A controller or processor that fails to comply with a section 35 directive can be required to pay a penalty of up to ten million rupees per non-compliance, doubled for repeat failures, taking into account gravity, mitigation, the effectiveness of the Data Protection Management Programme, cooperation, data categories, self-reporting, prior breaches and gains made; directors, partners and responsible officers are personally liable unless they show lack of knowledge or due diligence, and an appeal to the Court of Appeal needs the penalty deposited. Part VII has not yet been brought into operation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.