41. Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the rule or notification or both Houses agree that the rule or notification should not be made or issued, the rule or notification shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule or notification

Legal Interpretation of the

Section 41 of the Digital Personal Data Protection Act, 2023 (DPDPA)

Legal Provision

Section 17 of the Digital Personal Data Protection Act, 2023 (India) deals with the “Laying of rules and certain notifications.” In essence, this provision ensures that all subordinate legislation—rules and specific notifications—issued under the Act are subject to parliamentary oversight. The intent behind this section is to maintain checks and balances, transparency, and democratic accountability in how the executive exercises its delegated legislative powers.

Textual Summary of Section 17

Section 17 requires that every rule made by the Central Government under the Act, as well as certain types of notifications specified by the Act, must be laid before each House of Parliament. This typically follows a standard procedure found in many Indian statutes to ensure that subordinate legislation can be scrutinized, amended, or annulled by Parliament if found inappropriate or inconsistent with the parent law.

Key Legal Interpretations

1. Scope of Application

Section 17 applies to:

All rules made under the DPDP Act, 2023.
Certain notifications specified within the Act (for instance, those identifying categories of personal data or setting procedures under specific provisions).

2. Timing and Procedure

The rules and notifications must be laid before both Houses of Parliament “as soon as may be” after they are made. This phrase generally means at the earliest possible legislative session after the issuance of such rules or notifications. The objective is to prevent undue delay and ensure that Parliament gets a prompt opportunity to review them.

3. Parliamentary Scrutiny and Control

Once laid before Parliament, the rules and notifications come under the scrutiny of both the Lok Sabha (House of the People) and the Rajya Sabha (Council of States). This allows members of Parliament to examine whether the subordinate legislation aligns with the objectives of the parent Act, does not exceed the delegated authority, and is not arbitrary or unreasonable.

4. Modification or Annulment

If Parliament finds any aspect of the rules or notifications unsatisfactory, it may suggest modifications or even annul them. If both Houses agree on certain changes, the Central Government is legally bound to implement those changes. Such modifications ensure that the final shape of subordinate legislation maintains consistency with legislative intent.

5. No Impact on Prior Actions

Typically, the annulment or modification of rules or notifications does not affect anything done under them before the modification or annulment. This preserves the validity of actions taken in good faith prior to Parliament’s decision.

Illustrations

Illustration 1 (Rule-Making for Data Protection Officers)

Suppose the Central Government issues rules under the DPDP Act specifying the qualifications, duties, and registration process for Data Protection Officers (DPOs). According to Section 17, these rules must be laid before both Houses of Parliament.

If, after review, Parliament concludes that the rules impose overly burdensome requirements on small companies or are ambiguous in certain respects, it can direct that the rules be amended. For instance, Parliament may decide that a certain educational qualification is unnecessarily restrictive. The government must then modify the rules accordingly—perhaps allowing more flexible criteria—before they take full and final effect.

Illustration 2 (Notification Defining Sensitive Data Categories)

Imagine the Central Government issues a notification designating certain new categories of personal data as “sensitive personal data” under the Act. This notification is placed before Parliament.

On review, if Parliamentarians find the category too broad—for example, including data that may not actually need special protections—Parliament could request that the category be narrowed. The government would then be required to issue a revised notification, ensuring the definition aligns better with the legislative intent.

Illustration 3 (Additional Procedural Regulations)

Consider a scenario where the government introduces a rule setting out detailed procedures for how individuals can request correction or erasure of their personal data. If Parliament believes the process is overly complex and not user-friendly, it may recommend simplifying the procedural steps. Once accepted, the government must amend the rules to reflect a more straightforward approach.

Conclusion

Section 17 of the DPDP Act, 2023 establishes a critical mechanism of checks and balances. It ensures that the power to frame detailed rules and issue significant notifications—often highly technical or specialized—remains anchored in democratic oversight.

By mandating the laying of such subordinate legislation before Parliament, Section 17 upholds transparency, prevents misuse of delegated power, and guarantees that the final shape of these rules and notifications is consistent with the overarching goals and principles of the statute.