Section 42 authorises the Central Government to amend the Schedule to the DPDPA through a notification. Since the Schedule presently specifies the maximum monetary penalties for different categories of breach, the provision allows those penalty amounts to be revised without requiring a formal amendment to the main body of the Act.
The Government’s power is subject to a clear ceiling. No penalty may be increased to more than twice the amount specified when the DPDPA was originally enacted. Accordingly, the maximum permissible increases under Section 42 are:
-
₹250 crore to ₹500 crore for failure to take reasonable security safeguards;
-
₹200 crore to ₹400 crore for breach-notification failures;
-
₹200 crore to ₹400 crore for breach of children’s-data obligations;
-
₹150 crore to ₹300 crore for breach of Significant Data Fiduciary obligations;
-
₹10,000 to ₹20,000 for breach of Data Principal duties; and
-
₹50 crore to ₹100 crore for other breaches of the Act or Rules.
The restriction is tied to the amounts in the Schedule as originally enacted, not to the amount appearing after an earlier amendment. The Government therefore cannot repeatedly double an amended penalty. For example, a ₹250 crore ceiling cannot first be increased to ₹500 crore and later doubled again to ₹1,000 crore under Section 42.
The Schedule may be amended only through a formally issued notification. Once notified, the amendment:
-
has effect as if it formed part of the Act itself; and
-
comes into force on the date of the notification.
Section 42 does not require a separate transition period. Organisations must therefore monitor Gazette notifications because a revised penalty ceiling may become operative immediately upon notification.
The power is confined to the Schedule. It cannot be used to amend the substantive provisions of the DPDPA, create new statutory duties, alter Data Principal rights or rewrite the Board’s powers. Any amendment must remain consistent with the Act and is subject to judicial review if it exceeds the delegated authority or violates constitutional requirements.
Notifications issued under Section 42 must also be laid before both Houses of Parliament under Section 41. Parliament may agree to modify or annul the notification. Such modification or annulment operates prospectively and does not invalidate actions already lawfully taken under the notification before the parliamentary decision.
Section 42 came into force on 13 November 2025 and is already operational.
In summary, Section 42 allows the Central Government to update the DPDPA’s monetary penalty Schedule promptly through notification, but no penalty may be increased beyond twice its originally enacted amount. Any amendment takes immediate statutory effect and remains subject to parliamentary oversight.