How to Read the Power to Amend the Schedule Under Section 42 of the DPDP Act
The penalties under the Digital Personal Data Protection Act, 2023 are not in the body of the Act. They are in the Schedule, and the Schedule can be changed by notification without going back to Parliament first. The power to amend the Schedule is operative now, which makes its two limits worth knowing before the first notification rather than after.
Step 1: Note That This Provision Is Operative
Under commencement notification G.S.R. 843(E) dated November 13, 2025, section 41 and section 42 came into force on publication. The penalties the Schedule carries are imposed under section 33, which has not commenced, so the position is that the power to change the Schedule is live while the power to impose what it contains is not.
That is less odd than it looks. An amendment made now would simply be part of the Schedule when section 33 commences, and the Schedule is headed by a reference to sub-section (1) of section 33, which is the provision that gives it work to do.
Step 2: Read Sub-section (1) and Find the Restriction
Section 42(1) provides that the Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when the Act was originally enacted.
The ceiling is measured against the Act as originally enacted, not against whatever the Schedule says at the time of the notification. So the power cannot be exercised twice to compound an increase, and a submission that reads the restriction as twice the figure then in force has misread the reference point.
Step 3: Note What the Restriction Does Not Limit
The restriction is expressed in one direction only, as a bar on increasing a penalty beyond a ceiling. On the face of the sub-section it does not limit a reduction, and it does not limit an amendment to the description of a breach as distinct from the figure set against it.
That is a textual reading of the restriction and it matters because the Schedule is a table of breaches as well as of amounts. An amendment to the entry describing a breach would change what the penalty attaches to, which is a different kind of change from moving a number.
Step 4: Read Sub-section (2) for the Date of Effect
Section 42(2) provides that any amendment notified under sub-section (1) shall have effect as if enacted in the Act and shall come into force on the date of the notification.
Both halves do work. The amendment is given the status of a provision of the Act rather than of subordinate legislation, and it operates from the date of the notification, with no interval and no further step. There is nothing in the sub-section that makes effect wait on anything else.
Step 5: Read Section 41 for What Follows the Notification
Section 41 provides that every rule made and every notification issued under section 16 and section 42 shall be laid before each House of Parliament as soon as may be after it is made, while Parliament is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions.
If both Houses agree on a modification before the end of the session or the successive sessions, the instrument takes effect only in the modified form. If both Houses agree that it should not be made or issued, it has no effect at all.
Step 6: Put Sub-section (2) and Section 41 Together
Read with section 42(2), the sequence is that an amendment to the Schedule is in force from the date of its notification and is only afterwards exposed to modification or annulment by the two Houses. There is therefore a period in which an amended entry is operative and still liable to be undone.
The saving in section 41 is what resolves that. Any modification or annulment is without prejudice to the validity of anything previously done under the rule or notification, so what was done while the amendment stood is not unwound by its later fate.
Step 7: Note the Instruments Section 41 Names
Section 41 names section 16 and section 42. Section 16 is the power to restrict by notification the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India. Section 42 is the power to amend the Schedule.
The section does not name section 40, the power to make rules, and the laying requirement for an order under section 43 is in sub-section (3) of that section rather than in section 41. Where a question arises about whether a particular instrument must be laid, the answer comes from the provision that empowers it.
Step 8: Keep the Schedule as It Stood on the File
Because an amendment operates from the date of its notification and may be modified or annulled afterwards, the Schedule has a version history. Record which version applied on the date of the conduct, the date of the notification relied on, and whether the thirty day period had run.
A file that records the entry as it stood answers a question that cannot be reconstructed later from the current text. That record costs nothing to keep and is the only way to show which figure and which description of the breach were in force at the material time.
Common Pitfalls to Avoid
Looking for the penalties in the body of the Act: They are in the Schedule, which is headed by a reference to sub-section (1) of section 33.
Measuring the ceiling against the current figure: The restriction is measured against what was specified when the Act was originally enacted.
Reading the restriction as a limit on every amendment: It is expressed as a bar on increasing a penalty beyond a ceiling.
Assuming an amendment waits on Parliament: Section 42(2) brings it into force on the date of the notification.
Treating an amendment as subordinate legislation: It has effect as if enacted in the Act.
Overlooking the laying procedure: The instrument is laid for a total of thirty days, which may fall in one session or in successive sessions.
Assuming annulment unwinds what was done: The saving preserves the validity of anything previously done under the instrument.
Assuming section 41 covers every instrument: It names section 16 and section 42.
Key Statutory Provisions
Section 42 of the Digital Personal Data Protection Act, 2023: Power to amend Schedule. Sub-section (1) allows the Central Government by notification to amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when the Act was originally enacted. Sub-section (2) provides that an amendment so notified has effect as if enacted in the Act and comes into force on the date of the notification.
Section 41 of the Act: Laying of rules and certain notifications. Every rule made and every notification issued under section 16 and section 42 is laid before each House of Parliament for a total period of thirty days, which may be comprised in one session or in two or more successive sessions. Agreement of both Houses may modify the instrument or prevent it taking effect, without prejudice to the validity of anything previously done under it.
Section 16 of the Act: Processing of personal data outside India, the power by notification to restrict the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India.
Section 33 of the Act: Penalties, under which the Board imposes the penalty specified in the Schedule, and the provision to which the Schedule is keyed.
Section 40 of the Act: The power to make rules. It is not among the provisions named in section 41.
Section 43 of the Act: Power to remove difficulties. An order under it may be made only before the expiry of three years from the date of commencement of the Act, must make provisions not inconsistent with the Act, and is laid before each House of Parliament under sub-section (3) of that section.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Brings section 41, section 42 and section 43 into force on publication, while section 16 and section 33 commence eighteen months after publication.
Related in This Series
How to Build the Mitigation Case Before the Board Sets a DPDP Penalty: how the Board fixes the actual amount within the Schedule ceiling.
How to Deal With a Blocking Direction Under Section 37 of the DPDP Act: the sanction that follows a record of penalties.
Removal of Difficulties Order Corrects the DPDP Act on Children's Consent and Significant Data Fiduciary Audits: the other executive power to adjust the Act.
How to Determine the Application of the DPDP Act Under Section 3: the threshold question of whether the Act applies at all.
Sources and References
Section 42 of the Digital Personal Data Protection Act, 2023, bare text
Section 41, laying of rules and certain notifications, bare text
Section 16, processing of personal data outside India, bare text
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapter IX and the Schedule
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments