DPDP vs GDPR: the key differences, section by article
India’s Digital Personal Data Protection Act and the EU’s General Data Protection Regulation side by side, each point checked against the official texts, plus what GDPR-ready companies still need to do.
Last updated 22 October 2026
How is the DPDP Act different from the GDPR?
India’s DPDP Act is narrower and more consent-centred than the GDPR. It covers only digital personal data, has two grounds for processing instead of six, treats everyone under 18 as a child, has no special categories, requires every breach to be reported, and sets fixed penalty caps up to ₹250 crore rather than turnover-based fines.
How do the DPDP Act and the GDPR compare, point by point?
Sources: the DPDP Act, 2023, the DPDP Rules, 2025 and the official text of Regulation (EU) 2016/679 on EUR-Lex.
| Topic | DPDP Act and Rules (India) | GDPR (EU) |
|---|---|---|
| Material scope | Digital personal data only, including data collected on paper and digitised later (s. 3(a)). Excludes personal or domestic use and data the individual made public (s. 3(c)) | Automated processing, and manual processing of data in a filing system (Art. 2(1)) |
| Territorial reach | Processing in India, and processing outside India connected with offering goods or services to people in India (s. 3(b)) | Establishments in the EU, and non-EU controllers or processors offering goods or services to, or monitoring the behaviour of, people in the EU (Art. 3) |
| Who is responsible | Data Fiduciary (s. 2(i)), responsible even for its processors’ processing (s. 8(1)) | Controller (Art. 4(7)); processors also carry some direct obligations, such as designating a DPO (Art. 37(1)) and fines (Art. 83(4)) |
| Grounds for processing | Two: consent, or “certain legitimate uses” listed in s. 7 (s. 4) | Six: consent, contract, legal obligation, vital interests, public task, legitimate interests (Art. 6(1)) |
| Consent standard | Free, specific, informed, unconditional and unambiguous with a clear affirmative action; withdrawal as easy as giving (s. 6(1), 6(4)) | Must be demonstrable; withdrawal at any time and as easy as giving (Art. 7(1), 7(3)) |
| Notice language | In English or any Eighth Schedule language, at the Data Principal’s option (s. 5(3), 6(3)); itemised contents under Rule 3 | Clear and plain language (Art. 7(2)); no fixed language list |
| Children | Under 18 (s. 2(f)). Verifiable parental consent for any processing, and no tracking, behavioural monitoring or targeted advertising directed at children (s. 9; Rule 10) | For information society services offered directly to a child, parental consent below 16; Member States may lower this, not below 13 (Art. 8(1)) |
| Sensitive data | No special categories in the Act; sensitivity is a factor for notifying Significant Data Fiduciaries (s. 10(1)(a)) | Special categories such as health, biometric, genetic, religious and political data are prohibited unless an exception applies (Art. 9) |
| Individual rights | Access to a summary, correction and erasure, grievance redressal, nomination (ss. 11–14) | Access, rectification, erasure, restriction, portability, objection and rights on automated decisions (Arts. 15–22) |
| Response time | Grievances answered within a published period not exceeding ninety days (Rule 14(3)) | One month, extendable by two further months (Art. 12(3)) |
| Breach notification | Every breach, to the Board and each affected Data Principal: without delay, then a detailed report to the Board within 72 hours (s. 8(6); Rule 7) | To the supervisory authority within 72 hours where feasible, unless unlikely to result in risk (Art. 33(1)); to individuals only for high risk (Art. 34(1)) |
| Data Protection Officer | Only for Significant Data Fiduciaries, and must be based in India (s. 10(2)(a)) | Public bodies, and large-scale regular monitoring or special-category processing (Art. 37(1)) |
| Impact assessment | Significant Data Fiduciaries only: periodic DPIA and audit, every twelve months (s. 10(2)(c); Rule 13(1)) | For processing likely to result in a high risk (Art. 35(1)) |
| Cross-border transfers | Allowed except to countries the government restricts by notification (s. 16(1)), subject to requirements on making data available to foreign States (Rule 15) and localisation of specified data for SDFs (Rule 13(4)) | Adequacy decisions (Art. 45) or appropriate safeguards (Art. 46) |
| Penalties | Fixed caps per type of breach, up to ₹250 crore (s. 33; Schedule) | Up to EUR 10 million or 2% of worldwide turnover (Art. 83(4)), or EUR 20 million or 4% (Art. 83(5)), whichever is higher |
| Regulator | One national Data Protection Board, working as a digital office (ss. 18, 28(1)); appeals to TDSAT (s. 29) | Independent supervisory authorities in each Member State (Art. 51(1)) |
Where is the DPDP Act stricter than the GDPR?
- Breach reporting has no risk threshold. Section 8(6) and Rule 7 require intimation of every personal data breach to the Board and each affected Data Principal. The GDPR exempts breaches unlikely to result in risk (Art. 33(1)) and only requires telling individuals of high-risk breaches (Art. 34(1)).
- Children means under 18. Section 2(f) and section 9 apply verifiable parental consent to every child under 18, for any processing. GDPR Article 8 sets 16, with an option down to 13, and only for information society services offered directly to a child.
- No legitimate interests ground. Processing that a GDPR controller runs on legitimate interests (Art. 6(1)(f)) needs consent or a specific section 7 use in India.
- Minimum log retention. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from processing, for the purposes in the Seventh Schedule, and Rule 6(1)(e) sets a one-year retention for security logs.
- Pre-erasure warning. Where a Third Schedule period applies, Rule 8(2) requires telling the Data Principal at least 48 hours before her data is erased.
Where is the GDPR stricter?
- Special categories of data have their own prohibition and exceptions (Art. 9); the DPDP Act has none.
- Rights to restriction, portability and to object, and rights on automated decisions (Arts. 18, 20–22), have no direct DPDP equivalent.
- DPOs and DPIAs apply more widely (Arts. 35 and 37); under the DPDP Act they apply only to Significant Data Fiduciaries.
- Turnover-based fines (Art. 83) can exceed the DPDP Schedule’s fixed caps for the largest companies.
- Restricted transfers by default (Arts. 45–46), against India’s approach of restricting only notified countries (s. 16(1)).
What do GDPR-compliant companies still need to do for DPDP?
A GDPR programme is a useful base, especially its data map, security controls and request handling. These are the gaps that most often need new work:
| Area | What to change for DPDP | Source |
|---|---|---|
| Lawful grounds | Re-map every processing activity to consent or a section 7 use; legitimate-interest and contract bases do not carry over | ss. 4, 7 |
| Notices | Standalone notice with an itemised list of data and purposes, links to withdraw consent, exercise rights and complain to the Board; available in Eighth Schedule languages | s. 5; Rule 3 |
| Children | Age-gate at 18 and run verifiable parental consent; stop tracking, behavioural monitoring and targeted ads aimed at children unless an exemption applies | s. 9; Rules 10, 12 |
| Breach playbook | Notify every breach to each affected person and the Board, with the detailed Board report within 72 hours | s. 8(6); Rule 7 |
| Retention | Keep processing logs for at least one year, then erase; send 48-hour pre-erasure notices where the Third Schedule applies | Rule 8 |
| Contact and grievances | Publish a contact for processing questions and a grievance period of up to ninety days; add nomination of another individual | s. 8(9), 8(10), 14; Rules 9, 14 |
| SDF readiness | If notified as a Significant Data Fiduciary: India-based DPO, independent data auditor, annual DPIA and audit, algorithmic due diligence | s. 10; Rule 13 |
Timing matters: the Act’s duties, rights and penalties (sections 3 to 17, other than section 6(9), and sections 27 to 34, other than section 27(1)(d)) come into force on 13 May 2027 under commencement notification G.S.R. 843(E) (Gazette notification), and Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication (13 May 2027) (Rule 1(4)). Work through the full DPDP compliance checklist for the rest.
How will the Perimattic DPDP Compliance Suite help close the gaps?
Planned features aimed at the DPDP-specific work above:
- A notice builder for DPDP notices with the Rule 3 items, in English and Eighth Schedule languages.
- Consent capture and records, with withdrawal as easy as giving consent.
- Verifiable parental consent workflow for children’s data under Rule 10.
- A breach response workflow for intimations to Data Principals and reports to the Board under Rule 7.
- Retention and erasure schedules under Rule 8, including the 48-hour pre-erasure intimation.
- A personal-data inventory, which can start from an existing GDPR record of processing.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. It is not certified or approved by any government body, and using it will not by itself make a business compliant. Sign up to follow the build.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on the DPDP Act
DPDP and GDPR, answered
If we are GDPR compliant, are we DPDP compliant?
Not automatically. GDPR work gives you a head start on data mapping, security and rights handling, but the DPDP Act differs in ways that need changes: fewer grounds for processing, consent notices in Indian languages, parental consent for everyone under 18, reporting of every breach to the Board and to each affected person, and a one-year minimum retention of processing logs.
Does the DPDP Act have a legitimate interests basis?
No. Section 4 allows processing only with consent or for “certain legitimate uses”, and section 7 lists those uses exhaustively: data voluntarily provided for a purpose, certain State functions, legal obligations, court orders, medical emergencies, epidemics, disasters and employment. There is no general balancing test like GDPR Article 6(1)(f).
Who regulates the DPDP Act, compared with the GDPR?
The DPDP Act is enforced by one national body, the Data Protection Board of India, set up under section 18, with appeals to TDSAT. Under GDPR Article 51, each EU Member State provides one or more independent supervisory authorities.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up