What are the penalties for breaching the Data Protection Act?

Breaching the Data Protection Act, 2024 can mean an administrative fine from the Commission, a separate criminal charge, or both, and the figures are specific rather than open-ended. Administrative fines run up to P50,000,000 or 4% of worldwide turnover depending on what was breached, and criminal offences carry a P500,000 fine plus up to 9 or 10 years’ imprisonment depending on the offence. Below are the exact figures, section by section, since this is one of the most commonly searched, and most often loosely reported, topics in this guide.

Administrative fines have two tiers (s.83)

Section 83 sets a two-tier system for administrative fines imposed by the Commission. Which tier applies depends on what was breached, not on the size of the business.

Lower tier: up to P10,000,000, or for an undertaking, up to 2% of its total worldwide annual turnover for the preceding financial year, whichever is higher. This tier applies specifically to contraventions of obligations under:

• Section 29 (conditions for a child’s consent to information society services).
• Section 52 (data protection by design and by default).

Higher tier: up to P50,000,000, or for an undertaking, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher. This tier applies to contraventions of:

• The basic processing principles and consent conditions, Parts IV to VI of the Act.
• Data subject rights, Part VIII of the Act. See data subject rights.
• Cross-border transfer rules, Part XIV of the Act. See international data transfers.
• A failure to comply with a Commission order issued under section 16.

In both tiers, the fine is whichever of the two figures, the fixed Pula amount or the percentage of turnover, is higher for that business, not whichever is lower.

What decides where in the range a fine lands (s.82)

Section 82 does not let the Commission pick a number arbitrarily within the applicable cap. It has to weigh a defined list of factors:

• The nature, gravity and duration of the contravention.
• Whether the contravention was intentional or negligent.
• Any steps taken to mitigate the damage suffered by data subjects.
• Any previous contraventions by the controller or processor.
• The degree of cooperation with the Commission in remedying the contravention.
• The categories of personal data affected.
• How the Commission became aware of the contravention.
• Any financial benefit gained, or loss avoided, as a result of the contravention.

Fines do not replace anything else

An administrative fine under section 83 is additional to the Commission’s corrective powers under section 16, not a substitute for them. A business can face a compliance order, a processing ban, and a fine, all arising from the same contravention. A fine also does not prevent separate criminal liability under section 84 where the same conduct amounts to a criminal offence. A fine, a corrective order, and a criminal charge can all apply to the same underlying breach.

Criminal offences (s.84)

Section 84 creates three specific criminal offences, each carrying the same penalty: a fine of P500,000 or imprisonment of up to 9 years, or both.

• Section 84(1): failing to implement required security safeguards. Fine of P500,000 or imprisonment of up to 9 years, or both.
• Section 84(2): selling personal data. Fine of P500,000 or imprisonment of up to 9 years, or both.
• Section 84(3): the general offence provision, covering any other contravention of the Act that does not have a specific penalty set out elsewhere. Fine of P500,000 or imprisonment of up to 9 years, or both.

Two other specific offences elsewhere in the Act

Two further criminal penalties sit outside section 84, attached to specific provisions rather than the general enforcement Part:

• Obstructing an authorised officer during a search under section 15: fine of up to P500,000 or imprisonment of up to 10 years, or both. This is the highest prison term anywhere in the Act, and it is specific to obstructing an investigation, not a general penalty.
• A Commissioner, Deputy Commissioner or officer breaching their own confidentiality obligations under section 11: fine of up to P50,000 or imprisonment of up to 3 years, or both. This one runs the other way: it is a penalty on the regulator’s own staff for misusing information they access in the course of their duties, not on a controller or processor.

Getting the figures right

Some secondary sources summarise the Act’s criminal penalties as a vague “3 to 12 years,” which is not accurate. The actual imprisonment terms are precise and tied to specific offences: up to 9 years for the three offences under section 84(1) to (3), up to 10 years for obstructing a search under section 15, and up to 3 years for an officer’s own confidentiality breach under section 11. There is no 12-year term anywhere in the Act. Getting this wrong matters for a business trying to assess its real exposure, so treat any source that rounds these figures off, or blends them into a single range, with caution.