The Schedule's ₹250 crore ceiling isn't frozen forever — but it isn't infinitely adjustable by notification either. There's a hard cap on how far the Government can push it without going back to Parliament for a full amendment.
42. (1) The Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted.
(2) Any amendment notified under sub-section (1) shall have effect as if enacted in this Act and shall come into force on the date of the notification.
Section 42(1) lets the Central Government amend the Schedule — the penalty table Section 33 draws its figures from — by notification, without needing a fresh Act of Parliament. But it comes with one explicit restriction: no such notification can increase any penalty in the Schedule to more than twice what it was when the Act was originally enacted.
Take the Schedule's steepest figure, the ₹250 crore ceiling on a Section 8(5) security-safeguards breach. Section 42(1) lets the Government raise that by notification, but never past ₹500 crore — twice the originally enacted amount. Once that ceiling is reached, any further increase would need an actual legislative amendment to the Act itself, not another notification under this section. The same logic caps every other figure in the Schedule at twice its original amount, whatever that original figure happens to be.
Section 42(2) says an amendment notified under 42(1) has effect as if it had been enacted in the Act itself, and it comes into force on the date of the notification — there's no separate commencement delay built into this section. The notification is still subject to Section 41's parliamentary laying requirement, since Section 41 names Section 42 notifications specifically, so Parliament retains a window afterward to modify or annul it.
The Schedule an organisation is planning around today isn't necessarily the ceiling it will face in five years. The Government has a standing, relatively low-friction lever to raise every figure in the Schedule, up to double, without the delay of a full parliamentary Bill — and there's nothing in the Act that requires waiting any particular number of years before using it. Organisations doing long-horizon risk modelling around DPDPA exposure should treat the current Schedule as a floor for future enforcement risk, not a permanent number.
Section 33 is where the Schedule this section amends actually gets applied. Section 41 is the parliamentary check specifically named as applying to notifications under this section — meaning a doubled penalty figure still has to survive that thirty-day window before it's beyond challenge.
30 minutes to talk through what could actually change — no obligation.
Book a Consultation