Consistency with Other Laws
Section 38: the Act applies in addition to other laws, and prevails over them where they truly conflict.
Section 38 says the DPDP Act sits on top of the other laws that already apply to you. You follow both, and only where the two cannot both be obeyed does the DPDP Act win.
Meaning of Consistency with Other Laws
Sector rules from regulators such as the RBI, SEBI, IRDAI and TRAI continue. A fiduciary should meet both the DPDP Act and the sector rule, and if a provision of another law truly conflicts with the Act, the Act prevails to the extent of the conflict.
Section 38 has two short sub-sections that do different jobs. Sub-section (1) says the Act is in addition to, and not in derogation of, any other law in force. Sub-section (2) says that if a provision of the Act and a provision of another law are in conflict, the Act's provision prevails to the extent of that conflict. In day-to-day compliance, sub-section (1) is the rule you will use ninety-nine times out of a hundred, and sub-section (2) is the tie-breaker for the rare occasion when it is impossible to satisfy two statutes at once.
Think of the layers an Indian business already lives with. A bank answers to the RBI's master directions on KYC and record retention. A broker answers to SEBI, an insurer to IRDAI, a telecom operator to the licence conditions and TRAI regulations, a hospital to the clinical establishment and medical council rules. None of these goes away because the DPDP Act exists. The Act adds a common layer on top: lawful ground, notice, consent, security safeguards, breach reporting, erasure and rights of the Data Principal. Most of the time the sector rule is simply the source of your "legal obligation" to keep or disclose something, and the DPDP Act accommodates it. Section 8(7), for example, lets you retain data beyond the purpose when a law requires it, and Section 7(d) lets you disclose data where a law obliges you to disclose it to the State.
A genuine conflict is narrower than it sounds. Two rules that overlap, or that set different levels of detail, are not in conflict if you can obey both. A conflict exists when obeying one would mean breaking the other. Even then, the DPDP Act prevails only to the extent of the conflict, so the rest of the other law keeps working. Section 38 also needs to be read alongside Section 16(2), which preserves any existing law that gives a higher degree of protection for, or places restrictions on, the transfer of personal data outside India. For cross-border transfers, a stricter sector rule therefore continues to bind you.
Section 38 is not the same as an exemption. Section 17 lists the situations where parts of the Act do not apply, and Section 44 amends specific laws such as the IT Act (omitting Section 43A) and the RTI Act. Where Parliament wanted another law changed, it said so in Section 44. Everywhere else the other statutes stand as they were, and your job is to map them against the Act rather than assume one replaces the other.
Examples of Consistency with Other Laws
A bank follows both RBI record-keeping rules and the DPDP Act's notice and consent rules.
A bank must keep customer identification records for the period its regulator prescribes, even after the account is closed. When a customer asks for erasure, the bank erases marketing preferences and unused profile data but keeps the KYC file, and its reply names the retention requirement. Both laws are met and no conflict arises.
A telecom operator holds call and traffic records under its licence conditions and also under the Rules' one-year log-retention duty. It sets a single [retention period](term/retention-period) that satisfies the longer of the two, restricts who can open the records, and erases them once both periods end.
A hospital group stores patient records for the period medical-council norms require, while the DPDP Act requires reasonable security and purpose-bound use. The hospital keeps the records, limits access to treating staff and the records team, and publishes a notice that explains why it cannot delete clinical history on request.
Why Consistency with Other Laws matters
The practical risk is not that the two laws collide, but that a team satisfies one and forgets the other. A lender that perfectly follows RBI's digital lending directions can still be in breach of the DPDP Act if its notice is not itemised or it cannot show valid consent. The reverse also happens: a company with an excellent consent flow may keep records for a shorter period than its sector regulator requires, and then faces the regulator, not the Board. Penalties under the DPDP Act go up to ₹250 crore for failure to maintain reasonable security safeguards, while sector regulators have their own enforcement tools, so exposure is cumulative.
Getting Section 38 right also saves money. A clear map of which obligation comes from which law lets you build one retention schedule, one disclosure-request procedure and one customer notice that serve several regimes together, instead of running parallel compliance programmes that contradict each other in practice.
How it works in practice
- 1Build a register of every law that touches personal data in your business: the sector regulator's directions, the Companies Act and tax record-keeping rules, labour laws for employee data, the IT Act and CERT-In directions, and any contractual or international obligations. For each, note what it requires you to collect, keep, disclose or restrict.
- 2Map each entry against the Act's duties. Mark where the other law supplies a legal obligation that lets you retain or disclose data, where it is simply stricter than the Act, and where it appears to pull in a different direction from the Act.
- 3For anything that looks like a conflict, test it first by asking whether both can be satisfied together, for example by retaining the data but restricting access, or by disclosing only what the law demands. Escalate to counsel only when compliance with one truly rules out the other, and record the reasoning.
- 4Write the sector-law basis into your notice and retention schedule, so a Data Principal who asks for erasure under Section 12 is told plainly which records you must keep and under which law, and for how long.
- 5Re-run the map whenever a regulator issues a new direction or the Government notifies a new Rule, and assign an owner. Sector regulators update their circulars frequently, and a map that is a year old is a liability.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming the DPDP Act overrides everything. It does not. Sub-section (1) preserves other laws, and sub-section (2) applies only to a true conflict. Treat the sector rule as binding until counsel confirms otherwise.
Calling overlap a conflict. Two laws asking for similar things, or one asking for more, are usually cumulative. Meet the stricter standard instead of choosing the Act over the sector rule.
Ignoring Section 16(2) for overseas transfers. A transfer that the DPDP Act would allow can still be barred or conditioned by a sector regulator's localisation or transfer rule. Check both before data leaves India.
Treating a sector rule as a blanket excuse. A regulator's retention requirement covers specific records, not everything you hold about a customer. Keep only what the other law actually demands and erase the rest.
Compliance tips
Keep a living "law-to-obligation" sheet with one row per statute or direction, the data it affects, and the owner. It makes audits and Board queries far quicker to answer.
Where two rules differ, default to the stricter one unless it clearly breaks the other. This is cheaper than litigating which one prevails.
Cite the specific legal basis whenever you refuse a Data Principal's request on the ground of another law, so the refusal can be checked and does not look arbitrary.
Brief your procurement and legal teams so that new contracts with processors flag any sector-specific clauses, such as audit rights for a regulator, alongside the DPDP security duties.
Common questions about Consistency with Other Laws
Does the DPDP Act override sector laws like RBI or IRDAI rules?
Not as a general rule. Section 38(1) makes the Act additional to other laws, so you follow both. Section 38(2) lets the Act prevail only where a provision truly conflicts with another law, and only to the extent of that conflict. Regulator directions generally continue to apply.
What happens if a sector law and the DPDP Act conflict?
If you cannot obey both, the DPDP Act's provision prevails to the extent of the conflict under Section 38(2). Because that is a legal judgment on specific facts, take professional advice, and note that Section 16(2) separately preserves stricter laws on cross-border transfers.
Can I keep data after erasure is requested because another law says so?
Yes, where the other law actually requires retention. Section 8(7) allows you to keep data when retention is necessary for compliance with a law. Keep only the records the law covers, restrict their use, and tell the Data Principal the reason.
Is Section 38 the same as an exemption under Section 17?
No. Section 17 removes certain duties of the Act for listed purposes or organisations. Section 38 is a rule about how the Act relates to other statutes. You can fall under Section 38 without being exempt from anything in the Act.