DPDPA Section 38: Consistency With Other Laws

Everyone wants to know which law wins in a fight. When a sectoral regulation demands you keep data, and the DPDP Act demands you delete it, who blinks first?

DPDPA Section 38 provides the answer, but it is not the blanket override most companies hope for. It confirms two things: the DPDPA adds obligations on top of your existing statutes, and if a direct conflict cannot be reconciled, the DPDPA prevails,but only to the extent of that exact conflict.

For operators, the message is clear. You cannot use the DPDPA to sidestep other obligations, and you cannot ignore the DPDPA just because a sectoral statute also applies. You must run both tracks at once and resolve collisions using a consistent, defensible method.

What Section 38 Actually Says

• Additional, not substitutive: The Act is in addition to all other laws in force. It does not reduce or repeal them.
• Priority in conflict: If there is a conflict between a provision of the DPDPA and another law, the DPDPA prevails to the extent of that conflict.

This is a standard consistency clause with a clear priority rule. You apply every compatible law together. If they clash and cannot both be followed, the DPDPA takes priority, but only for the exact point of collision.

How to Interpret It Correctly

• Start with harmony: Do not jump straight to the priority rule. First, read the obligations together and find a way to comply with both. Courts and regulators will expect that.
• Use the conflict rule only when needed: If an obligation under another law makes it impossible to comply with the DPDPA for the same data and purpose, the DPDPA prevails for that narrow issue.
• No general exemptions: Following the DPDPA does not excuse you from other statutory duties. Following other statutes does not excuse you from the DPDPA, unless a direct and irreconcilable conflict exists.
• Precision matters: The phrase to the extent of such conflict limits how far DPDPA priority stretches. You do not get a blanket override just because two laws touch the same data.

Practical Implications for Compliance Teams

• Build a single view of obligations: Map each processing activity to all applicable legal duties. Include sectoral laws, retention mandates, disclosure requirements, and security norms.
• Engineer dual compliance by default:
• Purpose and legal basis: Record the statutory or regulatory basis alongside the DPDPA processing basis.
• Retention: Apply sectoral retention rules, then align deletion and minimization around them.
• Disclosures: Permit disclosures required by law, but gate them with DPDPA safeguards such as necessity, scope control, and security.
• Treat conflicts as exceptions with controls:
• Define a conflict assessment step in your workflow.
• Document the analysis that shows why the laws cannot both be satisfied.
• Apply the narrowest possible override and record the decision.
• Audit trail and accountability: Keep evidence of the harmonization attempt and the rationale for any DPDPA-priority decision. This is what you will need in audits.
• Policy integration: Update privacy notices, data retention policies, and incident response plans to reference sectoral frameworks where they materially change the outcome.
• Training and escalation: Train frontline teams on the harmonize-first rule, the conflict test, and when to escalate.

How It Works in Common Scenarios

• Financial record retention vs. minimization
• Situation: A financial law requires keeping transaction data for a set period. The DPDPA encourages keeping data no longer than necessary.
• Operation: Retain the mandated data for the full period. Limit access and use to the retention purpose, apply security controls, and delete once the statutory period ends. There is no conflict here if you confine processing to what the retention law requires.
• Right to Information requests vs. privacy protection
• Situation: A citizen requests information about a public official under the RTI Act. The DPDPA restricts unnecessary disclosure of personal data.
• Operation: Disclose only the information that serves the public interest under RTI. Withhold sensitive or irrelevant personal details. This harmonizes both laws by narrowing scope and applying necessity.
• Mandatory health reporting vs. data sharing limits
• Situation: Health regulations require a hospital to report certain patient data to a public authority. The DPDPA sets strict conditions on data sharing.
• Operation: Share the exact data required, through secure channels, for the mandated purpose only. Record the legal requirement as the basis. Apply minimization and security. Again, no conflict if execution is precise.

Boundaries and Pitfalls to Avoid

• Overstating conflict: If you can comply with both laws by narrowing scope, applying minimization, or adding controls, there is no conflict. Do not default to the priority rule out of convenience.
• Under-documenting analysis: Regulators will look for your reasoning path. Keep a clear record of how you attempted to harmonize and why you concluded a conflict exists.
• Ignoring the extent qualifier: When the DPDPA prevails, it does so only for the specific inconsistency. Do not expand the override beyond what is necessary.
• Using the DPDPA as a shield: You cannot refuse statutory disclosures or retention duties by citing privacy obligations when the law clearly requires action. Privacy is not a loophole for ignoring compliance.

What Changes in Practice

• Processing inventories must be legal-obligation aware: Tag each activity with its non-DPDPA legal hooks. This is your blueprint for harmonization.
• Decisioning moves from policy to workflow: Embed DPDP Act conflicts of law checks in intake, disclosure, retention, and deletion workflows. Remove one-off judgment calls.
• Incident response needs cross-law triggers: Breach notices or regulator engagement may be required under multiple frameworks. Coordinate timing and content to satisfy all.
• Data subject request handling becomes conditional: Respond to requests with a matrix that accounts for statutory limits or deferrals where other laws control access, retention, or disclosure.

A Simple Conflict-Handling Playbook

1. Identify the concrete obligation under each law for the same data and purpose.
2. Try to satisfy both using scope reduction, timing adjustments, or additional safeguards.
3. If impossible, document why and point to the exact provisions in conflict.
4. Apply the DPDPA to the extent of the conflict, and only that extent.
5. Record the decision, controls applied, and review date.

This is how you keep auditors comfortable and decisions defensible.

Closing

Section 38 is not complicated. It just demands disciplined execution. Read laws together first. Narrow the problem. Use the DPDPA’s priority only when a clash is real and irreconcilable. Then capture the decision like a regulator will later read it,because they probably will.

Most organizations struggle not with the rule, but with consistent, auditable application across systems and teams. At Regodit, we give you a structured way to map obligations, run harmonization checks, and document conflict resolutions without creating operational drag.

If operationalizing Section 38 with clear workflows, evidence, and controls is on your roadmap, it is time to stop relying on ad-hoc judgment calls and start building a defensible system.