India DPDPA: Article 38 – Consistency with other laws
38. Consistency with other laws
(1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.
(2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict.
What Article 38 Means for Your Business
Article 38 addresses how the DPDPA interacts with other Indian laws. The Act operates alongside existing legislation such as the Information Technology Act 2000, sectoral data protection rules in banking and telecom, and professional secrecy obligations. Understanding the interaction is essential for businesses operating in regulated sectors.
- Where the DPDPA is inconsistent with any other law, the DPDPA prevails, sector-specific rules that conflict with DPDPA obligations must yield to the Act.
- Sectoral regulators (RBI, SEBI, TRAI, IRDAI) may issue DPDPA-consistent guidelines for their sectors, check for sector-specific guidance before relying solely on the Act.
- The old IT (Reasonable Security Practices) Rules 2011 will remain in force until the phased implementation of DPDPA is complete, do not discontinue compliance with those rules prematurely.
- Contracts governed by laws other than the DPDPA that involve personal data processing must be reviewed for consistency with the Act’s requirements.