Section 38 — Consistency with Other Laws

Section 38 has two sub-sections doing two different jobs. 38(1) says the Act's provisions are in addition to, and not in derogation of, any other law currently in force — it supplements existing law rather than displacing it. 38(2) then handles what happens when that coexistence breaks down: where a DPDPA provision genuinely conflicts with a provision of some other law, the DPDPA prevails, but only to the extent of that conflict — a narrow, conflict-specific override, not a blanket claim of supremacy over every other statute.

Why "to the extent of such conflict" is doing real work

Most of what a sector regulator requires doesn't actually conflict with the DPDPA at all — it just runs alongside it, covering different ground. RBI's KYC retention mandates are a good example: Section 8(7) already builds in an exception for retention required by other law, so a bank keeping KYC records for the period RBI requires isn't in tension with the DPDPA's erasure duty in the first place. Section 38(2) only bites in the rarer case where a specific requirement under one law and a specific requirement under the DPDPA genuinely can't both be satisfied — and even then, the DPDPA only overrides the part actually in conflict, not the whole of the other law.

Why this matters in practice

Organisations under multiple regulators — banks and insurers answering to RBI, IRDAI and SEBI at once, telecom operators running TRAI's own consent framework alongside DPDPA consent, healthcare entities with no single sector regulator to defer to — tend to read Section 38 as either "DPDPA wins on everything" or "our sector rules exempt us from DPDPA." Neither reading is right. The correct posture is closer to running both frameworks together, mapping the handful of points where they actually diverge, and treating Section 38(2) as the tie-breaker for those specific points rather than as a general escape hatch either way.

Illustration: a telecom operator runs consent for promotional calls through TRAI's Digital Consent Acquisition facility, and separately needs DPDPA-compliant consent for other processing of the same customer's data. The two consent mechanisms serve different purposes and don't conflict — Section 38(1) lets them run in addition to each other. Only where TRAI's specific requirement and a specific DPDPA requirement genuinely couldn't both be honoured for the same processing would 38(2)'s override actually come into play.

How Section 38 connects to the rest of the Act

Section 34 relies on this same "addition, not derogation" logic from the other direction — it's part of why a Data Principal's separate damages claim under some other law survives the DPDP Act's own penalty-only remedy. Section 44 takes a more surgical approach to the same underlying problem, directly amending specific provisions of the TRAI Act, the IT Act and the RTI Act rather than leaving the interaction to a general consistency rule.