Section 42 of Digital Personal Data Protection Act, 2023 - Power to Amend Schedule
Section 42 of the Digital Personal Data Protection Act, 2023 gives the Central Government a limited statutory power to amend the Schedule to the Act by notification. The Schedule contains the monetary penalty ceilings applicable to specified breaches under the Act.
Text of Section 42 - Power to amend Schedule
42. (1) The Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted.
(2) Any amendment notified under sub-section (1) shall have effect as if enacted in this Act and shall come into force on the date of the notification.
Meaning and scope of Section 42
Section 42 is a delegated amendment power relating specifically to the Schedule. It allows the Central Government to revise the Schedule through an Official Gazette notification without requiring a separate amending Act for each permitted change. The power is not unlimited: where a notification increases a penalty, the revised amount cannot exceed twice the amount specified for that penalty when the Act was originally enacted.
What is a notification?
Section 2(r) of the Act defines a "notification" as a notification published in the Official Gazette. Accordingly, an amendment under Section 42 must be made through the prescribed Gazette notification process.
Effect of an amendment under Section 42(2)
Once validly notified, the amendment has effect as if it were enacted in the Act itself. It comes into force on the date of the notification. Users should therefore check the latest Gazette notification and the current Schedule before relying on a monetary penalty figure.
Limit on increase of penalties
The key statutory safeguard in Section 42(1) is the ceiling on executive enhancement of penalties. A notification under this section cannot increase a penalty beyond twice the amount originally specified for that penalty when the Digital Personal Data Protection Act, 2023 was enacted.
Relationship with Section 41
Section 41 requires every notification issued under Section 42 to be laid before each House of Parliament for the statutory period specified there. Parliament may agree to modify or annul the notification, without prejudice to the validity of anything previously done under it.
Official resources
For authoritative and updated material, refer to the Ministry of Electronics and Information Technology - Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Gazette notifications should be checked for any amendment to the Schedule under Section 42.
Frequently asked questions
Can the Central Government amend the Schedule?
Yes. Section 42(1) authorises the Central Government to amend the Schedule by notification, subject to the statutory restriction on increasing penalties.
Can a penalty be increased without limit?
No. A Section 42 notification cannot increase a penalty to more than twice the amount specified for it when the Act was originally enacted.
When does a Section 42 amendment take effect?
Under Section 42(2), the amendment takes effect on the date of the notification and operates as if enacted in the Act.
Is Section 42 currently in force?
Yes. Section 42 commenced on 13 November 2025 under the Central Government's phased commencement notification for the Act.
Updated: 24 September 2026. This page is intended as a statutory reference and general legal information. Always verify the latest Official Gazette notification for amendments.