Section 38 of Digital Personal Data Protection Act, 2023 - Consistency with Other Laws

Section 38 of the Digital Personal Data Protection Act, 2023 explains how the Act operates alongside other laws in force in India and what happens when a provision of the Act conflicts with another law.

Current legal status: Section 38 came into force on 13 November 2025 under the Central Government's commencement notification issued under section 1(2) of the Digital Personal Data Protection Act, 2023.

Text of Section 38 - Consistency with other laws

38. (1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.

(2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict.

Meaning of Section 38

Section 38 contains two connected rules. First, the Digital Personal Data Protection Act, 2023 generally supplements other laws rather than displacing them. Therefore, obligations arising under another applicable statute can continue to operate alongside the DPDP Act.

Second, where there is an actual conflict between a provision of the DPDP Act and a provision of another law, the DPDP Act prevails, but only to the extent of that conflict. This means the overriding effect is limited to the inconsistent part; it does not automatically render the whole of the other law inapplicable.

Key expressions explained

Expression	Practical meaning
In addition to	The DPDP Act can operate together with other applicable laws.
Not in derogation of	The Act does not generally take away obligations or requirements imposed by other laws merely because both laws concern the same activity.
Conflict	A situation in which compliance with the relevant provisions cannot be reconciled, or the provisions impose inconsistent legal requirements on the same matter.
To the extent of such conflict	The DPDP Act receives priority only for the inconsistent portion; provisions that can coexist remain capable of operating.

Why Section 38 is important

Digital personal data may be processed in sectors already governed by other legislation. Section 38 provides the statutory rule for coordinating the DPDP Act with those laws. The first step is therefore to read the relevant legal requirements together. The overriding rule in section 38(2) becomes relevant only where a genuine conflict remains.

Interpretation note: Whether two provisions actually conflict depends on the wording, purpose and application of the particular laws involved. Section 38 itself does not declare that every difference between the DPDP Act and another statute is a conflict.

Commencement and the Digital Personal Data Protection Rules, 2025

The Central Government brought section 38 into force on 13 November 2025. The Digital Personal Data Protection Rules, 2025 were also notified in November 2025 with phased commencement for different rules. The Rules provide the implementation framework for provisions of the Act, while section 38 supplies the statutory rule governing consistency with other laws.

Official resources

For the authoritative statutory text and current implementation material, refer to the Digital Personal Data Protection Act, 2023 - official Gazette text, the commencement notification dated 13 November 2025, and the Digital Personal Data Protection Rules, 2025 - MeitY.

Related provision

Section 38 should be read in its statutory context with the succeeding provisions, including Section 39 - Bar of jurisdiction and Section 40 - Power to make rules.

Last updated: 24 September 2026. This page is intended for general legal information. For an issue involving overlapping statutory obligations, the relevant enactments and notifications should be examined in their specific factual context.