Last Updated: June 2026 · Author: Saurabh Gupta, CISM, CIPP/E · Founder, MYITMANAGER
DPDP Act vs GDPR — Key Differences for Indian Companies
India’s Digital Personal Data Protection (DPDP) Act 2023 and the EU’s General Data Protection Regulation (GDPR) share common principles — lawful processing, individual rights, breach notification — but differ significantly in scope, legal basis, penalty structure, and obligations for large data processors. This guide covers the most important differences for Indian companies operating under one or both frameworks.
DPDP Act vs GDPR — Quick Comparison
| Factor | India DPDP Act 2023 | EU GDPR |
|---|---|---|
| Enacted | August 2023 (rules pending) | May 2018 |
| Territorial Scope | Applies to processing of digital personal data of individuals in India, including offshore processing | Applies to processing of EU residents’ data, regardless of where the organisation is located |
| Data Types Covered | Digital personal data only (physical/offline data excluded) | All personal data — digital, physical, and offline records |
| Legal Bases for Processing | Consent OR legitimate uses (government functions, legal obligations, employment, emergencies) | Six legal bases: consent, contract, legal obligation, vital interests, public task, legitimate interests |
| Consent Requirements | Specific, informed, unconditional, unambiguous. Notice must be in plain language. No bundled consent. | Freely given, specific, informed, unambiguous. Granular consent required per purpose. |
| Special Categories of Data | Not explicitly defined in DPDP Act (may be addressed in rules). Children’s data gets heightened protection. | Explicitly defined: health, biometric, genetic, racial/ethnic, religious, political, sexual orientation data |
| Data Principal Rights | Access, correction, erasure, grievance redressal, nomination | Access, rectification, erasure, restriction, portability, objection, no automated decision-making |
| Data Portability | Not included (may come via rules) | Explicitly required (Article 20) |
| Data Breach Notification | Notify DPBI and affected data principals; no specific timeframe defined yet (rules pending) | Notify DPA within 72 hours; notify individuals without undue delay if high risk |
| DPO Requirement | Required only for Significant Data Fiduciaries (SDFs); must be India-based | Required for public authorities, large-scale processing, systematic monitoring; no location requirement |
| Data Localisation | Possible for SDFs; Central Government can restrict transfers to certain countries | No blanket localisation; transfers to third countries restricted without adequacy decision or safeguards |
| Maximum Penalty | ₹250 crore (~€28M) per breach of security safeguards | €20 million or 4% of global annual turnover, whichever is higher |
| Enforcement Body | Data Protection Board of India (DPBI) | National Data Protection Authorities (DPAs) in each EU member state |
Key Differences That Impact Indian Companies Most
1. Digital-Only Scope Under DPDP Act
The DPDP Act explicitly covers only digital personal data. Physical records — paper forms, handwritten notes — are outside its scope unless digitised. GDPR covers all personal data regardless of format. For Indian companies with legacy paper-based processes, this is a meaningful difference in scope and compliance cost.
2. Consent Is the Primary Legal Basis Under DPDP Act
Under GDPR, organisations have six legal bases to choose from — legitimate interests, contract performance, and legal obligation are frequently used without consent. The DPDP Act is more consent-centric. While “legitimate uses” exist, the framework is designed around obtaining specific, informed consent. Indian companies that rely on legitimate interests under GDPR will need to revisit their legal basis framework for DPDP compliance.
3. No Special Category Data Framework (Yet)
GDPR’s special categories (health, biometric, genetic, racial/ethnic, religious, political, sexual orientation data) require explicit consent and heightened protection. The DPDP Act does not yet define equivalent special categories, though this is expected in the rules. Children’s data (under 18) does receive explicit heightened protection under Section 9 — including a ban on tracking, behavioural monitoring, and targeted advertising directed at children.
4. No Right to Data Portability
GDPR’s Article 20 right to data portability — which allows individuals to receive their data in a machine-readable format and transfer it to another provider — is not included in the DPDP Act. This has significant implications for Indian fintech and banking companies that are also subject to RBI’s Account Aggregator framework.
5. Penalty Structure Is Different
GDPR’s maximum penalty is the higher of €20M or 4% of global annual turnover — which can be astronomical for large multinationals (Meta’s €1.2B fine, Amazon’s €746M). DPDP Act penalties are fixed sums capped at ₹250 crore per violation, which is materially lower for large global companies but significant for mid-market Indian organisations.
Do You Need Both DPDP and GDPR Compliance?
Indian companies need both if they: (1) process personal data of individuals in India (DPDP Act applies), AND (2) offer goods or services to EU residents, or monitor EU residents’ behaviour (GDPR applies). This includes:
- Indian SaaS companies with EU customers
- Indian IT services companies with EU clients whose employees’ data they process
- Indian e-commerce platforms shipping to EU countries
- Indian companies with EU subsidiaries or employees
If you have an existing GDPR compliance programme, DPDP bridging typically costs 30–40% of a from-scratch DPDP implementation — the consent architecture, privacy notices, breach response procedures, and DPA vendor contracts largely map across.
Operating under both DPDP Act and GDPR? MYITMANAGER’s dual-framework compliance programme covers both in a single engagement. Free gap assessment in 5 business days. Talk to a compliance specialist →
