Financial penalties are graded for personal-data non-compliance. A Data Fiduciary may face penalties for inadequate security safeguards or failure to notify the Board or affected Data Principal of a breach. Additional penalties apply to obligations concerning children and Significant Data Fiduciaries, while Data Principal duties, voluntary undertakings, and residual contraventions carry separate penalty exposure.

Section 44 makes consequential amendments connected with the Digital Personal Data Protection Act, 2023. It revises the listed Appellate Tribunals under telecom regulation, omits section 43A and a rulemaking provision under the Information Technology Act, 2000, and extends the section 81 proviso to preserve operation of the Digital Personal Data Protection Act, 2023. It also substitutes the Right to Information exemption with wording covering information relating to personal information.

The Central Government may issue Official Gazette orders necessary or expedient to address obstacles in implementing the Digital Personal Data Protection Act, 2023, provided the orders remain consistent with its provisions. The power cannot be exercised after three years from commencement, and every order must be laid before each House of Parliament as soon as practicable.

Central Government may amend the Schedule by notification, subject to a ceiling preventing any specified penalty from exceeding twice the amount originally specified. Each notified amendment has statutory force and takes effect on its notification date. The power permits revision of scheduled penalties within the prescribed ceiling, with immediate commencement through notification.

Parliamentary laying procedure requires rules and specified notifications to be placed before both Houses for an aggregate thirty-day period. Both Houses may jointly modify an instrument or determine that it should not be made or issued before expiry of the immediately following session. Modified instruments operate only in revised form, while annulment does not invalidate actions previously taken under them.

Central Government's delegated rule-making power permits rules, through notification and subject to previous publication, to carry out statutory purposes, provided they remain consistent with the governing provisions. Prescribed matters include notices by Data Fiduciaries, Consent Manager accountability and registration, permitted processing for designated benefits or services, and personal data breach intimation to the Board. Rules may also determine when a specified processing purpose is no longer served and require publication of a Data Protection Officer's business contact information.

Section 39 bars civil courts from entertaining suits or proceedings concerning matters within the Board's powers under the Digital Personal Data Protection Act, 2023. It further prohibits courts and other authorities from granting injunctions concerning action taken or proposed in exercise of powers under that framework, thereby excluding civil litigation and injunctive restraint in those matters.

Section 38 makes the Digital Personal Data Protection Act, 2023 supplementary to existing laws and preserves their concurrent operation. Where a provision under that framework conflicts with another law in force, the digital personal data protection provision prevails only to the extent of the inconsistency. It therefore combines cumulative legal application with a limited conflict-resolution rule favouring the data protection regime.

Section 37 permits the Central Government or a specially authorised officer to order public-access blocking of information on a computer resource enabling a Data Fiduciary to offer goods or services to Data Principals in India. The power requires a written Board reference concerning repeated monetary penalties and advice that blocking serves the general public interest. The Data Fiduciary must be heard, and written reasons must support the finding that blocking is necessary or expedient. Intermediaries receiving such directions must comply.

Section 36 empowers the Central Government to require the Board, any Data Fiduciary, or any intermediary to furnish information for the purposes of the Digital Personal Data Protection Act, 2023. This creates a statutory information-furnishing obligation for the Board and regulated entities when information is called for.

Good-faith actions or intended actions under the Digital Personal Data Protection Act, 2023 and its rules are protected from suits, prosecutions and other legal proceedings. The protection covers the Central Government, the Board, its Chairperson, Members, officers and employees for conduct undertaken or intended in good faith while exercising functions under the statutory framework.

Penalties imposed by the Board under the Digital Personal Data Protection Act, 2023 must be credited to the Consolidated Fund of India. All sums realised through such penalties are required to be deposited in that fund.

Significant breaches of the Digital Personal Data Protection Act, 2023 or its rules may result in a monetary penalty specified in the Schedule. The Board may impose the penalty only after completing an inquiry, determining that the breach is significant, and giving the concerned person an opportunity to be heard. Penalty assessment considers breach severity, affected personal data, repetition, gains or avoided losses, mitigation, proportionality, deterrence, and likely impact.

Voluntary undertakings may be accepted during compliance proceedings and may require specified action, restraint from action, or publication within a Board-determined period. Their terms may be varied with the undertaking giver's consent. Acceptance bars further proceedings on matters covered by the undertaking. Non-compliance with an accepted term is deemed a breach of the Act, following which action may proceed after an opportunity of hearing.

Alternate dispute resolution permits the Board, where it considers a complaint capable of resolution by mediation, to direct the concerned parties to attempt mediated resolution. The mediator may be selected by mutual agreement of the parties or in accordance with any law in force in India governing such mediation.

Appellate Tribunal orders under digital personal data protection law are executable by the Tribunal as civil-court decrees, with all powers of a civil court available for execution. The Tribunal may transmit an order to the civil court having local jurisdiction, which must execute it as though it were its own decree.

Any person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal within sixty days, subject to prescribed form, manner, and fee requirements. The Tribunal may condone delay for sufficient cause and, after hearing the parties, confirm, modify, or set aside the challenged order. Appeals should be disposed of expeditiously, with reasons recorded for delay beyond six months. Proceedings should function as far as practicable through a digital office.

Bail in allegations of fraudulent loan transactions requires assessment of the prima facie case, offence gravity and societal impact, public interest, and the risk of interference with justice. Alleged concerted siphoning of co-operative bank funds through loans was treated as seriously affecting depositors and the banking system. Temporary bail intended to enable recovery had not resulted in recovery. Alleged influence of the accused, together with a genuine apprehension of evidence tampering and interference with pending proceedings, weighed against release. Bail was therefore denied.

The Board must function independently and, as far as practicable, as a digital office for digital receipt, allocation, hearing and decision-making. It must assess whether sufficient grounds justify an inquiry, record written reasons when closing or pursuing proceedings, and conduct inquiries under principles of natural justice. It has civil-court powers to summon persons, receive affidavit evidence, require documents and inspect records, while being barred from disrupting access to premises or taking custody of items that adversely affect day-to-day functioning. Interim orders and post-inquiry action require an opportunity of hearing.

The Board may order urgent remedial or mitigation measures for personal data breaches, investigate specified breaches involving Data Fiduciaries, Consent Managers and intermediaries, and impose statutory penalties. After hearing the concerned person and recording written reasons, it may issue binding directions. Directions may be modified, suspended, withdrawn or cancelled on representation by an affected person or on Central Government reference, subject to conditions imposed by the Board.