.svg){kind=small}
For most people, the GDPR is the reference point for data privacy law, and it gave them the vocabulary they still use to understand the subject.
But India has its own data protection law, the Digital Personal Data Protection Act, 2023, and it differs from the GDPR in a lot of aspects.
So, if you already comply with the GDPR, your work is not done. You will still need to do additional work to comply with the DPDP Act. Similarly, if you are using GDPR checklists, material or platforms for DPDP compliance, you will not be compliant.
The sections below compare both laws across scope, entities under the law, consent and grounds of processing, compliance obligations, exemptions and penalties.
Scope and Applicability: GDPR vs DPDP Act
Both the DPDP and GDPR apply processing inside their own territory as well as processing outside the territory for offering goods or services to people residing in the territory.
For example: A company in Singapore selling to customers in India is covered by the DPDP Act, and will be covered by the GDPR if it sells to customers in Germany.
Both the laws also exclude processing for personal or domestic purposes.
However there are three key differences:
- GDPR also applies to behavioural monitoring of people in EU: The GDPR extends applicability not only for processing of data for offering goods and services to people in the EU but also to monitoring the behaviour of people in the EU.
- Physical records are covered under GDPR: The DPDP Act applies only to digital personal data, meaning data collected digitally or digitised later but the GDPR also applies to non-digital data such as data stored in a physical filing system, card index, or paper folder.
- Publicly available data is not excluded under GDPR: The DPDP Act does not apply to personal data made public by the Data Principal herself, or by someone legally required to publish it. The GDPR has no such carve-out.
What is personal data under GDPR and DPDP Act?
The GDPR defines personal data as any information relating to an identified or identifiable natural person.
The DPDP Act defines personal data as any data about an individual who is identifiable by or in relation to that data.
However, the GDPR also sets out special categories of data which include health data, biometric data, religious belief, political opinion, trade union membership and sexual orientation data where processing this data is prohibited unless a specific exception applies. Consent is not adequate for processing these categories of data because of their sensitive nature.
For example, this means a customer's religion and a customer's PIN code are treated identically under the DPDP Act. Under the GDPR they are not.
Entities under GDPR and DPDP Act
The DPDP Act uses its own terms for the entities under the law. Some map onto GDPR concepts but have differences in obligations while others have no GDPR counterpart at all.
Consent and grounds for processing under GDPR and DPDP Act
Under both laws, you need a valid ground to process personal data but the DPDP Act gives you far fewer grounds than the GDPR does.
To process personal data, the DPDP Act gives you two grounds: consent, and a limited list of nine legitimate uses.
The GDPR gives you six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests.
This means that:
- There is no legitimate interest ground under the DPDP: Under the GDPR this is a balancing test an organisation can apply to its own processing. The DPDP Act has nothing like it. Legitimate uses are a fixed list of limited situations, not a test.
- There is no contract ground under the DPDP: Processing that the GDPR would allow because it is necessary to perform a contract will need consent under the DPDP Act.
- Consent carries far more weight under the DPDP: Consent is the primary ground under the DPDP Act and most processing that an Indian business does today will need consent, because the alternatives are extremely narrow and limited.
Read more in Grounds for processing under the DPDP Act.
What are the compliance obligations under the GDPR and DPDP Act?
What are exemptions under GDPR and DPDP Act?
Both laws allow exemptions, but under the DPDP Act the exemptions are wider and give the State more power. Where an exemption applies, it switches off most of the obligations under the Act. Under the GDPR, restrictions are limited and mostly set out in law.
The Central Government may also exempt entities from obligations under the DPDP Act. Two such scenarios are:
- State instrumentalities. The Central Government can exempt any government agency from the Act entirely, on grounds such as national security, public order and friendly relations with other countries. The GDPR lets member states restrict rights by law, but not at this scale.
- Startups. The government can exempt certain Data Fiduciaries, including startups, from the notice requirement, some general obligations, the SDF rules and the right to access. The GDPR has no such exemption based on company size.
Read more about DPDP exemptions in Exemptions under the DPDP Act.
What are the penalties under GDPR and DPDP Act?
See Penalties under the DPDP Act and Data Protection Board of India.
DPDP vs GDPR at a glance
FAQs
Is the DPDP Act based on the GDPR?
It borrows some vocabulary and some concepts, but is not identical. The biggest departures are the absence of legitimate interests and contractual necessity as grounds, the absence of special categories of personal data, and the addition of Consent Managers and Significant Data Fiduciaries, which the GDPR has no equivalent of.
If we are GDPR compliant, are we DPDP compliant?
No. Your lawful basis mapping, your consent flows, your breach threshold, your processor contracts and your children's data handling will all need work.
Some DPDP vs GDPR examples of where this matters:
- Marketing you run on legitimate interests under the GDPR will need consent under the DPDP Act.
- A minor breach that does not meet the GDPR’s risk threshold is still reportable under the DPDP Act, to the Board and to every affected Data Principal.
- A 17-year-old is an adult for consent purposes in most EU member states, but a child under the DPDP Act, so you need verifiable parental consent.
Does the DPDP Act have a legitimate interest ground?
No. "Legitimate uses" sounds similar but works very differently. Under the DPDP it is a limited list of situations under which data can be processed for that limited purpose rather than a purpose and necessity test like under the GDPR.
Does the DPDP Act give a right to data portability?
No. The DPDP Act gives data principals a right to access, withdraw consent, correction, erasure, grievance redressal and nomination. However the GDPR provides some additional rights such as portability, restriction of processing, objection and protection against solely automated decision-making which aren’t present in the DPDP. DPDP has an additional right to nominate.
Which law is stricter?
It depends on the subject. The GDPR is stricter on lawful bases, individual rights, records and the size of penalties. The DPDP Act is stricter on consent, breach reporting, and children's data. The DPDP Act also exempts the State far more broadly than the GDPR does.
When do DPDP obligations start applying?
The DPDP Rules were notified on 13 November 2025. Most operational obligations, including the notice requirements, security safeguards, breach reporting, children's data and cross-border provisions, take effect on 13 May 2027.
.avif)
.avif)
.avif)
