A lot of Indian businesses already did real work for GDPR, an EU customer asked for it, or a vendor contract required it, and the natural next question is how much of that work carries over to DPDP. Some of it does. Some of it actively points the wrong direction if you assume the two laws work the same way.
As part of our DPDP series, this post compares India’s DPDP Act with the GDPR, highlighting the key differences businesses need to understand.
Ashok’s IT services company in Chennai, the business we have followed through this series, does support work for a couple of clients with EU operations. His team’s GDPR compliance programme turned out to cover a lot of DPDP’s ground, but not all of it.
Scope: all personal data versus digital-only
GDPR covers personal data in any form, digital or offline. DPDP covers digital personal data specifically, including digitised versions of originally offline records. If Ashok’s company still keeps a handful of paper intake forms that never get digitised, DPDP generally does not reach those, GDPR may apply depending on the circumstances.
Lawful basis: six options versus two
GDPR gives businesses six lawful bases for processing personal data, consent being just one of them, alongside options like legitimate interest, contractual necessity, and legal obligation. DPDP works differently: consent is the primary basis, with a second, narrower basis called “legitimate use” covering specific listed scenarios, such as employer-employee processing, compliance with a legal obligation, or a medical emergency.
The practical effect: if Ashok’s team relied on GDPR’s “legitimate interest” basis for some EU processing, that basis does not carry over to DPDP. Consent is generally required unless the processing falls within one of the Act’s recognised legitimate use scenarios.
Notices: required for everything versus tied primarily to consent
GDPR generally expects a privacy notice regardless of which lawful basis you are relying on. DPDP’s notice requirements are primarily framed around obtaining consent, while processing under legitimate use may not involve the same consent notice process. Businesses should still ensure they meet any applicable transparency obligations under the Act regardless of which basis they rely on.
Children’s data: DPDP is the stricter one here
This is the one area where DPDP is generally considered more restrictive than GDPR, worth knowing since the overall pattern elsewhere runs the other way.
Under GDPR, for consent-based processing in relation to information society services offered directly to a child, the default age is 16. EU member states may lower this threshold to between 13 and 16.
DPDP sets a single, flat threshold of 18, with verifiable parental consent required below that age. DPDP generally prohibits tracking, behavioural monitoring, and targeted advertising directed at children, subject to any exemptions the Government may notify for specific classes down the line.
For any business with under-18 users, gaming, EdTech, family-oriented apps, this is a meaningfully bigger obligation under DPDP than most GDPR-based programs were built to handle.
Processor obligations: statutory duty versus contractual duty
GDPR places direct statutory compliance obligations, and direct penalty exposure, on processors themselves, not just the controller. DPDP works differently: the Data Fiduciary remains responsible for meeting its obligations under the Act, including when it engages a Data Processor to process personal data on its behalf. The processor relationship must be governed by a valid contract, with applicable safeguards addressed. We explained this Fiduciary/Processor distinction in depth earlier in this series. Processors typically operate under contractual obligations with the Fiduciary rather than direct compliance obligations under the Act itself.
For Ashok’s business, this means contractual controls between his company and its processors, his cloud storage provider among them, become particularly important under DPDP, since the Act’s statutory accountability sits with his business, not with the vendor directly.
Individual rights: narrower under DPDP
GDPR gives individuals a broader set of rights: access, correction, erasure, data portability, the right to object to processing, and specific protections around solely automated decision-making. DPDP’s set is narrower, generally covering access, correction, erasure, grievance redressal, and the ability to nominate someone to exercise these rights after death.
Erasure specifically works differently too. GDPR’s right to erasure (its “right to be forgotten”) comes with detailed, specific grounds set out in the regulation itself. DPDP’s version is tied more narrowly to consent withdrawal and the original purpose being fulfilled, with less granular detail in the law, and the Data Protection Board deciding disputed cases rather than a codified list of grounds.
Breach notification: a broader approach than GDPR, with detail still evolving
GDPR generally requires a controller to notify the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Under DPDP, once the relevant provisions commence in May 2027, the Data Fiduciary must notify the Data Protection Board without delay and provide detailed information within 72 hours, unless the Board allows a longer period on a written request. Affected Data Principals must also be notified without delay. The key difference is that DPDP does not use GDPR’s risk threshold for notifying affected individuals.
The DPDP Rules, 2025 have been notified, but the relevant breach-notification provisions are scheduled to commence in May 2027.
Cross-border data transfers: permissive versus restrictive by default
GDPR restricts data transfers out of the EU by default, requiring an adequacy decision, standard contractual clauses, or another approved mechanism before data can leave. DPDP currently works the other way around: a negative-list model, transfers are allowed by default unless a specific country is explicitly restricted by the government. As of now, no countries have been restricted under this mechanism, though that could change.
Consent Managers: a DPDP-only concept
DPDP introduces the Consent Manager as a registered intermediary letting individuals manage consent across multiple businesses from one place. GDPR has no direct equivalent to this role.
Penalties: percentage-based administrative fines versus statutory monetary penalties, with one figure needing verification
GDPR’s maximum penalty is well established: up to €20 million or 4% of global annual turnover, whichever is higher. DPDP works differently, using statutory monetary penalties tied to specific violations rather than a percentage of revenue. The maximum penalty for failing to take reasonable security safeguards to prevent a personal data breach is ₹250 crore. Other violations carry separate maximum penalties specified in the Act’s Schedule.
The Act’s Schedule specifies the maximum penalty for each listed violation. For example, failure to notify the Board or affected Data Principals of a personal data breach may attract a penalty of up to ₹200 crore. These are statutory maximums, not automatic fines; the Board determines any penalty following an inquiry and considers the factors set out in Section 33.
One structural point worth remembering regardless of the exact figures: DPDP’s fixed-amount model can hit smaller businesses harder in relative terms than GDPR’s percentage-based model would, a small startup and a large enterprise can face the same maximum fixed penalty for the same violation, whereas GDPR’s cap scales with the size of the business.
GDPR vs DPDP: Side by side comparison
| Area | GDPR | DPDP |
|---|---|---|
| Scope | All personal data, digital and offline | Digital personal data only |
| Lawful basis | Six options, including legitimate interest | Consent primarily, plus a narrower “legitimate use” basis |
| Children’s age | 16 by default for consent to information society services, with Member States permitted to lower the age to 13–15. | 18, with restrictions on tracking and behavioural monitoring |
| Processor obligations | Direct statutory duties and penalty exposure | Statutory responsibility sits with the Data Fiduciary; processors bound contractually |
| Individual rights | Broader, includes portability and automated-decision-making safeguards | Narrower, access, correction, erasure, grievance redressal |
| Breach notification to individuals | Required only if high risk | Affected Data Principals must be notified without delay once the relevant provisions commence; no GDPR-style risk threshold applies. |
| Cross-border transfers | Restrictive by default, needs an approved mechanism | Permissive by default, restricted only for specific notified countries |
| Penalty structure | Up to 4% of global turnover or €20 million | Statutory maximums by violation: up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to notify a personal data breach. |
If you are already GDPR-compliant, what’s the real gap
Many privacy practitioners consider GDPR compliance to provide a strong starting point for DPDP compliance, although important DPDP-specific obligations still require additional work, a lawful-basis framework, breach response processes, data mapping, and a privacy-conscious culture all transfer over reasonably well in general terms.
What generally does not transfer automatically: DPDP-specific consent language and notices, India-specific cross-border transfer restrictions if notified by the Government, integration with Consent Managers once they exist, a DPO appointment evaluated against DPDP’s own Significant Data Fiduciary criteria rather than GDPR’s, and the stricter children’s data rules around tracking and behavioural monitoring. Treat GDPR compliance as a strong head start, not a substitute.
Frequently Asked Questions
Is DPDP the same as GDPR?
No. DPDP shares some underlying principles with GDPR but differs in scope, lawful basis, children’s data rules, breach notification approach, cross-border transfer approach, and penalty structure.
If my business is GDPR-compliant, am I automatically DPDP-compliant?
No. GDPR compliance typically provides a strong starting point for DPDP compliance, but gaps remain, particularly around DPDP-specific consent and notice language, the stricter children’s data rules, and India-specific obligations.
Which law has stricter children’s data rules?
DPDP is generally considered stricter here. It sets the age threshold at 18, compared to GDPR’s default of 16, and restricts tracking, behavioural monitoring, and targeted advertising directed at children, subject to any exemptions the Government may notify.
Which law has a stricter breach notification approach?
DPDP takes a broader approach here. GDPR only requires notifying individuals if a breach is likely to cause high risk, while DPDP requires notifying the Data Protection Board and affected Data Principals for reportable breaches under the law, though the detailed Rules on exactly how this works are still evolving.
Does DPDP fine businesses the same way GDPR does?
No. GDPR fines scale with global turnover, up to 4% or €20 million. DPDP uses statutory monetary penalties for specific violations, up to an overall ceiling of ₹250 crore, which does not scale down for smaller businesses the way GDPR’s percentage-based model does.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the GDPR & DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
