The DPDP Act is often described as India's GDPR. It shares the vocabulary of consent, purpose and rights, but it is shorter, narrower in its grounds and stricter in places a GDPR programme does not expect. This is where the two diverge, and what that means if you are extending a European programme to India.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
The DPDP Act has two grounds for processing, consent and a closed list of legitimate uses in section 7, where the GDPR has six including legitimate interests. The DPDP Act also has no special categories of personal data, no Article 30 duty to keep a record of processing, and penalties fixed in rupees rather than a share of turnover.
| Topic | DPDP Act, 2023 and Rules, 2025 | GDPR |
|---|---|---|
| Who it protects | Data Principal (Sec 2(j)) | Data subject |
| Who is responsible | Data Fiduciary (Sec 2(i)) | Controller |
| Data covered | Digital personal data, or data digitised later (Sec 3(a)) | Personal data, automated or in a filing system |
| Publicly available data | Excluded if made public by the person or under a legal duty (Sec 3(c)(ii)) | Covered |
| Grounds for processing | Consent, or a closed list of legitimate uses (Sec 4, 7) | Six lawful bases, incl. legitimate interests (Art 6) |
| Sensitive data | No special categories | Special categories with extra conditions (Art 9) |
| Children | Under 18; verifiable parental consent; no tracking or targeted ads (Sec 9) | Under 16, or as low as 13 by member state (Art 8) |
| Notice languages | English or any of 22 Eighth Schedule languages, on request (Sec 5(3)) | Clear and plain language; no list |
| Proof of consent | Data Fiduciary must prove notice and consent (Sec 6(10)) | Controller must demonstrate consent (Art 7(1)) |
| Consent intermediaries | Board-registered Consent Managers (Sec 6(7)–(9)) | None |
| Breach: to individuals | Every affected Data Principal, without delay (Sec 8(6), Rule 7) | Only where high risk (Art 34) |
| Breach: to regulator | Without delay, then a detailed report within 72 hours (Rule 7) | Within 72 hours unless unlikely to be a risk (Art 33) |
| Record of processing | No statutory requirement | Required (Art 30) |
| DPO and DPIA | Only for Significant Data Fiduciaries (Sec 10) | DPO for certain controllers (Art 37); DPIA where high risk (Art 35) |
| Rights | Access, correction, erasure, grievance, nomination (Sec 11–14) | Adds portability, objection, automated-decision rights (Art 20–22) |
| Duties on individuals | Yes, penalty up to ₹10,000 (Sec 15) | None |
| Transfers abroad | Allowed unless the country is restricted by notification (Sec 16) | Adequacy, safeguards or derogations (Ch V) |
| Penalties | Fixed ceilings, up to ₹250 crore per breach (Schedule) | Up to €20m or 4% of worldwide turnover (Art 83) |
There is no such ground. Analytics, fraud checks, marketing and product research that a GDPR programme runs on legitimate interests need consent under the DPDP Act, unless they fit one of the section 7 uses. Re-map every purpose, rather than translating the old lawful-basis column.
There is no risk threshold. Every personal data breach goes to the Board and to every affected Data Principal (section 8(6)), with the detailed Board report due within 72 hours under Rule 7. A GDPR runbook that stops at 'unlikely to result in a risk' under-reports here.
A child is anyone under eighteen. Verifiable parental consent under Rule 10, and the ban on tracking and targeted advertising, reach users that a GDPR age gate treats as adults.
The DPDP Act does not ask for a record of processing. It asks for proof: of the notice and the consent behind each purpose (section 6(10)), and of who you shared data with when a Data Principal asks (section 11(1)(b)). A data map is still needed, but it has to feed those answers.
The Data Principal can ask for the notice and the consent request in any Eighth Schedule language. Tools that price or build per language, or treat translations as an afterthought, struggle here.
Not automatically. GDPR compliance covers much of the groundwork, but the DPDP Act adds notices in Eighth Schedule languages, verifiable parental consent for everyone under 18, a duty to tell every affected Data Principal about every breach, a 72-hour detailed report to the Board, and the burden of proving consent.
What does carry over: purpose limitation, data minimisation, security controls, processor contracts, rights-handling workflows and a culture of documenting decisions. Start from the DPDP compliance checklist and mark which items your GDPR programme already evidences; the rest is the India gap.
The DPDP Act has two grounds for processing, consent and a closed list of legitimate uses in section 7, where the GDPR has six including legitimate interests. The DPDP Act also has no special categories of personal data, no Article 30 duty to keep a record of processing, and penalties fixed in rupees rather than a share of turnover.
Not automatically. GDPR compliance covers much of the groundwork, but the DPDP Act adds notices in Eighth Schedule languages, verifiable parental consent for everyone under 18, a duty to tell every affected Data Principal about every breach, a 72-hour detailed report to the Board, and the burden of proving consent.
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
