Section 38 — DPDP Act, 2023
The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in force, except where— (a) a law expressly overrides this Act; or (b) the Central Government has exempted such other law from the operation of this Act.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 38 establishes the DPDP Act's relationship with other laws. The Act is not a supreme override of all other data-related regulation. It has effect over inconsistent provisions in other laws — but other regulators (RBI, SEBI, IRDAI, etc.) retain jurisdiction over their own regulatory frameworks. Where an obligation under another law conflicts with the DPDP Act, the DPDP Act generally prevails unless the other law expressly overrides it. For Data Fiduciaries in regulated sectors, this means DPDP compliance does not replace compliance with sectoral regulations — the two layers stack.
RBI's payment data localisation circular requires certain payment data to be stored in India. This is not in conflict with the DPDP Act (the Act does not prohibit India-storage). Both obligations apply simultaneously — the DPDP Act for consent and rights, the RBI circular for localisation.
Section 43A of the IT Act created civil liability for failure to protect sensitive personal information. The DPDP Act does not expressly repeal Section 43A. For now, both may apply to data breaches. Legal counsel should assess the interaction for breach-related liability.