DPDPA Section 43: Government Power to Remove Implementation Difficulties

When a sweeping privacy law collides with operational reality, friction is inevitable. Edge cases emerge. Timelines clash. Definitions that looked perfect on paper suddenly stall in production.

DPDPA Section 43 is the government’s built-in mechanism to resolve that friction. It empowers the Central Government to remove practical obstacles in applying the Act. It is a tool for implementation, not a backdoor to rewrite the law. For operators and compliance teams, this provision will dictate how obligations actually land on the ground during the critical early phases of the DPDP implementation timeline.

What Section 43 Says

Section 43 authorizes the Central Government to issue orders to remove difficulties that arise in giving effect to the Act. The mechanics are straightforward, but the guardrails are strict:

• Official publication: Orders must be published in the Official Gazette.
• Strict consistency: Orders cannot be inconsistent with the Act itself.
• The ticking clock: The power expires exactly three years from the Act’s commencement.
• Democratic oversight: Every order must be placed before both Houses of Parliament as soon as possible after it is made.

In short, the Government can step in to fix practical snags, but only within clearly defined boundaries.

Nature and Limits of the Power

Section 43 is an administrative power designed to ensure the Act functions in the real world. It is not a blank check to amend the statute or alter core rights and obligations. Its limits matter just as much as its capabilities:

• Non-legislative character. This power supports execution. It does not replace formal rulemaking or legislative amendment.
• Consistency requirement. Any order must align with the text and purpose of the Act. If it contradicts the underlying law, it fails.
• Time limit. The power sunsets after three years from commencement. After that window closes, fixes require formal rules or amendments.
• Parliamentary oversight. Orders must be laid before Parliament, ensuring transparency and democratic scrutiny.
• Judicial review. Courts retain the power to strike down orders that are arbitrary, unreasonable, or inconsistent with the Act or the Constitution.

These boundaries keep the power focused exactly where it belongs: on execution, not policy change.

How the Power Operates in Practice

The Government may use executive orders, notifications, or directions to clear specific operational roadblocks. Typical applications include:

• Clarifying ambiguous terms where the Act leaves room for interpretation.
• Sequencing or phasing certain requirements to avoid market disruption.
• Aligning overlapping administrative procedures.
• Addressing unforeseen implementation edge cases.

Best practice expects consultation with stakeholders, even if it is not strictly mandated. Transparency in rationale and scope reduces the risk of legal challenge and market confusion.

What It Means for Organizations

A law that can be adjusted by executive order is a moving target. Here is how to prepare:

• Expect clarifications. Early implementation always generates questions. Watch for orders that settle interpretation gaps.
• Compliance can shift quickly. Orders are executive actions and may take effect immediately upon publication. Build change management that can absorb fast updates.
• Document decisions. Track how each order affects your obligations, processes, and controls. Update policies, notices, and records of processing accordingly.
• Contract governance matters. Review Data Processing Agreement (DPA) terms and vendor contracts to ensure they can adapt to changes stemming from Section 43 orders.
• Maintain a training cadence. Brief relevant teams when orders land. Security, engineering, product, legal, and operations need a shared understanding of the new reality.
• Monitor official sources. Rely on the Official Gazette and formal notifications, not secondary commentary or speculative blogs.

Interpretation Boundaries and Risk Controls

Section 43 is not a magic wand for policy redesign. Keep these boundaries in view when assessing new orders:

• No inconsistency with the Act. Orders cannot dilute consent requirements, expand permitted processing unlawfully, or reduce statutory rights.
• Narrow targeting. Orders must address actual difficulties in giving effect to the Act, not broader policy redesign.
• Temporal scope. If an order pretends to operate beyond three years from commencement, treat it as suspect and seek legal advice.
• Challenge exposure. Stakeholders can contest orders that exceed the power or undermine the Act’s objectives. Build compliance positions that can withstand a moving target without overreacting to speculative commentary.

Practical Illustrations

The following examples show how Section 43 could be applied, consistent with the text and limits of the provision:

• Clarifying data categories. If ambiguity leads to inconsistent classification across sectors, an order could define parameters and examples to ensure uniform application, provided it stays within the Act’s framework.
• Addressing new processing models. If new technologies produce data flows not contemplated during drafting, an order could clarify how core duties like consent, data minimization, or security apply in those contexts, without creating new rights or removing existing ones.
• Streamlining compliance procedures. If documentation or sequencing requirements create unnecessary bottlenecks, an order could simplify steps or extend deadlines, as long as it does not weaken the Act’s protections.
• Reconciling overlap with existing regulations. If sectoral rules create real conflicts, an order could set interpretation principles to harmonize obligations, while remaining consistent with the DPDPA.

In all cases, the order must operate as a bridge over a practical gap, not a bypass around the Act.

Action Points for Compliance Teams

• Build an intake process for government orders. Designate owners to track, triage, and summarize impact within 24 to 72 hours.
• Maintain an obligations register. Map each order to impacted processes, controls, data flows, and records of processing.
• Align change management and legal review. Ensure product, engineering, and security integrate legal interpretations into delivery plans.
• Update communications. Revise privacy notices, consent flows, and internal SOPs when orders adjust the practical interpretation.
• Plan for auditability. Keep evidence of how you interpreted and implemented each order, including rationale and approvals.
• Watch the clock. The three-year window matters. Late-stage orders may trigger concentrated changes. Prepare for a surge near the sunset.

Bottom Line

Section 43 is a practical tool for making the DPDPA work in the real world. It will matter most in the early implementation phase, where definitions, timelines, and procedures need adjustment to avoid paralysis. The power is constrained. It cannot rewrite the Act. But it can and will shape how your obligations apply in detail.

Execution is the gap most teams underestimate. Orders arrive, and the hard part is translating them into process changes, evidence, and clear ownership. Regodit provides a structured way to track these shifting obligations, map them to controls, assign work, and document proof. Because when the rules of implementation change overnight, you need a system that can adapt with speed and discipline.