Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter IX — Miscellaneous/Section 38 — Consistency with Other Laws
DPDP Act, 2023 · Chapter IX · Section 38 of 44

Section 38: Consistency with Other Laws

Section 38 answers a question that comes up constantly in practice: what happens when the DPDP Act and some other Indian law seem to say different things? The Act adds to existing law by default, but wins outright if there's a genuine conflict.

Effective from 13 May 2027Reviewed September 2026
Back to the Full DPDP Act GuideNext: Section 39 — Bar of Jurisdiction
StatusEffective 13 May 2027
Chapter IX · Miscellaneous

Quick summary

In plain terms: The Act's provisions are in addition to, not in derogation of, any other applicable law. But if a provision of the Act genuinely conflicts with a provision of any other law, the Act's provision prevails to the extent of that conflict.

What Section 38 says

  • Sub-section (1) — the Act's provisions shall be in addition to, and not in derogation of, any other law for the time being in force.
  • Sub-section (2) — in the event of any conflict between a provision of the Act and a provision of any other law for the time being in force, the Act's provision shall prevail to the extent of that conflict.

Breaking it down

This is a standard, but important, rule for how a new law interacts with India's existing legal landscape — and it operates in two distinct modes depending on whether there's an actual conflict.

The default mode is additive, not displacing. Sub-section (1) means the DPDP Act generally layers on top of existing sectoral laws — banking regulation, healthcare law, telecom rules, and so on — rather than replacing them. An organisation typically needs to comply with both the DPDP Act and its sector-specific obligations, not just one or the other.

The override only activates where there's a genuine, unavoidable conflict. Sub-section (2) is narrower than it might first appear — it only applies “in the event of any conflict,” meaning two provisions that can both be followed simultaneously (even if they overlap or address similar ground) don't trigger this override; it's for situations where compliance with one law would require violating the other.

Where a genuine conflict does exist, the DPDP Act wins, but only to the extent of that specific conflict. The override isn't a blanket statement that the DPDP Act trumps all other law generally — it's scoped precisely to the conflicting provisions, leaving the rest of the other law, and the rest of the DPDP Act, both fully intact and operative.

Why this section matters

Almost every organisation operating in a regulated sector already has to comply with sector-specific rules about data — banking KYC requirements, healthcare record-keeping rules, telecom data-retention obligations. Section 38 is what tells you how the DPDP Act sits alongside all of that: generally as an additional layer, but as the controlling rule specifically where a genuine conflict can't be avoided.

Real-world example

Example

Two different scenarios: addition versus conflict

A bank navigating both banking law and the DPDP Act:

  • Addition, not conflict — banking law requires retaining KYC records for a set number of years; the DPDP Act's Section 8(7) requires erasing data once the specified purpose ends, unless retention is legally required. These work together, not against each other — the legal-retention exception in Section 8(7) itself accommodates the banking-law requirement, so the bank complies with both.
  • A genuine conflict, hypothetically — if some other law required a bank to disclose certain customer data in a manner the DPDP Act's provisions would otherwise prohibit, with no way to satisfy both simultaneously, sub-section (2) would mean the DPDP Act's provision prevails, to the extent of that specific conflict.

Who needs to care about this section

  • Legal and compliance teams in regulated sectors — need to map DPDP Act obligations against existing sector-specific law, understanding they generally apply together rather than one displacing the other.
  • Anyone assessing a genuine conflict between the DPDP Act and another law — sub-section (2) is the specific rule that resolves such a conflict, but only where one truly exists.

Common questions

Does the DPDP Act override all other Indian laws about data?
No — sub-section (1) makes clear the Act generally applies in addition to other law, not instead of it. The override in sub-section (2) only applies where there's an actual, unavoidable conflict between specific provisions.
If our sector-specific law and the DPDP Act both address the same topic, does that automatically count as a conflict?
Not necessarily — if both laws can be complied with simultaneously (even if they cover overlapping ground), that generally isn't the kind of “conflict” sub-section (2) is addressing; a true conflict is where compliance with one would require violating the other.

Related sections

Section 39 — Bar of Jurisdiction

Continue to the next section in sequence.

Read Section 39

Section 37 — Power of Central Government to Issue Directions

Go back to the previous section.

Read Section 37

Chapter IX — Miscellaneous

See every section in this chapter together.

View the chapter

Full DPDP Act Guide

Back to the overview page, with the complete section-by-section guide.

View all 44 sections