Sections 38-39 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 38 answers "what happens when the DPDP Act meets another law": it adds to other laws, and in a conflict it prevails to the extent of the conflict. Section 39 answers "can I go to a civil court": no court may entertain a suit or proceeding on a matter the Board is empowered to decide, and no injunction can be granted against action taken under the Act's powers. For disputes that cross these lines, our legal dispute resolution team can help.
Section 38(1): the Act is "in addition to and not in derogation of any other law". Section 38(2): in a conflict between a provision of this Act and any other law, this Act prevails to the extent of the conflict. Section 39: no civil court has jurisdiction to entertain any suit or proceeding on any matter for which the Board is empowered under the Act, and no injunction may be granted by any court or other authority in respect of action taken or to be taken under any power under the Act.
At a glance
| Section | Rule | Practical meaning |
|---|---|---|
| 38(1) | In addition to, and not in derogation of, any other law | Other laws on confidentiality, sector rules and contracts keep running alongside |
| 38(2) | In a conflict, this Act prevails to the extent of the conflict | Only the conflicting part yields |
| 39 (first limb) | No civil court may entertain a suit or proceeding on a matter the Board is empowered to decide | Use the Board and the Appellate Tribunal |
| 39 (second limb) | No injunction by any court or other authority against action taken or to be taken under any power under the Act | Action under the Act cannot be stopped by injunction |
Section 38(1): in addition
"The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force." So the Act does not replace the law on confidentiality, contracts, consumer protection or sector rules. A fiduciary must satisfy both. The words "not in derogation" mean that other laws are not reduced by this one. The Act names some laws it touches: the IT Act, 2000, the TRAI Act, 1997, the RTI Act, 2005, the Disaster Management Act, 2005 and the IBC, 2016, and it amends some of them in section 44. See section 44.
Section 16(2) is a specific case: other laws giving a higher degree of protection for or restriction on cross-border transfer continue to apply. See section 16.
Section 38(2): the Act prevails in a conflict
"In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict."
Three interpretive points.
- A real conflict is needed. If two laws can both be obeyed, there is no conflict. A stricter law that can be complied with alongside the Act does not conflict, and section 38(1) keeps it alive.
- Only "to the extent". The non-conflicting part of the other law survives.
- Any other law. The text does not limit this to earlier laws or to particular subjects. It does not say whether it overrides a later law; the wording "any other law for the time being in force" refers to laws in force at the relevant time.
A worked contrast. Suppose another law requires a record to be kept for a stated period and the Act's erasure duty (section 8(7)) would otherwise require erasure. Section 8(7) itself excepts retention "necessary for compliance with any law", so there is no conflict in the first place. See section 8 erasure. Conflict arises only where a provision of the Act and another law point in opposite directions and cannot both be met. Expect disputes about this to go through the Board and the Appellate Tribunal.
Section 39: the bar
"No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act."
Two limbs.
First limb: no civil court jurisdiction. Matters the Board is empowered to decide, such as inquiries on complaints and breach intimations and penalties under sections 27 and 33, cannot be taken to a civil court. The bar covers "any suit or proceeding". A Data Principal who wants a remedy against a fiduciary for a matter within the Board's functions must use the Board (after the grievance route under section 13(3)). The bar says "civil court"; it does not mention constitutional courts or the Appellate Tribunal's further appeal route, and the Act does not address them.
Second limb: no injunction. No "court or other authority" may grant an injunction in respect of "any action taken or to be taken in pursuance of any power under the provisions of this Act". This is wider than the first limb: it covers action "to be taken", so pending Board action cannot be restrained by an injunction, and it covers "other authority" as well as courts. The Act does not say whether the Appellate Tribunal's powers in an appeal are affected; the Tribunal has its own statutory powers.
What the bar does not do
- It does not stop an appeal to the Appellate Tribunal under section 29 or further appeal under section 29(9).
- It does not stop the civil court executing a Tribunal order under section 30(2).
- It does not cover matters outside the Board's empowered matters, such as a contract claim with no Act-based element. The Act does not draw that line; where it falls will depend on the facts.
- It does not say anything about criminal proceedings.
How 38 and 39 work together
Section 38 decides which rule governs; section 39 decides where the dispute is heard. A claim that a provision of the Act conflicts with, say, a contractual confidentiality clause is tested on section 38 but, if it concerns the Board's matters, it runs before the Board, not a civil court.
Practical guidance
- Do a conflicts check. For each policy built on another law, ask whether it can be met alongside the Act. If yes, keep both.
- Do not plan on an injunction to stop a Board inquiry or order. Plan a response, an undertaking or an appeal.
- Redirect claims. If a customer threatens a civil suit on a data matter within the Board's functions, point to the Board's route and the section 39 bar, and keep a dated record of the grievance process.
- Keep contract terms consistent. A contract clause that conflicts with the Act may yield to it, so review data clauses.
- Track sector rules as they stay in force under section 38(1).
Example
A customer sues a company in a civil court alleging breach of her data rights and seeks an injunction against the company's processing. The company relies on section 39: the matter is one the Board is empowered to decide. Separately, the company's record-keeping policy under another law is kept because it does not conflict with the Act (section 38(1)).
What the sections do not say
- No test for when a conflict arises.
- No list of matters within the Board's empowerment beyond the functions in section 27.
- No remedy for damages through the Board; section 34 sends penalties to the Consolidated Fund.
- No statement on the High Courts' or Supreme Court's jurisdiction.
Need help with conflicts between the Act and other laws?
Where a contract, sector rule or a pending claim meets the Act, it helps to settle early which rule governs and which forum hears the matter. Our legal dispute resolution team can help you map the position and choose a route.
Key takeaways
- The Act is in addition to other laws (section 38(1)).
- In a conflict, the Act prevails to the extent of the conflict (section 38(2)).
- Civil courts cannot entertain matters the Board is empowered to decide (section 39).
- No court or other authority can grant an injunction against action under the Act's powers.
- Appeals go to the Appellate Tribunal, not a civil court.
Read next
- Section 44 of the DPDP Act, 2023: amendments to the IT Act, RTI Act and TRAI Act
- Section 29 of the DPDP Act, 2023: appeal to the Appellate Tribunal
- Section 16 of the DPDP Act, 2023: transfer of personal data outside India
- Section 27 of the DPDP Act, 2023: powers and functions of the Board
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.