The DPDPA and sector rules, side by side

Updated 10 October 2026

The DPDPA applies on top of sector rules, not instead of them. Where a provision genuinely conflicts, the DPDPA prevails (s.38). Two exceptions matter most in practice: a law that requires you to keep records overrides the duty to erase them (s.8(7), s.12(3)), and a stricter rule on storing data outside India still applies (s.16(2)). A bank therefore still keeps KYC records for five years, stores payment data only in India, and reports cyber incidents to RBI and CERT-In within 6 hours, alongside its DPDPA duties.

This page compares the DPDPA with RBI, SEBI and CERT-In rules, checked against each official text on 10 October 2026. It is a summary for planning, not legal advice. IRDAI and ABDM rules will be added once checked against their originals. Spotted something out of date? Email hello@dpdpacms.com.

How the DPDPA fits with other laws

Section	What it says	What it means
s.38(1)	“The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.”	Sector rules keep applying alongside the DPDPA.
s.38(2)	“In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict.”	The DPDPA wins only where the two genuinely conflict.
s.8(7)	Erase personal data when consent is withdrawn or the purpose is no longer served, “unless retention is necessary for compliance with any law for the time being in force”.	A legal duty to keep records overrides the duty to erase.
s.12(3)	Erase on the Data Principal’s request unless retention is necessary for the specified purpose “or for compliance with any law for the time being in force”.	The same override applies to erasure requests.
s.16(2)	Nothing in s.16 restricts “any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data” outside India.	Stricter localisation rules survive.
s.17(1)(b)	Exempts processing by a body “entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function”, where necessary for that function.	Covers the regulator’s own processing, not the entities it regulates.

Obligation by obligation

Duties under the DPDPA’s Chapter II mostly apply from 13 May 2027. The sector rules below already apply.

Breach and incident reporting

DPDPA and DPDP Rules	Tell the Data Protection Board and each affected person without delay; detailed report to the Board within 72 hours (Rule 7, from 13 May 2027).
RBI	Report cyber incidents within 6 hours of detection on the DAKSH platform and notify CERT-In (2026 Directions for banks and NBFCs).
SEBI	Report to SEBI and CERT-In within 6 hours of noticing; details on the SEBI portal within 24 hours (CSCRF).
CERT-In	Report within 6 hours of noticing the incident (Directions, 28 April 2022).

How they fit: Parallel duties. Report to each body on its own clock. Only the DPDPA requires telling affected people.

Keeping and erasing records

DPDPA and DPDP Rules	Erase when consent is withdrawn or the purpose is served, unless a law requires retention (s.8(7), s.12(3)).
RBI	KYC: transaction records for at least five years from the transaction; identity records for at least five years after the relationship ends.
CERT-In	Keep logs of all ICT systems for a rolling 180 days, within Indian jurisdiction.

How they fit: Sector retention periods win. Erase once the last legal retention period ends.

Storing data outside India

DPDPA and DPDP Rules	Transfers abroad are allowed except to countries the government restricts (s.16(1)).
RBI	Payment system data stored only in India. If processed abroad, delete it there and bring it back within one business day or 24 hours, whichever is earlier.
SEBI	Regulatory data kept within India. If the data centre is abroad, a readable copy is kept in India (CSCRF).
CERT-In	Logs maintained within Indian jurisdiction.

How they fit: The stricter sector rule applies (s.16(2)).

Security safeguards

DPDPA and DPDP Rules	Reasonable security safeguards to prevent a breach (s.8(5)).
RBI	Board-approved cybersecurity and IT risk framework (2026 Directions).
SEBI	Full cyber resilience framework; data handling must follow the DPDP Act, the IT Act and CERT-In (CSCRF).
CERT-In	Logging and incident reporting duties.

How they fit: Both apply. Map your regulator’s framework to s.8(5) rather than assuming it covers it.

Who is responsible

DPDPA and DPDP Rules	A published contact for data protection questions (s.8(9)); a Data Protection Officer based in India for Significant Data Fiduciaries (s.10(2)(a)).
RBI	A senior-level CISO with no reporting line to the head of IT (2026 Directions).
SEBI	A CISO or designated officer (CSCRF).
CERT-In	A designated point of contact for CERT-In.

How they fit: Separate roles under separate rules. Decide who holds each before an incident.

What this means in practice

Map each record to its longest legal retention period before you set up erasure under the DPDPA.
Keep one incident log with the time of detection, because RBI, SEBI and CERT-In clocks run from noticing or detecting the incident.
Check where each system stores and processes data. RBI and SEBI localisation rules apply now, whatever the DPDPA allows.
Name who answers to which body: the CISO to the regulator and CERT-In, the DPDPA contact or DPO to Data Principals and the Board.

DPDPA CMS runs on your own servers in India, so consent records, rights requests and your data inventory sit alongside the systems these rules already govern. See the product, or check which DPDPA obligations apply to you.

Frequently asked questions

Does the DPDPA override RBI and SEBI rules?

Only where they genuinely conflict. Section 38(1) says the Act applies in addition to other laws, and s.38(2) gives it priority only to the extent of a conflict. Where a sector rule asks for more, such as a 6-hour incident report or local storage, both apply.

Can a bank erase KYC records when a customer asks?

Not while the KYC retention period runs. The DPDPA allows retention needed for compliance with any law (s.8(7) and s.12(3)), and RBI's KYC rules require records to be kept for at least five years. Erase them once that period ends.

Can payment data be processed outside India under the DPDPA?

The DPDPA allows transfers abroad except to countries the government restricts, but RBI requires payment system data to be stored only in India. Section 16(2) keeps RBI's stricter rule in place.

How many breach reports does a bank file?

For a cyber incident involving personal data, up to three: RBI on DAKSH within 6 hours, CERT-In within 6 hours, and from 13 May 2027 the Data Protection Board and each affected person without delay, with a detailed report to the Board within 72 hours.