Compare
DPDP vs GDPR
Many Indian companies already run a GDPR programme. Much of it helps with DPDP, but several core rules differ, and copying GDPR answers across leaves gaps.
Short answer
India's DPDP Act, 2023 and the EU's GDPR (Regulation (EU) 2016/679, which applies since 25 May 2018) share ideas such as notice, consent, rights and breach reporting, but differ on core rules. DPDP allows processing only on consent or certain legitimate uses (s.4), treats everyone under 18 as a child (s.2), requires every personal data breach to be intimated to the Board and affected Data Principals (Rule 7), and restricts transfers only to countries the government notifies (s.16). GDPR has six lawful bases (Art. 6), lets member states set the age for a child's own consent to online services between 13 and 16 (Art. 8), requires authority notification within 72 hours unless a breach is unlikely to result in a risk (Art. 33), and relies on adequacy decisions and safeguards such as standard contractual clauses.
Side-by-side comparison
| Topic | DPDP Act, 2023 and Rules, 2025 | GDPR |
|---|---|---|
| Scope | Digital personal data processed in India, and processing outside India connected with offering goods or services to people in India (s.3) | Processing in the context of an EU establishment, and offering goods or services to, or monitoring, people in the EU (Art. 3) |
| Roles | Data Fiduciary, Data Processor, Data Principal; Consent Manager as a registered role | Controller, processor, data subject |
| Grounds for processing | Consent (s.6) or certain legitimate uses (s.7); no legitimate interest ground (s.4) | Six lawful bases (Art. 6) |
| Children | Anyone under 18; verifiable parental consent (s.9, Rule 10) | For online (information society) services, parental consent below an age each member state sets between 13 and 16 (Art. 8) |
| Sensitive data | No separate sensitive category | Special categories of personal data (Art. 9) |
| Breach | Every personal data breach: the Board and each affected Data Principal without delay, and a detailed report to the Board within 72 hours (Rule 7) | Risk-based: the supervisory authority within 72 hours unless the breach is unlikely to result in a risk (Art. 33) |
| Transfers | Allowed unless to a country the government notifies (s.16), subject to Rule 15 orders | Adequacy decisions, or appropriate safeguards such as standard contractual clauses |
| Higher-tier fiduciaries | Significant Data Fiduciaries notified by the government, with DPO, auditor and DPIA duties (s.10, Rule 13) | No equivalent designation |
| Penalties | Fixed maximum amounts per type of breach in the Schedule, decided by the Board after an inquiry (s.33) | Up to €20 million or 4% of worldwide annual turnover, whichever is higher |
This page compares the two laws at a high level, for India. For GDPR depth, see our global site, trueprivacy.io.
Where the differences bite
- Grounds: DPDP has no balancing-test ground. A purpose you run on legitimate interests under GDPR needs consent or a specific legitimate use under s.7 in India.
- Children: a 16-year-old who can consent alone under GDPR (Art. 8) is a child under DPDP, so the parental flow and the s.9(3) bar on targeted advertising apply.
- Breach: an incident you might only record internally under GDPR still needs Board and Data Principal intimation under Rule 7.
- Sensitive data: DPDP has no special categories, but sensitivity of data is a s.10 factor, and your sector regulator may have its own rules.
- Rights: DPDP rights are access to information (s.11), correction and erasure (s.12), grievance redressal (s.13) and nomination (s.14). Map your GDPR process to these and add nomination.
- Grievances first: under s.13(3) a person must exhaust your grievance process before approaching the Board.
What carries over from a GDPR programme
- Your data inventory and records of processing
- Processor contracts, updated for Rule 6 security terms
- Your breach process, with the Rule 7 intimations added
- Rights request workflows, re-pointed to DPDP rights and Rule 14
- DPIA methods, useful if you are notified as an SDF (Rule 13)
- Consent records, if they capture notice version, purpose, action and time
Steps to adapt a GDPR programme for India
- 01Re-map grounds
Go through every purpose and move it to consent or a named s.7 legitimate use.
- 02Rewrite notices
Meet Rule 3 and let people read the notice in English or an Eighth Schedule language (s.5(3)). Do not reuse an EU notice unchanged.
- 03Reset the age gate
Use 18 for India and build verifiable parental consent (Rule 10).
- 04Change the breach trigger
For Indian Data Principals, drop the risk threshold and add the Board intimation and the 72-hour detailed report (Rule 7).
- 05Publish India contacts and periods
Add the Rule 9 contact, the request method and a grievance period of no more than 90 days (Rule 14).
- 06Review transfers
Track s.16 notifications for data leaving India, and keep your GDPR transfer tools for EU data.
How TruePrivacy helps
Rights requests track deadlines per law, with the DPDP outer limit of 90 days, and breach management records which laws an incident affects and runs a clock per audience.
Consent management holds purposes and records, and records of processing keeps one exportable register. Multiple brands and workspaces let you separate Indian and EU operations. Start with the readiness quiz for DPDP.
Is DPDP the same as GDPR?
No. They share ideas, but DPDP has only two grounds for processing, treats under-18s as children, requires every breach to be intimated and uses a negative list for transfers.
Does DPDP have a legitimate interests ground?
No. Section 4 allows processing only with consent or for the legitimate uses in s.7.
Is GDPR compliance enough for DPDP?
No. It is a good base, but you also need DPDP notices, the under-18 rule, Rule 7 breach intimation and DPDP rights processes.
How do DPDP and GDPR penalties compare?
GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher. DPDP sets fixed maximum amounts per type of breach in the Schedule to the Act; see the penalties page.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin