Sections 41-43 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sections 41 to 43 are the Government's control panel and Parliament's check on it. Section 41 requires rules and notifications under sections 16 and 42 to be laid before Parliament for thirty days. Section 42 lets the Government amend the Schedule of penalties, but never to more than twice the original amount of any penalty. Section 43 lets it make an order to remove a difficulty in giving effect to the Act, within three years of commencement. For help tracking how these powers affect your compliance plan, see our legal consultation team.
Section 41: every rule and every notification under section 16 or 42 must be laid before each House of Parliament for a total of thirty days; Parliament may modify it or agree it should not be made, without prejudice to what was done earlier. Section 42: the Government may amend the Schedule by notification, but no penalty may be increased to more than twice what the Schedule specified when the Act was originally enacted; the amendment takes effect from the date of notification. Section 43: for a difficulty in giving effect to the Act, the Government may make an order not inconsistent with the Act, but not after three years from commencement.
At a glance
| Section | Power | Limit | Parliamentary check |
|---|---|---|---|
| 41 | Laying of rules and notifications under sections 16 and 42 | Thirty days in total, in one session or successive sessions | Modify or annul by agreement of both Houses |
| 42(1) | Amend the Schedule by notification | No increase above twice the original penalty | Laid under section 41 |
| 42(2) | Effect of amendment | As if enacted in the Act; in force from the date of notification | - |
| 43(1) | Order to remove difficulties, published in the Official Gazette | Provisions must be "not inconsistent" with the Act and necessary or expedient | Laid before each House (43(3)) |
| 43(2) | Time limit | No order after three years from commencement | - |
Section 41: laying before Parliament
The text: "Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions." If, before the expiry of the session immediately following, both Houses agree to modify the rule or notification, or agree that it should not be made or issued, it then has effect only in the modified form or is of no effect. The section protects "anything previously done" under it.
Key points:
- What is covered: rules under section 40, notifications under section 16 (transfer restrictions) and notifications under section 42 (Schedule amendments).
- What is not named: other notifications under the Act, for example those under section 17 (exemptions), section 10 (Significant Data Fiduciary), section 1(2) (commencement) or section 18 (Board). The Act does not say they are laid. Confirm their status in the Government's notifications.
- Both Houses must agree to modify or annul; one House alone is not enough.
- Validity of past acts is preserved. A modification or annulment is "without prejudice to the validity of anything previously done".
The practical effect is that a rule or transfer restriction is in force from its making, and can later be changed by Parliament. Do not delay compliance while waiting for the thirty days to run.
Section 42: amending the Schedule
42(1) "The Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted."
42(2) Any amendment "shall have effect as if enacted in this Act and shall come into force on the date of the notification".
The cap, worked out
The cap refers to the amount "specified in it when this Act was originally enacted". It is measured against the original Schedule, not the current one. So repeated amendments cannot go beyond the original ceiling multiplied by two. On the original amounts:
| Schedule item | Breach | Original ceiling | Highest possible after amendment under s.42(1) |
|---|---|---|---|
| 1 | Reasonable security safeguards, s.8(5) | Rs 250 crore | Rs 500 crore |
| 2 | Notice of personal data breach, s.8(6) | Rs 200 crore | Rs 400 crore |
| 3 | Children's obligations, s.9 | Rs 200 crore | Rs 400 crore |
| 4 | Significant Data Fiduciary, s.10 | Rs 150 crore | Rs 300 crore |
| 5 | Duties of Data Principal, s.15 | Rs 10,000 | Rs 20,000 |
| 7 | Any other provision | Rs 50 crore | Rs 100 crore |
The table is arithmetic on the cap in section 42(1); no amendment is indicated by it. Item 6 (breach of a voluntary undertaking) has no fixed figure: it is "up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted". See the Schedule.
Observations:
- The restriction speaks of "increasing". The Act does not say in terms whether the power can be used to reduce a penalty, to add or delete items or to change the description of a breach; the text covers "amend the Schedule". Read each notification.
- The amendment operates from the date of notification, not retrospectively, and the Act does not say whether it applies to a breach that occurred before that date. Penalty under section 33 is "specified in the Schedule"; take advice where a breach straddles an amendment.
- An amendment is a notification under section 42, so section 41 applies and Parliament may modify it.
Section 43: removal of difficulties
43(1) "If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as may appear to it to be necessary or expedient for removing the difficulty."
43(2) "No order as referred to in sub-section (1) shall be made after the expiry of three years from the date of commencement of this Act."
43(3) Every order "shall be laid, as soon as may be after it is made, before each House of Parliament."
Three things to keep in mind.
- Not a general rule-making power. The order must be "not inconsistent" with the Act and aimed at a difficulty in giving effect to it.
- Three years from commencement. The Act does not say from which date the three years run when section 1(2) allows different dates for different provisions. Check the commencement notifications.
- Parliament sees the order. Section 43(3) requires laying, but the Act does not set a period or say what Parliament may do.
What this means for your planning
- Budget for the cap, not the current figure. Risk models should use the statutory ceiling, and recognise that it may be raised up to twice.
- Watch the Gazette for section 16 notifications, section 42 amendments and section 43 orders. Subscribe or set a review date.
- Keep a legal change log with the date of notification, what changed and who reviewed it.
- Do not wait for Parliament's thirty days before acting on a rule.
- Revisit contracts that cite specific penalty figures, since those may change.
Example
A company's risk register uses the Schedule's ceiling for safeguards failures. Suppose a notification under section 42 raises the ceiling. The company updates its register from the date of notification, confirms that the new figure is no more than twice the original, and notes that Parliament may modify the notification under section 41.
What the sections do not say
- No period for which a section 43 order stays in force.
- No statement that orders under section 43 can amend the Schedule; that is section 42.
- No statement about whether section 42 can reduce a penalty.
- No statement on retrospective effect of Schedule amendments.
Need help tracking changes to the Act?
Notifications, rules and orders can change your obligations and exposure without a new Act. Our legal consultation team can help you set up a change-tracking routine and update your compliance plan when something changes.
Key takeaways
- Rules and notifications under sections 16 and 42 are laid before Parliament for thirty days; Parliament may modify or annul them.
- The Schedule can be amended by notification, but no penalty may exceed twice its original amount.
- Schedule amendments take effect from the date of notification.
- A difficulty-removal order must be made within three years from commencement and be consistent with the Act.
- The Act does not say other notifications are laid.
Read next
- Schedule to the DPDP Act, 2023: penalties
- Section 40 of the DPDP Act, 2023: power to make rules
- Section 16 of the DPDP Act, 2023: transfer of personal data outside India
- Section 33 of the DPDP Act, 2023: monetary penalty and factors
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.