diff --git a/app/controllers/admin/settings_controller.rb b/app/controllers/admin/settings_controller.rb
index 6a0c5c033..4014cd7fc 100644
--- a/app/controllers/admin/settings_controller.rb
+++ b/app/controllers/admin/settings_controller.rb
@@ -7,12 +7,18 @@ class Admin::SettingsController < AdminController
   end
 
   def create
-    casted_settings.each do |k, v|
-      Setting[k] = v
-    end
+    @errors = Setting.params_errors(casted_settings)
+    if @errors.empty?
+      casted_settings.each do |k, v|
+        Setting[k] = v
+      end
 
-    flash[:notice] = I18n.t('records_updated')
-    redirect_to [:admin, :settings]
+      flash[:notice] = I18n.t('records_updated')
+      redirect_to [:admin, :settings]
+    else
+      flash[:alert] = @errors.values.uniq.join(", ")
+      render "admin/settings/index"
+    end
   end
 
   def show; end
diff --git a/app/models/setting.rb b/app/models/setting.rb
index 122bfc99a..cb52fd1b7 100644
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -6,4 +6,18 @@ class Setting < RailsSettings::CachedSettings
     Rails.cache.delete_matched('settings:.*')
     STDOUT << "#{Time.zone.now.utc} - Settings cache cleared\n"
   end
+
+
+  # cannot do instance validation because CachedSetting use save!
+  def self.params_errors(params)
+    errors = {}
+    # DS data allowed and Allow key data cannot be both true
+    if !!params["key_data_allowed"] && params["key_data_allowed"] == params["ds_data_allowed"]
+      msg = "#{I18n.t(:key_data_allowed)} and #{I18n.t(:ds_data_with_key_allowed)} cannot be both true"
+      errors["key_data_allowed"] = msg
+      errors["ds_data_allowed"]  = msg
+    end
+
+    return errors
+  end
 end
diff --git a/app/views/admin/settings/_setting_row.haml b/app/views/admin/settings/_setting_row.haml
index 632effc74..ab0d8d991 100644
--- a/app/views/admin/settings/_setting_row.haml
+++ b/app/views/admin/settings/_setting_row.haml
@@ -1,5 +1,5 @@
 - value = Setting.send(var)
-%tr
+%tr{class: (@errors && @errors.has_key?(var.to_s) && "danger")}
   %td= t(var)
   - if [TrueClass, FalseClass].include?(value.class)
     %td