A Comprehensive Legal Analysis of Remedial Frameworks, Constitutional Foundations, Comparative
GDPR Jurisprudence, and the Path Forward for Data Principals in India
Created By Shubhank Suman- AI, Privacy, and IP Counsel
What This Report Covers-
- DPDPA mainly punishes organizations; it doesn’t pay victims. The Act’s enforcement model is built around the Data Protection Board conducting inquiries and imposing monetary penalties for “significant” breaches.
- Penalty amounts go to the Government, not to affected individuals. Even when large fines are imposed.
- DPDPA has no built-in “right to compensation” for data principals. The report highlights that unlike GDPR (Article 82), the DPDPA does not give individuals a direct statutory right to claim monetary damages for material or non-material harm from a breach.
- The older compensation route under IT Act Section 43A is gone after full DPDPA enforcement. The report notes that Section 43A earlier allowed compensation for negligent protection of sensitive personal data, but DPDPA specifically amends the IT Act under Section 44(2) by omitting Section 43A.
- Victims must rely on imperfect “alternative remedies” (consumer law, torts,). Since the Board cannot compensate, the report maps other legal options-like filing under consumer “deficiency in service,” civil tort claims (negligence/privacy), while stressing these routes are slower, more uncertain, and not designed as a clean compensation system
A. The Penalty Architecture - Sections 33 And 34
The penalty mechanism of the DPDPA is contained in Chapter VIII of the Act, specifically Sections 33 and 34, and the accompanying Schedule. Section 33(1) empowers the Data Protection Board to impose monetary penalties upon a Data Fiduciary or Data Processor following an inquiry if it determines that the breach is 'significant.' The Schedule specifies the upper limits of penalties for different categories of breach ranging from fifty crore rupees for failure to implement reasonable security safeguards under Section 8(5) read with Schedule Item 2, to two hundred and fifty crore rupees for the most serious violations.
Section 33(2) lists the factors the Board must consider when determining the quantum of penalty: the nature, gravity, and duration of the breach; the type of personal data affected; whether the breach was repetitive; whether the fiduciary gained financially; the mitigation measures taken; proportionality; and the likely impact on the organization. Notably absent from this list is any factor relating to the harm suffered by individual data principals. The Board is not directed to consider whether victims suffered financial loss, identity theft, emotional distress, or reputational damage. This structural omission confirms that the penalty mechanism is regulatory not compensatory, in its design.
Section 34 then provides that all sums realized by way of penalties imposed by the Board shall be credited to the Consolidated Fund of India. This is the provision that definitively closes the door on direct victim compensation through the DPDPA's penalty mechanism. The government acts as the sole beneficiary of the fines imposed in the name of protecting individual privacy.
Parameter | DPDPA (India) | GDPR (EU) |
|---|---|---|
Direct compensation right | no provision in the Act | Yes , Article 82 GDPR |
Non-material damage | Not recognised in the Act | Explicitly compensable under Art. 82 |
Penalty destination | Consolidated Fund of India (Sec. 34) | National / EU treasury , separate from Art. 82 |
Maximum fine | Up to INR 250 crore (fixed) | 4% global turnover or EUR 20M (higher) |
Non-material harm (fear) | No framework | CJEU: compensable if well-founded (NAP) |
B. The Structural Absence Of A Right To Compensation
A careful reading of the entire DPDPA reveals no provision that grants a data principal the right to claim monetary compensation from a Data Fiduciary for harm caused by a data breach. Compare this with the Information Technology Act, 2000, which under Section 43A explicitly creates a civil right of compensation for persons affected by a body corporate's failure to protect sensitive personal data. The DPDPA, which was intended to be the more comprehensive and modern successor framework, paradoxically provides less direct relief to victims than the older and more limited IT Act.
The Act does provide data principals with the right to file complaints with the Board (Section 13 read with the grievance redressal provisions), but the Board's powers upon inquiry are limited to imposing penalties which go to the government and issuing directions for compliance. The Board cannot order a Data Fiduciary to pay compensation to the affected data principal. This creates an anomalous situation where the regulatory body can punish the wrongdoer but cannot remedy the victim.
Illustration -
A large e-commerce company suffers a data breach affecting the financial and address details of approximately twenty lakh customers. The Data Protection Board conducts an inquiry and determines that the breach was caused by the company's failure to maintain adequate technical safeguards. It imposes a penalty of ninety crore rupees , one of the largest under the new Act. The company pays the fine, which is deposited into the Consolidated Fund of India. An affected customer who had fraudulent transactions made on her credit card following the breach approaches the Board seeking a direction that she be compensated out of the penalty amount. The Board informs her that it has no statutory authority to redirect penalty funds to individual victims. She must file a separate civil suit.
What Does Court Say?
The case of Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, decided by a nine-judge constitutional bench of the Supreme Court of India, held that the right to privacy is a fundamental right protected under Part III of the Constitution of India, particularly under Articles 14, 19, and 21.
Justice D.Y. Chandrachud, writing for one of the concurring opinions, articulated a theory of privacy that is both philosophically deep and practically relevant to data protection. He held that privacy encompasses the right of an individual to control the dissemination of information about oneself — what he termed 'informational privacy.' This dimension is directly implicated every time a Data Fiduciary processes, shares, or fails to protect personal data. He further held that privacy is not merely a negative right against state interference but also generates positive obligations on the state to protect individuals from private intrusions.
The relevance of Puttaswamy to the compensation question is profound. If the right to informational privacy is a fundamental right, then its breach particularly when caused by a Data Fiduciary's negligence or failure is not merely an administrative violation. It is an infringement of a constitutionally protected right. This constitutional status carries consequences: it suggests that any statutory framework claiming to protect privacy must provide effective, real-world remedies to victims. A framework that collects fines for the government while leaving the violated individual without recourse sits uneasily with the constitutional mandate.
The Puttaswamy judgment also established that any restriction on privacy must satisfy the test of proportionality: the means must be proportionate to the object. This test, when applied to the DPDPA's penalty-only mechanism, raises serious questions about whether redirecting all penalty funds to government coffers to the exclusion of victims is a proportionate response to privacy breaches.
In Anuradha Bhasin v. Union of India, (2020) 3 SCC 637, the Supreme Court reinforces the principle that digital rights including the right to control one's personal data on digital platforms are not second-class rights. When these rights are violated through data breaches, the individual's claim for redress deserves to be taken seriously as a matter of constitutional law, not merely as an administrative afterthought.
Alternative Remedies Available To Indian Data Principals
While the DPDPA does not provide direct compensation, Indian data principals are not entirely without legal recourse. A careful mapping of the existing legal landscape reveals several alternative pathways, each with its own procedural characteristics, limitations, and practical challenges.
A. Section 43A Of The Information Technology Act, 2000
Section 43A of the Information Technology Act, 2000 (read with the SPDI Rules, 2011) earlier provided a limited statutory pathway for a data principal to claim compensation from a “body corporate” for negligent failure to implement reasonable security practices in relation to “sensitive personal data or information,” where such negligence caused “wrongful loss or wrongful gain.” However, with the Digital Personal Data Protection Act, 2023 now fully in force, this compensatory mechanism is no longer available: DPDPA expressly amends the IT Act under Section 44(2) by omitting Section 43A. Consequently, post‑DPDPA enforcement, a data principal cannot rely on Section 43A as a statutory basis to seek damages/compensation for a personal data breach, and must look beyond Section 43A for any monetary redress (since DPDPA primarily establishes a regulatory, penalty-driven enforcement architecture rather than an individual compensation claim under the erstwhile IT Act
B. Consumer Protection Act, 2019
The Consumer Protection Act, 2019 offers another avenue if the data principal can characterize the privacy breach as a 'deficiency in service.' A consumer who purchases a digital product or service -a subscription, a mobile application, an e-commerce platform -is arguably purchasing an implicit promise that their data will be protected. A data breach could be framed as a deficiency in the service provided. Under this theory, the data principal could approach the District Consumer Disputes Redressal Commission for compensation, including for mental agony and distress, which is recoverable under the Consumer Protection Act as 'unfair trade practice' or 'deficiency in service.' The limitation is that the data principal must establish a consumer-seller relationship and must show that the breach constitutes a deficiency in the specific service purchased, which is not always straightforward.
C. Law Of Torts - Negligence And Invasion Of Privacy
Indian tort law has historically recognized negligence as actionable where a defendant owes a duty of care to the plaintiff, breaches that duty, and thereby causes damage. A Data Fiduciary who fails to implement adequate security measures owes a duty of care to its data principals. A breach of that duty, resulting in a data leak, can ground a claim in negligence before a civil court. Additionally, the tort of invasion of privacy, though not comprehensively developed in India, has been recognized in principle by courts. The constitutional recognition of privacy in Puttaswamy strengthens the case for an actionable tort of privacy invasion, though the contours of such a tort in the Indian context remain to be fully judicially articulated.
Illustration -
A banking customer discovers that her account details and transaction history have been leaked by the bank's third-party data analytics vendor. She suffers phishing attacks and a financial loss of approximately forty thousand rupees. She consults a lawyer who maps out her options: (i) File a complaint with the Data Protection Board -which can fine the bank but cannot compensate her; (ii) File a consumer complaint before the District Forum for deficiency in banking service -relatively faster but with uncertain outcomes for data breach claims; (iv) File a civil suit for torts claim in the appropriate court -expensive and slow. None of these routes is swift, inexpensive, or certain.
The GDPR Model: Article 82 And The Right To Compensation
The European Union's General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, provides a fundamentally different approach to victim compensation. Article 82 of the GDPR creates a standalone, direct right to compensation for data subjects who suffer material or non-material damage as a result of an infringement of the Regulation. This right is exercisable against any controller or processor involved in the processing that caused the damage.
A. Article 82 - The Compensation Framework
Article 82(1) GDPR states that any person who has suffered material or non-material damage as a result of an infringement of the Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. The provision introduces three critically important features: first, it distinguishes between material damage (financial loss) and non-material damage (distress, anxiety, loss of control over personal information) -both are compensable; second, it imposes liability on the data controller for any infringement, with a special provision for processors who can be held liable for their own specific failures; third, it creates a right of exoneration -the controller or processor may escape liability only by proving that it is not in any way responsible for the event giving rise to the damage.
The GDPR's compensation framework is thus fully victim-centered, operating entirely independently of the administrative penalty mechanism. Supervisory authorities may impose fines under Article 83 (which, significantly, may go to national or European government funds), and simultaneously, affected data subjects may pursue compensation directly from the infringer under Article 82. The two mechanisms are complementary, not alternative.
B. EDPB Guidelines On Fine Calculation (2022, Version 2.1)
The European Data Protection Board (EDPB) Guidelines 04/2022 on the calculation of administrative fines under the GDPR provide important methodological clarity on how supervisory authorities should calibrate fines. The EDPB's five-step methodology -identifying processing operations, establishing a starting point for calculation based on infringement seriousness and organizational turnover, adjusting for aggravating and mitigating circumstances, identifying the legal maximum, and final proportionality review — is notable because at every stage it focuses on the severity of the infringement and the character of the perpetrator, not on restitution to the victim.
This design is deliberate: under GDPR, fines serve deterrence and enforcement functions, while victim compensation is handled separately under Article 82. The EDPB Guidelines explicitly provide that fines must be 'effective, proportionate and dissuasive' as required by Article 83(1) GDPR. The concern is regulatory efficacy, not individual restitution. This separation of functions, fines for deterrence, Article 82 for compensation, is structurally coherent. The DPDPA, in contrast, provides fines for deterrence but no equivalent of Article 82. It is as if the legislature borrowed one half of the European model and discarded the other.
A further point of contrast concerns the quantum of penalties. The GDPR allows fines of up to four percent of global annual turnover or twenty million euros (under Article 83(5)), whichever is higher. For a multinational corporation, this can translate to billions of euros. The DPDPA, in contrast, imposes a fixed maximum of two hundred and fifty crore rupees, approximately thirty million US dollars, regardless of the organization's global revenue. This means that a large multinational data fiduciary operating in India faces a comparatively modest deterrent, while Indian data principals receive neither equivalent fines nor direct compensation.
The CJEU's landmark ruling in Case C-300/21 (UI v. Osterreichische Post) addressed three critical questions about Article 82 GDPR compensation. The Court held that: (i) infringement of the GDPR alone does not automatically give rise to a right to compensation -the data subject must additionally demonstrate actual damage suffered; (ii) national courts cannot make the award of compensation conditional upon the damage being of a certain degree of seriousness -once actual damage is proven, however minor, compensation must follow; and (iii) Article 82 is not limited to financial damage; non-material damage, including distress, is fully compensable.
This ruling is particularly nuanced: the CJEU rejected the argument that any breach automatically entitles the data subject to compensation (preventing trivial claims), while simultaneously rejecting the imposition of a minimum seriousness threshold (preventing national courts from raising the bar so high that only severe harms qualify). The standard it strikes is reasonable: prove actual harm -however modest -and you will be compensated.
Critical Analysis: Systemic Failures And Structural Inadequacies
The most fundamental structural flaw in the DPDPA is the complete conceptual separation of the penalty mechanism from victim redress. Penalties under Section 33 are calculated without reference to individual victim harm. The Board is directed to consider organizational factors, turnover, mitigation measures, regulatory compliance history, but not the actual losses suffered by individuals. Section 34 then routes all penalty proceeds to the government. The result is a system that is well-designed for regulatory deterrence and poorly designed for individual justice.
This design choice reflects a legislative philosophy that conceives of data protection primarily as a market regulation problem rather than as a human rights problem. But the Supreme Court in Puttaswamy has already settled that data protection is constitutionally grounded in the fundamental right to privacy. A market regulation framework that ignores human rights consequences is not merely suboptimal, it is arguably constitutionally infirm.
B. The Section 34 Problem
Section 34's routing of all fines to the Consolidated Fund of India raises a specific policy concern: it eliminates any incentive for the enforcement system to be attentive to the scale of individual harm. When penalties benefit only the government, the government's interest in enforcement is purely fiscal and regulatory. There is no structural mechanism by which the voices of affected data principals can shape enforcement priorities or penalty quantum. In contrast, in a system where a portion of fines is reserved for a victim compensation fund, the enforcement agency has a structural incentive to hear and quantify individual harm, which in turn drives more victim-attentive enforcement.
C. The Non-Material Damage Blind Spot
The existing alternative remedies available to Indian data principals - Section 43A of the IT Act, consumer law, and tort , are all focused primarily on financial, measurable harm. They are poorly equipped to address non-material damage: the anxiety of having one's private medical history exposed, the psychological distress of knowing that intimate photographs have been circulated, the reputational damage of having one's mental health diagnosis disclosed to an employer. The CJEU's jurisprudence under Article 82 has firmly established that these non-material harms are compensable in a mature data protection legal system. India has no equivalent framework.
Illustration - The Uncompensated Non-Material Harm
A tech professional discovers that a mental health application through which she sought therapy, sharing highly sensitive psychological notes, has suffered a data breach. Her records , including diagnoses of clinical depression and notes about suicidal ideation from several years ago , are among the leaked files. She has suffered no financial loss. However, she lives with the constant anxiety that her employer, colleagues, or family could access this information. She is unable to sleep; she withdraws from social engagement. Under Indian law, she has no clear legal pathway to claim compensation for these non-material harms from the mental health application. Under the GDPR / CJEU standard, she would have a robust Article 82 claim for non-material damages, potentially worth several thousand euros. The DPDPA's silence on this category of harm is its most human cost.