On this page
If your business has followed the IT Act, 2000 for years, you may wonder what the DPDP Act does to it. This page sets out what the DPDP Act says about other laws, which parts of the IT Act it changes and from which date, and some of the words it borrows. It covers the DPDP Act, the Rules and the commencement notification only. We did not check the IT Act itself, any rules made under it, or any sector rules, and we say where that limits the answer. The sections on the law are cited in the Sources box. The section marked Our view is our opinion and carries no citation.
The short answer
The DPDP Act adds to other laws and does not replace them as a whole. It says its provisions are in addition to, and not in derogation of, any other law in force. Where a provision of the DPDP Act conflicts with a provision of another law, the DPDP Act prevails, but only to the extent of that conflict. The Act also amends the IT Act in three places, and those amendments start on 13 May 2027.
What the Act says about other laws
Two sentences carry the rule. The first says the Act is in addition to other laws. The second says that if a provision of the Act and a provision of another law conflict, the Act’s provision prevails to the extent of the conflict. Both started on 13 November 2025, the day the commencement notification was published.
The wording is narrow. It repeals no law as a whole, and it does not say the DPDP Act wins every time. It settles a conflict between a provision of the DPDP Act and a provision of another law, and only to the extent of that conflict. Whether two provisions conflict is a legal question about the particular words, so ask counsel before you rely on either side.
What changes in the IT Act, and when
The Act amends the IT Act in three places. The first is the provision numbered 43A, which the Act omits. The other two are a proviso that gains a reference to the DPDP Act, and a clause that is omitted from another provision. All three start on 13 May 2027, eighteen months after 13 November 2025. Until then, the DPDP Act’s changes to the IT Act are not in force. This page covers the DPDP Act, the Rules and the commencement notification only, so it does not set out what 43A provided.
| Law amended | What the DPDP Act does | Starts |
|---|---|---|
| IT Act, 2000 | Omits the provision numbered 43A, adds a reference to the DPDP Act in a proviso, and omits one clause from another provision | 13 May 2027 |
| Telecom Regulatory Authority of India Act, 1997 | Replaces two sub-clauses with three that name the Appellate Tribunals under the IT Act, the Airports Economic Regulatory Authority of India Act, 2008 and the DPDP Act | 13 November 2025 |
| Right to Information Act, 2005 | Substitutes one clause with a clause that reads “information which relates to personal information” | 13 November 2025 |
The DPDP Act and the RTI Act
The change to the Right to Information Act is already in force, from 13 November 2025. The DPDP Act substitutes one clause of that Act with a clause that reads “information which relates to personal information”. This page covers the DPDP Act, the Rules and the commencement notification only, so it does not set out what the earlier clause said or how the new words differ from it.
Words the DPDP texts take from the IT Act
The IT Act still matters for meaning. For example, the Rules give “computer resource” its IT Act meaning in the rule on security safeguards. The Central Government’s power under the DPDP Act to direct blocking of public access to information, on a written reference from the Board after it has imposed penalties on a Data Fiduciary in two or more instances, starts on 13 May 2027 and uses the IT Act meanings of computer resource, information and intermediary. Separately, the Appellate Tribunal for the DPDP Act is the Telecom Disputes Settlement and Appellate Tribunal, set up under the Telecom Regulatory Authority of India Act.
What this does not tell you
This page does not describe the IT Act, any rules made under it, or rules from sector regulators for banks, insurers or other regulated businesses. We have not checked whether they add duties of their own. The DPDP Act says it is in addition to, and not in derogation of, any other law in force. The timeline shows where each date falls.
Our view: what to do now
Our view. This is the order we would work in. Apart from the dates set out above, it makes no claim about the law.
- Find the references. Search your policies, customer contracts, vendor contracts and audit reports for mentions of the IT Act. Note each one that relies on the provision the table above shows as omitted from 13 May 2027.
- Keep your controls. A safeguard you already run is still worth having. The security safeguards checklist sets out what the DPDP Rules list.
- Plan the wording. Plan to change references to the omitted provision in the table above, so that once the omission takes effect your documents no longer rely on it.
- Ask about conflicts. If a sector rule you follow seems to clash with a DPDP duty, put the two provisions side by side and take counsel.
Common questions
Does the DPDP Act override the IT Act, 2000?
Only to the extent of a conflict. The Act says it is in addition to, and not in derogation of, any other law in force, and that where a provision conflicts with a provision of another law, the DPDP Act prevails to the extent of the conflict.
What happens to 43A of the IT Act?
The DPDP Act omits it, from 13 May 2027. Until then, the DPDP Act’s changes to the IT Act are not in force. This page covers the DPDP Act, the Rules and the commencement notification only, so it does not set out what 43A provided.
Which other laws does the DPDP Act amend, and when?
Three laws. The IT Act, 2000 is amended in three places from 13 May 2027. The Telecom Regulatory Authority of India Act, 1997 and the Right to Information Act, 2005 are each amended from 13 November 2025.
Is the Right to Information amendment already in force?
Yes, since 13 November 2025. It substitutes one clause of that Act with a clause that reads “information which relates to personal information”. This page covers the DPDP Act, the Rules and the commencement notification only, so it does not set out what the earlier clause said.
Do sector rules or other laws I follow still apply?
The DPDP Act says it is in addition to, and not in derogation of, any other law in force. Where a provision of the Act conflicts with a provision of another law, the Act’s provision prevails to the extent of the conflict. We did not check the IT Act, rules made under it or sector rules, so ask counsel whether a particular rule counts as such a law and whether it conflicts.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 02: Plan the work, in the toolkit
- How-to 01: Start here, in the toolkit
- The free duties list, every duty in plain words
In the news
- What are the Digital Personal Data Protection Rules and when do they apply?
Newspaper explainer on the DPDP Rules.
- DPDP Rules 2025: Fiduciary Duties Phase In Over 18 Months
Explains how the Rules start in stages over 18 months.
- Digital Personal Data Protection (DPDP) Rules, 2025: Key Highlights of the Newly Notified Framework
Summary of the DPDP Rules.
Sources
Every section, rule and date above was checked against the official text on 7 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
Official text: the Digital Personal Data Protection Act, 2023 (MeitY, PDF)
- Section 2(a)Appellate Tribunal: the Telecom Disputes Settlement and Appellate Tribunal under the Telecom Regulatory Authority of India Act, 1997
- Section 37(1) and (3)Blocking on a written Board reference after penalties in two or more instances; computer resource, information and intermediary take their IT Act meanings
- Section 38(1) and (2)In addition to and not in derogation of other laws; the DPDP Act prevails to the extent of a conflict
- Section 44(1)Telecom Regulatory Authority of India Act, 1997: two sub-clauses substituted with three
- Section 44(2)(a), (b) and (c)IT Act, 2000: from 13 May 2027, 43A omitted, a proviso amended and one clause omitted
- Section 44(3)Right to Information Act, 2005: clause (j) of section 8(1) substituted
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 6(2)Computer resource has its IT Act meaning
Notifications
Official text: commencement notification G.S.R. 843(E) (MeitY, PDF)
- G.S.R. 843(E), clause (a)Among others, sections 2, 38 and 44(1) and (3) in force on 13 November 2025
- G.S.R. 843(E), clause (c)Among others, sections 36, 37 and 44(2) in force eighteen months from 13 November 2025
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
