The DPDP Act shares the GDPR's core ideas but is stricter in places and simpler in others. It has no legitimate interests basis, treats everyone under 18 as a child, requires you to report every breach to the Board and affected people (section 8(6), Rule 7), and sets fixed penalties of up to ₹250 crore per breach instead of a percentage of turnover.
Key takeaways
- There is no legitimate interests ground: you need consent or one of the section 7 legitimate uses.
- A child is anyone under 18, and verifiable parental consent is needed before processing a child's data, subject to the Fourth Schedule exemptions.
- Every breach goes to the Board and every affected person, with no risk threshold; the detailed report is due in 72 hours.
- Only Significant Data Fiduciaries must appoint a DPO; everyone else publishes a contact person.
- Penalties are fixed ceilings per breach (up to ₹250 crore) and individuals get no compensation under the Act.
If your organisation already runs a GDPR programme, the DPDP Act will look familiar: notice, a lawful ground, purpose limitation, security, breach reporting, rights and a regulator with real penalties. That familiarity is useful, and also a trap. Several DPDP rules are stricter than their GDPR counterparts, and some GDPR tools have no Indian equivalent.
This guide compares the two laws point by point, then shows which parts of a GDPR programme you can reuse for India and which you need to rework before 13 May 2027.
How are DPDP and GDPR alike?
Both laws regulate any organisation that decides why and how personal data is processed (the GDPR "controller", the DPDP "Data Fiduciary") and hold it responsible for its vendors (GDPR "processors", DPDP "Data Processors"). Both require a notice, a lawful ground for each purpose, data minimisation, security, erasure when the purpose ends, breach reporting to a regulator, access and correction rights, and a complaints route. Both reach companies outside their territory.
The GDPR has applied since 25 May 2018. The DPDP Act's core obligations apply from 13 May 2027. That means the GDPR has years of regulator guidance and case law; the DPDP Act has a Board that is established but has no Members yet. Expect interpretation questions to be settled over time.
DPDP vs GDPR: side-by-side comparison
| DPDP Act and Rules | GDPR | |
|---|---|---|
| Data covered | Digital personal data, including offline data later digitised. Paper-only records are outside. | Automated processing, and manual records in a filing system. |
| Territorial reach | Processing in India, and processing abroad connected with offering goods or services to people in India (section 3). No monitoring trigger. | Establishments in the EU, and non-EU entities offering goods or services to, or monitoring the behaviour of, people in the EU (Art. 3). |
| Exclusions | Personal or domestic use; data made public by the person herself or under a legal duty. | Household activity is excluded; publicly available data is still covered. |
| Lawful grounds | Consent or a listed legitimate use (sections 6, 7). No legitimate interests and no general contract ground. | Six bases in Art. 6, including contract and legitimate interests. |
| Sensitive data | No separate category; sensitivity weighs in SDF designation and in penalties. | Special categories with extra conditions (Art. 9). |
| Children | Under 18. Verifiable parental consent before processing, subject to Fourth Schedule exemptions; no tracking, behavioural monitoring or targeted ads (section 9). | Art. 8: 16 for consent to online services, member states may lower to 13. |
| Breach reporting | Every breach, to the Board and each affected person, without delay; detailed Board report within 72 hours (Rule 7). | Regulator within 72 hours where feasible, unless unlikely to result in a risk (Art. 33); individuals only for high risk (Art. 34). |
| DPO | Only Significant Data Fiduciaries, and the DPO must be based in India. Others publish a contact person (Rule 9). | Required for public authorities and certain large-scale monitoring or special-category processing (Art. 37). |
| Impact assessments | Annual DPIA and audit for SDFs only (Rule 13). | DPIA for any high-risk processing (Art. 35). |
| Rights | Access, correction, erasure, grievance redressal, nomination. Grievance period of up to 90 days. | Access, rectification, erasure, restriction, portability, objection, automated decision rights. One month to respond, extendable. |
| Cross-border transfers | Allowed unless the government restricts a country (section 16). None restricted so far. | Allowed with adequacy, appropriate safeguards such as standard contractual clauses, or a derogation (Chapter V). |
| Consent intermediaries | Registered consent managers (Rule 4). | No equivalent. |
| Designated high-risk entities | Significant Data Fiduciaries notified by government, with extra duties (section 10). None notified yet. | No designation; duties scale with risk. |
| Penalties | Fixed ceilings per breach, from ₹50 crore to ₹250 crore (Schedule). | Up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83). |
| Compensation | None under the Act; IT Act section 43A is omitted from 13 May 2027. | Right to compensation for material or non-material damage (Art. 82). |
| Duties of individuals | Yes (section 15); penalty up to ₹10,000. | None. |
Where is DPDP stricter than GDPR?
No legitimate interests
This is the largest practical difference. Under GDPR, a lot of routine processing (analytics, fraud prevention, direct marketing to existing customers, product improvement) runs on legitimate interests. The DPDP Act has no equivalent. Section 7 is a closed list, and its first item, data a person voluntarily provides for a specified purpose without objecting, is narrower than a balancing test. Expect more of your purposes to need consent, with withdrawal as easy as giving it.
Children up to 18
The DPDP Act treats everyone under 18 as a child and needs verifiable parental consent before processing their data, not just for online services. Tracking, behavioural monitoring and targeted advertising directed at children are banned outright, subject to the Fourth Schedule exemptions. A GDPR flow built around 13 or 16 will not work. See children's data.
Every breach is reportable
Section 8(6) has no materiality or risk threshold. Every personal data breach goes to the Board and to each affected Data Principal. Rule 7 then requires a detailed report to the Board within 72 hours of becoming aware. GDPR teams used to deciding "is this notifiable?" need a different triage: the question becomes how fast and how clearly, not whether. CERT-In's six-hour reporting continues alongside. See breach notification.
A one-year retention floor
Rule 8(3) requires every fiduciary to keep personal data, traffic data and processing logs for at least one year. GDPR only sets ceilings through storage limitation. Indian retention schedules need both a floor and a ceiling.
Where is DPDP lighter than GDPR?
- Fewer rights. There is no right to portability, restriction or objection, and no specific right on automated decisions.
- No DPO for most. Unless you are notified as an SDF, you need a published contact person, not a formal DPO.
- Transfers by default. No adequacy decisions or standard contractual clauses are needed. Transfers are open unless the government restricts a country, though sectoral rules such as RBI's payment data storage requirement still apply.
- No compensation claims under the Act. Penalties go to the Consolidated Fund of India.
- Public data excluded. Data the person made public herself is outside the Act.
How do the penalties compare?
The GDPR's top tier is €20 million or 4% of total worldwide annual turnover, whichever is higher. The DPDP Act takes a different approach: the Schedule sets a fixed maximum for each type of breach, from ₹50 crore for general obligations up to ₹250 crore for failing to take reasonable security safeguards. The Board weighs factors in section 33(2), such as gravity, duration, mitigation and proportionality, when it sets the actual amount.
For a mid-sized Indian company, a ₹250 crore ceiling may be well above 4% of its turnover, so the DPDP Act is not the softer regime it is sometimes assumed to be. Whether amounts can be combined across several breaches in one case is not settled. More in our DPDP penalties guide.
Can you reuse a GDPR programme for India?
Yes, and you should. Most of the expensive groundwork transfers. The work is in adapting the legal bases, children's flows, breach process and notices.
Carry over
- Records of processing and data maps, extended to Indian systems and vendors
- Processor contracts, updated for Rule 6(f) safeguard clauses
- Security programme: encryption, access control, logging, backups
- Access, correction and erasure request workflows
- Incident response team and runbooks
- DPIA practice, for SDF readiness
Rework for DPDP
- Move every legitimate interests purpose to consent or a section 7 use
- Parental consent and age checks for everyone under 18
- Report every breach to the Board and to individuals
- Notices with an itemised data list, in English or an Eighth Schedule language
- One-year retention floor for data, traffic data and logs
- Nomination right and a published grievance period of 90 days or less
A few GDPR habits need unlearning. Do not rely on "contract" as a basis; under DPDP, data needed to deliver a service the person asked for usually falls under consent or the section 7(a) voluntary-provision use. Do not reuse a GDPR breach risk matrix to decide whether to notify. And do not copy a GDPR privacy policy wholesale: Rule 3 wants a notice that stands on its own, with each item of data listed.
How to implement this
- Extend your data map to cover Indian users, Indian entities and processing abroad for Indian customers.
- Re-paper the grounds. List every purpose that uses legitimate interests or contract under GDPR and assign a DPDP ground.
- Fork the children's flows for Indian users under 18, using the Rule 10 verification options.
- Update the breach runbook for the Board, individuals and CERT-In, with Rule 7 content.
- Localise notices to the Rule 3 standard and set up consent withdrawal and grievance handling.
- Check progress against the DPDP compliance checklist.
We help teams with an existing GDPR programme run this gap analysis and implement the changes alongside their counsel. Talk to us.
Frequently asked questions
Is DPDP the same as GDPR?
No. Both are built on notice, a lawful ground, security, breach reporting and individual rights, but the DPDP Act has no legitimate interests basis, a higher child age of 18, breach reporting with no risk threshold, a negative-list transfer model and fixed penalty ceilings rather than turnover-based fines.
If we are GDPR compliant, are we DPDP compliant?
Not automatically. Your data map, security programme, processor contracts and rights workflow give you a strong start, but you will need to replace legitimate interests processing, change children's flows, report every breach, rewrite notices to Rule 3 and set retention floors under Rule 8(3).
Does the DPDP Act have legitimate interests like GDPR?
No. Section 7 lists specific legitimate uses, such as data a person voluntarily provides for a stated purpose, legal obligations, medical emergencies and employment. There is no open, balancing-test ground like GDPR Article 6(1)(f).
What is the child age under DPDP vs GDPR?
Under the DPDP Act a child is anyone under 18 (section 2(f)), and verifiable parental consent is needed before processing their data. Under GDPR Article 8 the age for consent to online services is 16, and member states can lower it to as low as 13.
Which has higher fines, DPDP or GDPR?
They are built differently. GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher. DPDP penalties are fixed ceilings per breach, up to ₹250 crore for failing to take reasonable security safeguards. Which is larger in practice depends on the company's turnover, and on how the Board treats several breaches in one case, which is not yet settled.
Does DPDP require a DPO like GDPR?
Only Significant Data Fiduciaries must appoint a Data Protection Officer based in India (section 10). Every other fiduciary must publish the business contact of a DPO or another person who can answer questions about processing (section 8(9), Rule 9).
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.