The Cost of Non-Compliance: A Comparative Study of Penalties under GDPR (EU) and the Digital Personal Data Protection Act, 2023 (India)
This article is written by Anushka Jaiswal, pursuing a B.A. LL.B. (Hons.) from Christ (Deemed to be University).
The accelerated growth of digital economies has shown the importance of having strong data protection laws with the GDPR of the European Union being used as the international benchmark standard. In this scenario, the Digital Personal Data Protection Act of 2023 of India is an important step towards achieving data protection laws. The present paper will focus on carrying out a comparison between the penalty structure of GDPR and that of DPDPA in terms of monetary penalties.
In terms of the financial penalties levied by GDPR, there is a graduated system of fines, which allows the imposition of maximum fines of €10 million or 2 percent of global turnover for procedural breaches, whereas up to €20 million or 4 percent of global turnover can be levied as fine for the breaches of the core principles, the data subject rights and transfer restrictions. The Data Protection Act (DPA) also imposes financial penalties but only in form of a fixed monetary amount varying from ₹50 crore to ₹250 crore based on the type of the breach, with maximum penalties for breaches of security measures (₹250 crore), breach notification and protection of children's data (₹200 crore each).
The analysis brings out the main philosophical differences between the two legal frameworks under consideration: The GDPR espouses a rights-based, accountable framework which is extraterritorial, while the DPDPA embraces a pragmatic, State-based model which attempts to strike a balance between privacy and economic development. The absence of penalties based on turnover from the DPDPA could mean that it would not deter multinationals effectively compared to the GDPR, which does so through penalties depending on the size of the organization. This research finds that while the DPDPA represents a vital step forward in the Indian digital privacy domain, its penalty structure needs to be improved in order to match the GDPR.
DISCLAIMER: The views and opinions expressed in this research article, submitted by students and/or other contributors in their personal capacity, are solely those of the author(s) and do not, in any manner whatsoever, reflect or represent the views, opinions, advice, or official position of PACTEDGE LEGAL LLP (“PACTEDGE”). PACTEDGE makes no representations or warranties, whether express or implied, as to the completeness, accuracy, reliability, or currency of any facts, data, analysis, or legal propositions contained herein and shall not, to the fullest extent permitted by applicable law, be liable for any loss, injury, damage, or consequence arising directly or indirectly from any reliance placed upon this publication. The entire contents of this research article, including without limitation its text, structure, compilation, selection and arrangement of material, are and shall remain the exclusive intellectual property of PACTEDGE LEGAL LLP, protected under applicable copyright and other intellectual property laws. No part of this publication may be copied, reproduced, stored in a retrieval system, transmitted, adapted, published, communicated to the public, distributed, or otherwise made available in any form or by any means, whether electronic, digital, mechanical, photocopying, recording or otherwise, nor shared or reposted on any platform or medium, without the prior written consent of PACTEDGE LEGAL LLP; any unauthorised use shall constitute infringement and may attract civil and/or criminal consequences, without prejudice to any other rights or remedies available to PACTEDGE LEGAL LLP in law or equity.
Comments