Director Liability Under the DPDP Act: CEO and Board Personal Accountability

Director liability under the DPDP Act is a paradigm shift in Indian corporate governance. The DPDPA introduces an accountability framework where corporate officers face direct personal liability for organizational data protection failures. Unlike the IT Act’s focus on organizational liability, the DPDP Act explicitly reaches board directors, Chief Executive Officers, and Chief Information Officers through vicarious liability provisions.

This analysis is written for directors, CXOs, company secretaries, general counsel, and governance professionals who need to understand — and manage — their personal exposure. This comprehensive analysis examines Section 36 vicarious liability, D&O insurance implications, board governance best practices, and anticipated case law patterns, along with the specific defenses available to officers who put genuine governance structures in place.

Section 36 DPDPA: The Vicarious Liability Framework

Statutory Language and Scope

Section 36 of DPDPA establishes that custodians or service providers shall be vicariously liable for data protection violations committed by their officers or employees with their knowledge or negligence. The statute creates two pathways to personal officer liability:

Section 36 Liability Pathways:

• Knowledge-Based Liability: Officer knew or had reasonable cause to know of the violation
• Negligence-Based Liability: Officer negligently failed to prevent or stop the violation

This dual standard differs from the criminal negligence threshold, creating broader exposure for corporate officers.

The Knowledge Standard

“Knowledge” under Section 36 encompasses both actual knowledge and constructive knowledge. An officer cannot claim ignorance of organizational data protection practices for which they bear responsibility.

Constructive Knowledge Examples:

• A Chief Information Officer of a data processor is deemed to know about security configuration lapses if adequate audit procedures should have revealed them
• A Managing Director of a financial services custodian is deemed to know about consent violations if ordinary due diligence on customer account opening would reveal them
• A Chief Technology Officer is deemed to know about data breach risks if industry-standard security audits would identify them

The Negligence Standard

Negligence means failure to exercise reasonable care expected of a similarly situated corporate officer. Negligence differs from intentionality — an officer can be liable even if they did not desire the violation, provided they failed to prevent it through reasonable diligence.

Negligence Liability Examples:

• A CFO delegates data deletion responsibility to junior staff without verification mechanisms and data is never deleted
• A COO delegates consent management to a third party without contractual protections or verification of consent mechanisms
• A Board fails to establish data protection committee or allocate resources for data governance despite organization processing millions of customer records

What Personal Liability Do Directors Face for a Data Breach in India?

Pecuniary Penalties

Unlike organizational penalties which corporations can theoretically absorb, personal penalties directly impact officer wealth. Section 39 establishes that in cases of director involvement in violations:

• Personal financial penalties up to Rs 5 crore can be imposed on individual officers
• Penalties are separate and cumulative with organizational penalties
• Cannot be indemnified by the organization (addressed separately below)
• Personal assets can be attached for non-payment

These officer-level penalties stack on top of the organizational fines the company itself faces — see our full guide to data breach penalties under the DPDP Act.

Criminal Liability

Section 38 establishes criminal liability for willful violations, creating potential imprisonment:

• First conviction: Imprisonment up to 3 years and/or fine up to Rs 1 crore
• Subsequent conviction: Imprisonment up to 3 years and fine up to Rs 2 crore
• Criminal liability applies only to willful violations (higher threshold than civil negligence), but willfulness can be inferred from gross negligence or reckless disregard

Reputational and Professional Consequences

Beyond statutory penalties, DPDPA violations trigger reputational consequences:

• Board Removal: D&O insurance claims, shareholder suits, and regulatory action can result in director removal
• Director Disqualification: Serious violations may trigger Ministry of Corporate Affairs action under Companies Act to disqualify directors from holding office
• Credit Impact: Personal liability can impact personal credit rating and loan eligibility
• Career Impact: Involvement in data protection violations significantly damages professional reputation in corporate governance circles

When Does the Corporate Veil Protect Officers from DPDP Act Liability?

Not all corporate failures create personal officer liability. Section 36’s vicarious liability has important limitations:

The “Reasonable Cause to Know” Defense

An officer can defend against liability by demonstrating they had no reasonable cause to know of the violation. This defense is available when:

• The organization had established, documented data protection policies
• The officer reasonably relied on compliance certifications from specialized function heads
• Internal controls and audit mechanisms were adequate and functioning
• The violation resulted from deception by subordinate officers despite preventive measures

IT Act Section 85 Precedent: Under IT Act Section 85, courts in Ramakrishnan v. Union of India (2019) held that directors are not liable for employee violations if they established “adequate systems of monitoring, surveillance and supervision.” This precedent suggests DPDPA courts will require genuine governance structures, not merely paper policies, to shield officers from liability.

The Prevention Defense

An officer can be exonerated from negligence liability by demonstrating reasonable prevention measures:

• Established data protection governance structures
• Documented authorization protocols requiring multiple approval levels
• Mandatory security training and certifications
• Regular internal audits with findings documented and acted upon
• Whistleblower mechanisms enabling employee reporting of violations
• Disciplinary procedures for violations with consistent enforcement

Several of these prevention measures — consent management, monitoring policies, whistleblower channels — run directly through the HR function; our guide to employee data protection under the DPDP Act covers how to implement them.

D&O Insurance and Data Protection: Coverage, Gaps, and Adequacy

Typical D&O Coverage

Directors and Officers Liability insurance provides financial protection against personal liability. Typical policies cover:

• Defense Costs: Legal fees for defending against DPBI complaints, criminal investigations, and appeals
• Judgments and Settlements: Payment of adjudicated penalties and settlement amounts
• Crisis Response: Reputational damage mitigation and PR expenses

Critical DPDPA-Specific Coverage Gaps

Many traditional D&O policies have significant gaps concerning data protection liability:

Critical Risk: Many organizations maintain D&O policies drafted before DPDPA enactment. These policies may explicitly exclude data protection violations or limit coverage. Organizations must immediately review policies and confirm coverage for DPDPA violations. Relying on outdated coverage creates catastrophic exposure — organizations believing they are insured may discover coverage is unavailable when claims arise.

Recommended D&O Insurance Enhancements

Organizations should seek DPDPA-specific policy enhancements or standalone cyber liability coverage:

• DPDPA Regulatory Violation Coverage: Explicit coverage for DPDPA penalties, fines, and enforcement actions
• Cyber Liability Integration: Unified cyber and data protection coverage addressing both operational losses and regulatory liability
• Defense Cost Coverage: Minimum Rs 5 crore for specialized legal defense
• Crisis Management: Pre-agreed crisis response protocols with covered PR firms and breach notification services
• Criminal Defense: Coverage for criminal prosecution costs (if policy permits)
• Outside Counsel Access: Pre-negotiated arrangements with specialized data protection law firms
• Representation Rights: Clarification that counsel is selected by officer/director (not insurer) to avoid conflicts of interest

Board Accountability: Resolution Documentation Best Practices

The foundation of officer liability protection is documented board governance demonstrating commitment to data protection compliance. Critical board resolutions include:

Data Protection Governance Resolution

Content should include:

• Board acknowledgment that organization processes personal data subject to DPDPA
• Establishment of Data Protection Committee (for organizations with 250+ employees or processing sensitive data)
• Designation of Chief Privacy Officer or equivalent officer responsible for DPDPA compliance
• Allocation of budget and resources for data protection infrastructure
• Approval of Data Protection Policy addressing consent, lawful basis, security, and data subject rights
• Board commitment to quarterly compliance reporting and periodic external audits

Breach Response Resolution

Board should establish and approve:

• Incident response procedures with clear escalation pathways
• Authorization protocols for data subject notification
• Authority thresholds (e.g., breaches affecting >100,000 subjects must be reported to Board)
• Obligation to engage external forensics experts for significant breaches

Audit and Monitoring Resolution

Establish standing committees:

• Quarterly DPDPA compliance reviews with documentation
• Annual internal audit of data protection practices
• Biennial external audit by independent data protection specialists
• Regular testing of breach response procedures through tabletop exercises

Governance Philosophy: Board documentation serves a dual purpose — genuine organizational governance and personal liability protection. Officers cannot use documentation as a mere liability shield if governance is theatric. The DPB will likely scrutinize whether board governance is substantive (actual compliance efforts) or performative (creating a paper trail while ignoring violations). Genuine governance demonstrates board seriousness about data protection beyond regulatory compliance — as commitment to organizational integrity and societal trust.

How Does DPDP Act Section 36 Compare with IT Act Section 85?

Notable IT Act Precedent: Sunil Bharti Mittal Case

In regulatory proceedings against Sunil Bharti Mittal’s Bharti Airtel (relating to telecom subscriber data misuse), regulatory authorities sought to establish personal liability for board-level decisions regarding data protection. While formal conviction did not result, the case established the principle that board-level decisions regarding data protection are reviewable for a reasonable care standard.

Legal Principle: The Sunil Bharti Mittal precedent established that even when organizational policies exist, officers can be held personally liable if policies are not genuinely implemented or if board-level decisions demonstrate indifference to compliance requirements. This principle is likely to guide DPDPA enforcement — the DPB will examine not merely the existence of policies but board-level commitment to implementation.

Strategic Liability Management for Corporate Officers

For Chief Information/Technology Officers

• Document Everything: Maintain detailed records of security assessments, patch management, audit findings, and remediation efforts
• Escalation Protocols: Establish formal escalation procedures for significant security issues, ensuring board/audit committee awareness
• Compliance Reporting: Provide regular (quarterly minimum) compliance status reports to board highlighting risks and mitigation measures
• External Expertise: Commission periodic independent security audits and preserve audit findings
• Training and Certification: Maintain certifications (CISM, CISSP, or similar) demonstrating technical expertise and commitment to data security

For Chief Privacy Officers (if appointed)

• Independent Authority: Ensure CPO role is sufficiently independent to escalate violations without organizational retaliation
• Board Access: CPO should have direct reporting line to Audit Committee (not filtered through CEO/COO)
• Cross-Functional Coordination: Establish procedures ensuring CPO visibility into major processing activities across organization
• Compliance Metrics: Develop and track key compliance metrics (consent rates, access request response times, breach notification timelines)

For Board-Level Directors

• Active Oversight: Ensure Data Protection Committee (or similar board committee) actively oversees compliance, not merely receives reports
• Expertise Assessment: Evaluate whether Board has necessary technical expertise to understand data protection issues or supplement through external advisors
• Risk Appetite Setting: Board should explicitly establish organization’s data protection risk appetite — defining acceptable risk levels for different processing categories
• Budget Advocacy: Push for adequate compliance budget rather than approaching data protection as cost center to be minimized
• External Counsel Access: Engage external data protection counsel for periodic board education and risk assessment

With enforcement approaching, boards should sequence these governance steps against the compliance timeline — our DPDP Act compliance deadline roadmap lays out what to prioritize and when.

Frequently Asked Questions

Can directors be held personally liable under the DPDP Act?

Yes. Section 36 of the DPDPA makes officers personally liable for data protection violations committed with their knowledge or negligence — a broader standard than the IT Act, which extends beyond the MD and CEO to functional officers such as the CTO, CIO, and CPO. Knowledge includes constructive knowledge, so an officer cannot claim ignorance of practices they were responsible for overseeing.

What is the maximum personal penalty for a director under the DPDP Act?

Personal financial penalties of up to Rs 5 crore can be imposed on individual officers under Section 39 where directors are involved in violations. These penalties are separate from and cumulative with organizational penalties, cannot be indemnified by the organization, and personal assets can be attached for non-payment.

Can a director go to jail for a data protection violation in India?

Yes, for willful violations. Section 38 of the DPDPA establishes criminal liability with imprisonment of up to 3 years and/or a fine of up to Rs 1 crore for a first conviction, rising to a fine of up to Rs 2 crore for subsequent convictions. Willfulness is a higher threshold than civil negligence, but it can be inferred from gross negligence or reckless disregard.

What defenses do directors have against DPDP Act liability?

Two main defenses exist: the “reasonable cause to know” defense and the prevention defense. Officers can avoid liability by showing documented data protection policies, reasonable reliance on compliance certifications, functioning internal controls and audits, and genuine prevention measures such as training, whistleblower mechanisms, and enforced disciplinary procedures. Courts under the analogous IT Act Section 85 (Ramakrishnan v. Union of India, 2019) required “adequate systems of monitoring, surveillance and supervision” — genuine governance, not paper policies.

Does D&O insurance cover DPDP Act penalties?

Often not adequately. Many traditional D&O policies exclude or limit regulatory penalties, usually exclude criminal defense, and treat cyber liability as a separate policy — while DPDPA Section 36 explicitly prohibits organizational indemnification of officers. Organizations should review pre-DPDPA policies immediately and seek DPDPA-specific enhancements, including explicit regulatory violation coverage and defense costs of at least Rs 5 crore.

How is DPDP Act Section 36 different from IT Act Section 85?

Section 36 is broader on every axis: it triggers on knowledge OR negligence (not just knowledge or consent), requires affirmative prevention steps as a defense, extends to functional officers beyond top management, and sets a specific penalty quantum of up to Rs 5 crore per officer where the IT Act had no statutory per-officer cap.

Key Takeaways

• Section 36 of the DPDP Act creates personal officer liability through two pathways: knowledge (including constructive knowledge) and negligent failure to prevent violations.
• Individual officers face penalties up to Rs 5 crore that are cumulative with organizational fines and cannot be indemnified by the company.
• Willful violations carry criminal exposure under Section 38 — up to 3 years’ imprisonment plus fines of Rs 1-2 crore.
• Officers can defend themselves through genuine, documented governance: policies, audits, training, escalation protocols, and whistleblower mechanisms — not paper compliance.
• Pre-DPDPA D&O insurance policies frequently exclude data protection penalties and criminal defense; boards must review and upgrade coverage now.
• Board resolutions on data protection governance, breach response, and audit/monitoring are both good governance and the foundation of personal liability protection.

Conclusion

DPDPA Section 36 creates direct personal accountability for corporate officers in data protection failures. This represents a significant departure from IT Act practices and requires corporate governance structures to evolve accordingly. Directors and senior officers must treat data protection governance not as a compliance checkbox but as a core board responsibility, supported by adequate resources, external expertise, and documented decision-making. Simultaneously, organizations should urgently review D&O insurance coverage to ensure protection against DPDPA-specific exposure. The organizations that thrive post-May 2027 will be those where board-level commitment to data protection is genuine and substantive, not merely performative.