72. Penalty for failure to comply with direction or order issued by the Authority.— If any data fiduciaryor data processor fails to comply with any direction issued by the Authority under section 62or order issued by the Authority under section 65,as applicable, such data fiduciaryor data processor shall be liable to a penalty which, in case of a data fiduciary may extend to twenty thousand rupees for each day during which such default continues, subject to a maximum of two crore rupees, and in case of a data processor may extend to five thousand rupees for each day during which such default continues, subject to a maximum of fifty lakh rupees. 73. Penalty for contravention where no separate penalty has been provided.— Where any person fails to comply with any provision of this Act, or rules prescribed or regulations specified thereunder as applicable to such person, for which no separate penalty has been provided, then such person shall be liable to a penalty subject to a maximum of one crore rupees in case of significant data fiduciaries, and a maximum of twenty five lakh rupees in all other cases. 74. Adjudication by Adjudicating Officer.— (1) No penalty shall be imposed under this Chapter except after conducting an inquiry in such manner as may be prescribed, and the data fiduciary or data processoror any person, as the case may be, has been given a reasonable opportunity of being heard. (2) While holding an inquiry, the Adjudicating Officer shall have the power to summon and enforce the attendance of any person acquainted with the facts and circumstances of the case to give evidence or to produce any document which, in the opinion of the Adjudicating Officer, may be useful for or relevant to the subject matter of the inquiry. (3) If, on the conclusion of such inquiry, the Adjudicating Officer is satisfied that the person has failed to comply with the provisions of this Act or has caused harm to any data principal as a result of any violation of the provisions of this Act, which a penalty may be imposed under section 69to section 73, the Adjudicating Officer may impose a penalty in accordance with the provisions of the appropriate section. (4) While deciding whether to impose a penalty under sub-section (3) of this section and in determining the quantum of penalty under section69to section 73, the Adjudicating Officer shall have due regard to the following factors, as may be applicable — (a) (b) (c) (d) (e) nature, gravity and duration of violation taking into account the nature, scope and purpose of processing concerned; number of data principals affected, and the level of harm suffered by them; intentional or negligent character of the violation; nature of personal data impacted by the violation; repetitive nature of the default; 43