Section 41 subjects delegated legislation under the DPDPA to parliamentary oversight. It requires every rule made under the Act, together with notifications issued under Sections 16 and 42, to be placed before both the Lok Sabha and the Rajya Sabha as soon as reasonably possible after issuance.
The laying period must total thirty days while Parliament is in session. Those thirty days may fall within:
-
one parliamentary session; or
-
two or more successive sessions.
During the prescribed review period, both Houses may agree to modify the rule or notification or agree that it should not continue. If both Houses approve a modification, the instrument thereafter operates only in its modified form. If both Houses agree that it should not have been made or issued, it ceases to have effect.
This process does not mean that every rule remains legally inoperative until Parliament expressly approves it. A rule or notification ordinarily operates according to its specified commencement provisions unless Parliament subsequently modifies or annuls it through the Section 41 process.
Importantly, a later modification or annulment does not invalidate actions already taken while the original rule or notification was in force. Accordingly:
-
compliance undertaken under the original instrument remains valid;
-
proceedings validly conducted under it are not automatically reopened;
-
actions already completed do not become retrospectively unlawful merely because Parliament later changes the instrument; and
-
the modified or annulled position governs prospectively.
Section 41 applies to:
-
every rule made under the DPDPA, including the DPDP Rules, 2025 and future amendments;
-
notifications under Section 16, which may specify requirements concerning transfer of personal data outside India; and
-
notifications under Section 42, which may amend the monetary-penalty Schedule.
It does not state that every administrative order, Board decision or notification issued under every provision of the Act must undergo this parliamentary laying process.
Section 41 complements Section 40. Section 40 gives the Central Government power to make rules, while Section 41 preserves Parliament’s oversight over the exercise of that delegated power. The combination ensures that detailed regulatory requirements may be developed by the executive while remaining subject to legislative scrutiny.
The provision came into force on 13 November 2025 and is already operational.
In summary, Section 41 creates a parliamentary control mechanism over DPDPA rules and specified notifications. It allows both Houses to modify or annul those instruments while protecting the validity of actions already taken before that modification or annulment.