DPDP and neighbouring law
One incident, four rulebooks. Know the order before it happens.
An Indian company can owe duties under the Information Technology Act, 2000 (the IT Act), the CERT-In directions, a sector regulator's rules and the Digital Personal Data Protection Act, 2023, all for the same data. Most of these stack. A few overlap or pull in different directions. This page maps them and gives a way to decide.
Back to DPDP services01 · The layers
The instruments that touch personal data
From the general statute down to sector rules.
- IT ActInformation Technology Act, 2000The base statute for electronic records, offences and CERT-In's powers.
- SPDI RulesReasonable security practices rules, 2011Made under section 43A for sensitive personal data. Their parent provision is omitted by the DPDP Act.
- s.72AIT Act, section 72AAn offence for disclosing personal information in breach of contract. The DPDP Act does not amend it.
- CERT-InDirections under section 70B(6), April 2022Six-hour incident reporting, 180-day logs kept in India, clock synchronisation.
- DPDPDPDP Act, 2023 and Rules, 2025The general privacy law: notice, consent, rights, safeguards, breach intimation.
- SectorRBI, SEBI, IRDAI, health and telecom rulesStorage, outsourcing, cyber and reporting rules for regulated entities.
02 · What the Act changed
What the DPDP Act amends in older law
Section 44 makes three changes to the IT Act and one to the RTI Act.
- Section 43A omitted. The compensation provision for negligent handling of sensitive personal data is removed from the IT Act.
- Rule-making clause (ob) omitted. The power in IT Act section 87(2) used to make the 2011 security rules is removed.
- Section 81 proviso. The DPDP Act is added after the Patents Act in the list of laws whose rights the IT Act does not restrict.
- RTI Act section 8(1)(j). Rewritten to exempt information that relates to personal information.
The omission of section 43A, in section 44(2), takes effect only when the Act's main duties start, eighteen months after the November 2025 notification. Until then, section 43A and the 2011 rules still apply to you.
03 · Which applies first
A four-step test when several rules apply
Most of the time the answer is: all of them.
- Start from stacking. Section 38(1) says the Act adds to other laws, so meet every rule that applies.
- Where two rules set the same kind of duty, meet the stricter one and you usually meet both.
- Where they truly cannot both be met, section 38(2) says the Act prevails to the extent of the conflict.
- Two carve-outs point the other way: laws requiring retention (section 8(7)) and laws with tighter transfer limits (section 16(2)) keep applying.
Illustrative: a lender's logs
CERT-In directions require logs of ICT systems for a rolling 180 days in India. A customer asks for erasure. The logs hold the customer's IP address. The log duty is retention required by law, so the logs stay for that period, then age out on the normal cycle.
04 · Obligation map
Obligation, source and who it applies to
A working table. Confirm each sector entry against the current instrument.
| Obligation | Source | Who it applies to |
|---|---|---|
| Reasonable security safeguards | DPDP Act section 8(5) | Every data fiduciary, including for its processors |
| Breach intimation to the Board and each affected person | DPDP Act section 8(6) and the Rules | Every data fiduciary |
| Report listed cyber incidents within 6 hours | CERT-In directions, April 2022 | Service providers, intermediaries, data centres, body corporates, government bodies |
| Keep ICT logs 180 days in India | CERT-In directions, April 2022 | The same group |
| Synchronise clocks to NIC or NPL time | CERT-In directions, April 2022 | The same group |
| Keep subscriber records for 5 years | CERT-In directions, April 2022 | Data centres, VPS, cloud and VPN providers |
| Not disclose personal information in breach of contract | IT Act section 72A | Anyone providing services under a lawful contract |
| Store payment system data in India | RBI payment-data storage direction | Payment system operators and their partners |
| Cyber resilience framework and audits | SEBI cyber security framework | SEBI-regulated entities |
| Information and cyber security guidelines | IRDAI guidelines | Insurers and intermediaries |
| Health data handling rules | Health ministry and digital health policies | Health providers and platforms in scope |
| Telecom licence data duties | Telecom law and licence conditions | Licensed telecom operators |
05 · When rules clash
Handling a real conflict
Write the decision down; that record matters as much as the decision.
- Breach clocksCERT-In's six hours, the Board's intimation, a regulator's window. Run one playbook with a clock per body.
- Retention against erasureKeep what a law requires, for as long as it requires, then delete. Record the source.
- Localisation against transfer freedomThe Act restricts only to notified countries; a stricter sector rule still binds.
- Regulator access against confidentialityDisclosures a law compels are generally lawful; log what went to whom.
Sources: the Digital Personal Data Protection Act, 2023 (sections 8, 16, 17, 38 and 44); the Information Technology Act, 2000 (sections 43A, 70B, 72A, 81 and 87); the CERT-In directions under section 70B(6) dated 28 April 2022. Sector instruments are named at a general level.
Questions about overlapping Indian laws
Does the DPDP Act replace the IT Act?
No. It removes one IT Act provision and sits beside the rest.
Section 44 omits section 43A and the related rule-making clause, and adds the DPDP Act to section 81. The rest of the IT Act, including CERT-In's powers and section 72A, stays in force.
If we report a breach to CERT-In, do we still tell the Board?
Yes. They are separate duties.
CERT-In reporting is a cyber security duty under the IT Act. Intimation to the Board and to each affected person is a privacy duty under the DPDP Act. One incident can trigger both, plus a regulator's own reporting.
Our sector regulator is stricter than the Act. Which do we follow?
Usually the stricter rule, which also meets the Act.
Section 38(1) makes the Act additive. Meeting a stricter sector rule normally satisfies both. Only a genuine conflict brings in section 38(2), and that is a question to put to counsel.
Are the 2011 sensitive personal data rules still relevant?
Check the commencement date of section 44 first.
The Act omits the provisions those rules rest on. Once that change is in force, the DPDP Act and Rules take over the ground. Contracts that still refer to the 2011 rules should be updated.
See every duty on one page.
A DPDP readiness assessment maps your obligations across the IT Act, CERT-In, your regulator and the Act, and flags the overlaps. Counsel should confirm how the law applies to your contracts.