transmit an order to the civil court having local jurisdiction, which must execute it as though it were its own decree.

Any person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal within sixty days, subject to prescribed form, manner, and fee requirements. The Tribunal may condone delay for sufficient cause and, after hearing the parties, confirm, modify, or set aside the challenged order. Appeals should be disposed of expeditiously, with reasons recorded for delay beyond six months. Proceedings should function as far as practicable through a digital office.

Hon'ble Judges D.H. Waghela, J. For the Appellant : K.S. Nanavati, Sr. Adv., N. Chudgar and P.A. Mehta, Advs. in Criminal Misc. Application No. 3331 of 2003 and N.D. Nanavati, Sr. Adv. and Shakeel A. Qureshi, Adv. in Criminal Misc. Application No. 5302 of 2003 For the Respondents : Arun D. Oza, Public Prosecutor for Respondent No. 1, M.B. Gandhi, Adv. for Respondent No. 3 and Rajeshwar J. Dave, Adv. for Respondent No. 4 in Criminal Misc. Application No. 3331 of 2003 and Arun D. Oza, Pu... ... ...

The Board operates independently and, as far as practicable, through a digital office. It must determine whether sufficient grounds exist before commencing an inquiry, record reasons when closing proceedings or proceeding with inquiry, and follow the principles of natural justice. The Board has civil-court-like powers for summoning, evidence, document production and inspection, but cannot disrupt day-to-day functioning by preventing premises access or taking custody of essential equipment. Interim orders and final action require an opportunity of hearing, while false or frivolous complaints may attract warnings or costs.

The Board may direct urgent remedial or mitigation measures for notified personal data breaches, inquire into specified breaches involving Data Fiduciaries, Consent Managers, and intermediaries, and impose applicable penalties. It may issue necessary directions after hearing the affected person and recording written reasons, with mandatory compliance. On a representation by an affected person or a reference from the Central Government, it may modify, suspend, withdraw, or cancel a direction subject to appropriate conditions.