DPDP vs GDPR: The Differences That Catch Global Companies Out
TL;DR
The DPDP Act shares the GDPR's principles but differs in ways that break a copied programme. It has no legitimate interests basis, no sensitive-data category, no portability or objection rights, and no breach-reporting threshold. Children are anyone under 18, tracking and targeted ads to them are banned, and penalties are fixed rupee amounts per instance rather than a share of turnover. A GDPR programme is a strong starting point, not a finished one.
Who this is for: legal, privacy and compliance teams at multinational companies, and Indian companies already aligned to the GDPR, who need to know what their existing programme does not cover.
Many organisations approach the DPDP Act with a GDPR programme already in place. That is a real advantage: data mapping, security controls, vendor contracts and rights processes all carry over. But the two laws make different choices in places that matter, and a programme copied without change will over-comply in some areas and miss obligations in others.
This guide sets out the differences that most often catch global companies out. For the Indian law on its own terms, start with The DPDP Act, Explained.
The comparison at a glance
| Area | GDPR | DPDP Act |
| Data covered | Personal data, in any form, including structured paper filing systems | Digital personal data, and non-digital data once digitised |
| Territorial reach | Offering goods/services to, or monitoring behaviour of, people in the EU | Offering goods or services to people in India (no standalone monitoring trigger) |
| Publicly available data | Covered | Excluded if made public by the individual or under a legal obligation |
| Sensitive data | Special categories with stricter rules | No separate category |
| Lawful bases | Six, including legitimate interests and contract | Consent, or a listed legitimate use (Section 7) |
| Consent | Freely given, specific, informed, unambiguous | Free, specific, informed, unconditional, unambiguous, clear affirmative action, limited to necessary data |
| Notice | Detailed privacy information | Standalone, itemised notice with each consent request (Rule 3), in English or any Eighth Schedule language |
| Children | Under 16 (member states may lower to 13) for online services | Under 18; verifiable parental consent; tracking and targeted ads banned |
| Rights | Access (copy), rectification, erasure, restriction, portability, objection, automated decisions | Access (summary), correction and erasure, grievance, nomination |
| Duties of individuals | None | Section 15 duties, with penalties up to ₹10,000 |
| Breach reporting | To the regulator within 72 hours unless unlikely to pose risk; individuals if high risk | Every breach: individuals and Board without delay; detailed report within 72 hours |
| DPO and DPIA | Required in defined circumstances | Required for Significant Data Fiduciaries |
| Records of processing | Required (Article 30) | Not explicitly required |
| Processors | Direct obligations and liability | Obligations mainly via the fiduciary and contract |
| Transfers | Allowed to adequate countries or with safeguards | Allowed unless a country is restricted (negative list), subject to sector rules |
| Penalties | Up to €20 million or 4% of global turnover | Fixed maximums per instance, up to ₹250 crore |
| Compensation | Individuals can claim damages | No compensation route under the Act |
The five changes most programmes need
1. Rebuild the lawful-basis map
The biggest single change. Without legitimate interests or contract as bases, many GDPR justifications have no direct equivalent. Re-map each purpose to consent or a specific legitimate use under Section 7. Section 7(a), covering data voluntarily provided for a specified purpose, will absorb much of what "contract" covered, but marketing, analytics and profiling commonly justified as legitimate interests will usually need consent.
2. Rework notices
GDPR privacy notices are usually long documents covering everything. The DPDP Act requires a standalone, itemised notice with each consent request, understandable on its own, and accessible in English or any of the 22 Eighth Schedule languages. See how to write a DPDP privacy notice.
3. Raise the age, and remove tracking for minors
A GDPR setup built around a 13- or 16-year threshold leaves 16- and 17-year-olds unprotected under Indian law. Under the DPDP Act, anyone under 18 is a child, parental consent must be verifiable, and tracking and targeted advertising directed at children are banned outright. See verifiable parental consent.
4. Remove the breach-reporting threshold
GDPR teams are used to assessing whether a breach is "unlikely to result in a risk" before deciding to notify. The DPDP Act has no such test. Every personal data breach goes to affected individuals and the Data Protection Board. See the Rule 7 playbook.
5. Right-size the rights process
Indian individuals have fewer rights, but some are different. Remove portability and objection workflows for Indian users, add nomination (Section 14), and enforce the 90-day grievance limit. See Data Principal rights under DPDP.
What carries over well
- Data mapping. Your Article 30 records are an excellent base for a DPDP ROPA.
- Security controls. GDPR-grade security will usually meet the Rule 6 safeguards, though check log retention of at least one year.
- Vendor contracts. GDPR DPAs need updating, not replacing. See our DPA guide.
- Consent infrastructure. A consent platform built for GDPR can serve the DPDP Act if it supports per-purpose consent, notice versioning, multilingual notices and verifiable parental consent.
Where DPDP is less demanding
To avoid over-complying: the DPDP Act does not require records of processing outright, does not impose DPO and DPIA obligations on ordinary fiduciaries, has no portability or objection rights, excludes undigitised paper and self-published data, and allows transfers to any country not on a restricted list.
How ConsentifyAI helps
ConsentifyAI is built for the DPDP Act rather than adapted from a GDPR tool. It supports per-purpose consent and Section 7 legitimate-use mapping, standalone notices in Indian languages, verifiable parental consent, the four DPDP rights plus nomination, and evidence designed for the Section 6(10) burden of proof. For global teams, it gives the India-specific layer alongside existing GDPR controls.
Sources & references
- DPDP Act, 2023 — Sections 3, 4, 6, 7, 8, 9, 10, 11–15, 16, 33
- DPDP Rules, 2025 — Rules 3, 7, 10, 13, 14
- Other — GDPR (Regulation (EU) 2016/679)
Frequently asked questions
Is GDPR compliance enough for the DPDP Act?
No. GDPR programmes cover much of the groundwork, but the DPDP Act differs on lawful bases, children, rights, breach reporting, notices and penalties. Each needs specific changes.
Does the DPDP Act have a legitimate interests basis?
No. Processing must rely on consent or one of the specific legitimate uses in Section 7.
Which law has stricter breach reporting?
In some ways, the DPDP Act. It has no risk threshold, so every personal data breach is reported, and affected individuals must always be notified.
Are DPDP penalties higher than GDPR fines?
They are structured differently. GDPR fines can reach 4% of global turnover. DPDP penalties are fixed maximums per instance, up to ₹250 crore, regardless of company size.
Does the DPDP Act apply to EU companies?
Yes, if they process personal data in connection with offering goods or services to individuals in India.
Related reading
The DPDP Act, Explained: The Complete 2026 Guide for Indian Businesses
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law. It applies to almost every organisation that processes digital personal data of individuals in India, including foreign companies serving Indian users. The DPDP Rules, 2025 were notified on 13 November 2025, and most obligations (notice, consent, security, breach reporting, rights and grievance handling) become enforceable on 13 May 2027. Penalties reach ₹250 crore per instance. The organisations that will be ready are the ones treating compliance as an operating model, not a policy update.
ReadLegitimate Uses Under DPDP: When You Don't Need Consent
The DPDP Act allows only two lawful grounds for processing: consent, or a legitimate use listed in Section 7. The list is closed. It covers data individuals voluntarily provide for a specified purpose, certain state functions, legal obligations and court orders, medical emergencies, epidemics, disasters and employment purposes. There is no general "legitimate interests" ground. Choosing the right basis for each purpose decides which rights apply and whether withdrawal is possible.
ReadData Principal Rights Under DPDP: The Complete List (and What Isn't on It)
The DPDP Act gives individuals four rights: access to information (Section 11), correction and erasure (Section 12), grievance redressal (Section 13) and nomination (Section 14). Access and correction rights apply to data processed on consent or provided voluntarily. Unlike the GDPR, there is no right to data portability and no general right to object. Individuals also owe duties under Section 15. Businesses must publish how to make requests and resolve grievances within 90 days.
Read