Skip to content
GRC-FlowDPDP
Menu
Book a demo

DPDP vs GDPR: 12 Key Differences for Indian Businesses

DPDP vs GDPR compared: scope, legal grounds, children, breach reporting, DPO, transfers, rights and penalties, and why GDPR compliance isn't DPDP compliance.

By the GRC-Flow team · Published · 7 min read

Key takeaways

  • GDPR compliance does not make you DPDP compliant: the DPDP Act has fewer legal grounds, stricter breach reporting and stricter rules for children.
  • DPDP covers only digital personal data (including digitised paper records); GDPR also covers structured paper filing systems.
  • Under DPDP every personal data breach must be reported to the Board and affected people; GDPR exempts breaches unlikely to cause risk.
  • DPDP treats everyone under 18 as a child, needing verifiable parental consent; GDPR's age is 13 to 16 depending on the country.
  • DPDP penalties are fixed caps of up to ₹250 crore per breach; GDPR fines go up to €20 million or 4% of worldwide turnover.

Many Indian companies that sell abroad already follow the EU's GDPR. It is a useful head start, but the DPDP Act 2023 differs in ways that matter. Here is the side-by-side view.

DPDP vs GDPR at a glance

TopicDPDP Act 2023 (India)GDPR (EU)
Data coveredDigital personal data, including paper records once digitisedPersonal data processed automatically or in structured paper filing systems
Sensitive dataNo separate category (children's data has extra rules)Special categories (health, religion, biometrics etc.) with stricter rules
Legal groundsConsent, or listed "certain legitimate uses"Six bases, including legitimate interests and contract
Publicly available dataExcluded if the person made it publicStill covered
ChildrenUnder 18; verifiable parental consent; no tracking or targeted ads13 to 16 depending on the country, for online services
Breach reportingEvery breach, to the Board and affected people; detailed report within 72 hoursTo the authority within 72 hours unless unlikely to cause risk; to people if high risk
Data Protection OfficerOnly for Significant Data Fiduciaries, based in IndiaRequired for public bodies and large-scale monitoring or special-category processing
Cross-border transfersAllowed, except to countries the government restrictsOnly with adequacy, safeguards such as SCCs, or exceptions
RightsInformation, correction and erasure, grievance, nominationAdds portability, objection, restriction and rights on automated decisions
Duties of individualsYes: e.g. no false or frivolous complaints (up to ₹10,000)None
Consent ManagersRegistered platforms to give and withdraw consentNo equivalent
PenaltiesFixed caps per breach, up to ₹250 croreUp to €20 million or 4% of worldwide annual turnover

The differences that change your work

Fewer legal grounds

GDPR's "legitimate interests" does not exist under DPDP. Purposes you ran on legitimate interests, such as some analytics or marketing, usually need consent or must stop.

Every breach is reportable

Under GDPR you can decide a minor breach is unlikely to cause risk and not report it. Under the DPDP Rules every personal data breach goes to the Board and to the people affected, with a detailed report within 72 hours. Update your incident playbook.

Children means under 18

Services used by teenagers need verifiable parental consent for everyone under 18, and must switch off tracking, behavioural monitoring and targeted advertising for them.

Penalties are fixed caps

DPDP penalties are not tied to turnover. For a mid-sized Indian company, a cap of ₹250 crore can still be far larger than a GDPR fine would be. See DPDP Act penalties.

What you can reuse from GDPR

  • your data map and record of processing (update for India-specific flows);
  • security controls, which map well to the Rule 6 safeguards;
  • rights-request handling (adjust the timeline to 90 days and add nomination);
  • vendor reviews and data processing agreements (add DPDP clauses).

Then run a DPDP-specific gap assessment. Our DPDP compliance checklist lists the steps, and GRC Flow runs the assessment against each obligation in the DPDP Act and Rules, with the citation behind every finding.

Frequently asked questions

Is the DPDP Act the same as GDPR?

No. Both protect personal data, but the DPDP Act is narrower in scope (digital data only), has fewer lawful grounds (consent and listed legitimate uses), has no special categories of sensitive data, requires reporting of every breach, and sets fixed penalty caps instead of a percentage of turnover.

If we are GDPR compliant, are we DPDP compliant?

Not automatically. You can reuse your data map, security controls and rights processes, but you need to check legal grounds, notices, breach reporting, children's consent and contracts against the DPDP Act and Rules.

Does DPDP have a right to data portability?

No. The DPDP Act gives rights to information, correction and erasure, grievance redressal and nomination, but not data portability or a right to object to automated decisions.

Sources

This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.

Related guides