BACK TO DPDP ACT
DPDP Act 2023

Section 40

Power of Central Government to Amend Schedules

THE STATUTE

Original Text

The Central Government may, by notification, amend the Schedule.

Simplified

Section 40 is a short but functionally significant provision: it empowers the Central Government to amend the DPDP Act's Schedule by notification in the Official Gazette — without requiring parliamentary amendment of the Act itself. The Schedule to the DPDP Act contains specific lists of entities, categories, or provisions that are referenced in the substantive sections. The power to amend by notification enables agile regulatory responses: as the data protection landscape evolves — new types of data, new categories of entities, new technologies, new international relationships — the government can update the Schedule to reflect these changes without the delay and effort of parliamentary amendment. This Schedule amendment power is conceptually similar to the Second Schedule mechanism in the IT Act (under Section 3A), where the government can add or remove approved electronic signature technologies by notification. For the DPDP Act, it means that the government can expand or narrow exemptions, add new categories of legitimate uses, or adjust other schedule-based lists as implementation experience accumulates. The notification route for Schedule amendments means that changes become effective when published in the Official Gazette — subject to the parliamentary laying requirement for notifications that constitute 'rules' under the Act. This is one of the broadest executive powers in the DPDP Act in terms of its potential impact on substantive rights — a Schedule amendment could expand exemptions, narrow rights, or add new categories of processing without parliamentary vote.

Common Queries

Yes, if the exemption list is in the Schedule. Section 40 allows Schedule amendments by notification — the government can expand or narrow schedule-based exemptions without a parliamentary vote, subject only to the notification process.
Notifications under Section 40 that constitute 'rules' would be laid before Parliament under Section 39. However, not all notifications may qualify as rules — the scope of parliamentary oversight of Schedule amendments may be narrower than for rules under Section 38.
The Schedule contains specific provisions related to the Act's implementation framework. As the DPDP Rules and related notifications are issued, the Schedule's operational significance will become clearer.

Legal Context

Schedule amendment powers through notification rather than parliamentary amendment are used across Indian legislation — the Customs Act, FEMA schedules, and IT Act schedules can all be amended by subordinate legislation. For the DPDP Act, the power is particularly significant given that the Schedule may include sensitive lists like exempted entities or restricted processing categories.

Key Rules & Provisions

Schedule amendment by notification — no parliamentary amendment required.

Enables agile regulatory responses to evolving data protection landscape.

Broad executive power with significant impact on substantive rights.

Related Case Laws

In Re: The Kerala Education Bill (1958)

AIR 1958 SC 956
RELEVANCE

The Supreme Court's analysis of Schedule-amending powers — distinguishing substantive amendment (requiring parliamentary procedure) from schedule updates (permissible by notification) — frames the constitutional validity of Section 40. The power to amend Schedules by notification is constitutionally permissible if the Schedule contains implementing detail rather than rights-defining provisions.