DPDPA vs GDPR: Key Differences Indian Businesses Should Understand
-
Shankar Jayaraman - 01 Jul, 2026
India’s Digital Personal Data Protection Act (DPDPA) and the EU’s General Data Protection Regulation (GDPR) are two major data privacy laws that businesses need to understand. While GDPR has been in effect since 2018, DPDPA came into force on 14 November 2025, with full compliance required by 13 May 2027. Indian companies, especially those operating globally, must navigate both frameworks, which differ in scope, penalties, consent requirements, and data handling.
Key Takeaways:
- Territorial Scope: GDPR applies globally to EU residents’ data, while DPDPA focuses on digital data processed in India.
- Data Covered: GDPR includes both digital and structured manual data; DPDPA only covers digital data.
- Consent: DPDPA prioritises consent as the primary basis for processing, while GDPR allows six legal bases, including “legitimate interests.”
- Children’s Data: DPDPA sets the age of consent at 18, stricter than GDPR’s threshold of 16 (or 13 in some cases).
- Penalties: DPDPA imposes fixed fines up to ₹250 crores per violation, unlike GDPR’s turnover-based penalties.
- Breach Reporting: DPDPA requires reporting all breaches, whereas GDPR mandates reporting only high-risk incidents.
Key Operational Challenges:
- Consent Management: Retrofitting GDPR-based systems to meet DPDPA’s stricter consent-first model.
- Language Requirements: Privacy notices must be available in English and 22 Indian languages.
- Vendor Management: Stronger contracts needed as DPDPA shifts liability solely to data fiduciaries.
- Audit Readiness: DPDPA requires annual independent audits for Significant Data Fiduciaries (SDFs).
My takeaway: with DPDPA enforcement starting in May 2027, businesses must act now to ensure compliance with both laws. Automating privacy workflows and using AI compliance tools can simplify adherence to these complex regulations.
Scope and Applicability: Who Do These Laws Cover?
DPDPA vs GDPR: Key Differences at a Glance
Understanding which law applies requires a closer look at operational triggers, types of data involved, and the obligations placed on entities. While both GDPR and DPDPA have a broad reach, the specifics of their application differ in ways that can significantly impact operations.
Territorial Scope: GDPR vs DPDPA
GDPR covers any organisation that offers goods or services to EU residents or monitors their behaviour, regardless of the organisation’s location. For example, an Indian SaaS company selling to German enterprises would fall under GDPR’s jurisdiction.
DPDPA, on the other hand, applies to digital personal data processed in India and extends to activities targeting Indian individuals. For instance, a Singapore-based subsidiary of an Indian conglomerate serving Indian customers would be subject to DPDPA.
“The rights and protections to people (data subjects) found in the GDPR ‘travels’ with the data, meaning that the rules protecting personal data continue to apply regardless of where the data is held and processed.” - K&S Partners
To put it simply, GDPR follows the person, while DPDPA follows the transaction. In certain cases, both laws can apply to the same dataset. This distinction is key to understanding how each law defines its scope and limitations.
Differences in Data Coverage
The frameworks also differ in the types of data they cover and how they handle it. GDPR governs all personal data, whether processed digitally or stored in structured manual systems like physical HR files. DPDPA, however, applies solely to digital personal data - data collected in digital form or data collected offline and later digitised.
For DPDPA, paper records remain outside its purview unless digitised. Additionally, personal data made public by the individual or under legal obligation is exempt under DPDPA. In contrast, GDPR protects public data, offering no such exemption. This distinction is especially relevant for teams relying on publicly sourced datasets for research or sales.
Another key difference lies in how the laws treat sensitive data. DPDPA does not categorise data into “ordinary” and “sensitive” types, unlike GDPR, which has stricter rules for “Special Categories” like health records, biometric data, and religious beliefs. Miriam Everett, Global Head of Data and Privacy at Herbert Smith Freehills, explains:
“Unlike the GDPR, the DPDPA does not distinguish between personal data and sensitive personal data. Instead, all personally identifiable data is regulated in the same way.”
For Indian businesses and tech companies, this means applying a uniformly high level of security to all digital personal data. With DPDPA penalties capped at ₹250 crores per violation, even mid-sized companies face significant exposure, unlike GDPR’s turnover-based fines. These differences are crucial for crafting an effective compliance strategy.
Below is a summary of the key distinctions between DPDPA and GDPR in terms of data coverage and extraterritorial scope:
| Feature | DPDPA (India) | GDPR (EU) |
|---|---|---|
| Data Covered | Digital personal data only | Digital and structured non-digital personal data |
| Sensitive Data | No sub-categories; uniform treatment | ”Special Categories” with stricter rules |
| Publicly Available Data | Exempt if made public by the individual | Protected regardless of public status |
| Extraterritorial Reach | Applies if offering goods/services to India | Applies if offering goods/services to or monitoring EU residents |
| Age Threshold for Minors | Under 18, no exceptions | Under 16 (member states can lower to 13) |
Consent and Legal Basis for Data Processing
How organisations justify processing personal data is a critical difference between GDPR and DPDPA. Missteps under either framework can lead to severe penalties.
GDPR’s Six Lawful Bases vs DPDPA’s Consent-First Model
Under GDPR, organisations can choose from six lawful bases for data processing: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Many businesses lean on legitimate interests for activities like marketing, analytics, or product improvement, often bypassing explicit consent.
DPDPA, however, takes a consent-first approach. Consent is the primary legal basis, with limited exceptions termed “legitimate uses.” These include voluntary data submission for clear purposes, narrowly defined employment-related needs (such as preventing loss or providing benefits), medical emergencies, and legal compliance. Unlike GDPR, DPDPA does not have a broad equivalent to legitimate interests.
“If your GDPR compliance relies on ‘legitimate interests’, you need to retrofit consent mechanisms for DPDP.” - TCSA Compliance Team
Cyril Amarchand Mangaldas further highlights:
“Under the Act, a Data Principal’s consent for a purpose which is later found to be unnecessary may not be considered valid even where a Data Fiduciary has duly recorded the Data Principal’s consent.”
For instance, a telemedicine app might request access to a user’s contact list and obtain consent on paper. However, if the data collection is later deemed unnecessary, it would fail DPDPA’s necessity test.
| Aspect | GDPR (EU) | DPDPA (India) |
|---|---|---|
| Lawful Bases | Six bases including legitimate interests | Consent (primary) with specific “legitimate uses” |
| Legitimate Interest | Widely used for marketing, analytics, and operations | Not recognised; no general equivalent |
| Consent Standard | Freely given, specific, informed, and unambiguous | Free, specific, informed, unconditional, and signified by clear affirmative action |
| Language Requirements | As per the member state’s language | English and 22 scheduled Indian languages |
| Necessity Check | Not explicitly required after consent | Regulators can invalidate consent if processing is deemed unnecessary |
What This Means for Indian Businesses
For Indian businesses, the implications are substantial. Processing activities that rely on GDPR’s legitimate interests - such as email marketing, behavioural analytics, or A/B testing - will likely require explicit, purpose-specific consent under DPDPA.
“DPDPA consent involves IT and UI/UX redesign.” - S. Chandrasekhar, Partner, K&S Partners
This means businesses must overhaul consent mechanisms. Consent flows need to be granular, offering separate opt-ins for distinct purposes rather than blanket “accept all” options. Additionally, consent notices must be available in English and the 22 scheduled Indian languages. DPDPA also introduces Consent Managers - government-registered intermediaries that allow users to manage their consent across platforms. Organisations must ensure their systems can integrate with these tools.
Employee data is another area of concern. While GDPR often justifies HR data processing under contractual necessity, DPDPA’s employment exemption is narrowly defined. Routine HR operations like performance reviews, attendance tracking, and hiring will likely require consent, creating a significant shift in how Indian companies handle employee data.
Data Subject Rights and Business Obligations
Data Subject Rights vs Data Principal Rights
The GDPR uses the term Data Subjects to refer to individuals, while the DPDPA refers to them as Data Principals. This change in terminology signals a shift in how rights are framed and exercised under each regulation.
Under GDPR, individuals are granted 8 specific rights, whereas the DPDPA outlines 7. Notably, the DPDPA does not include the GDPR’s rights to data portability, to restrict processing, or to object to processing. However, the DPDPA introduces a Right to Nominate, which allows individuals to appoint a representative to exercise their data rights in case of death or incapacity. This addition may require businesses to update their privacy portals to include nomination options and revise internal workflows to accommodate this new feature. Implementing such changes highlights the need for businesses to stay agile in their compliance efforts.
These differences in the rights framework not only impact how individuals control their data but also require businesses to adjust their compliance processes.
| Right | GDPR (EU) | DPDPA (India) |
|---|---|---|
| Access & Correction | Yes | Yes |
| Erasure | Yes | Yes |
| Data Portability | Yes | No |
| Restrict Processing | Yes | No |
| Object to Processing | Yes | No |
| Right to Nominate | No | Yes |
| Grievance Redressal | General complaint to supervisory authority | Mandatory 90-day internal resolution |
Under the DPDPA, withdrawing consent requires businesses to delete the associated data automatically unless legal retention is necessary. For example, sectors like e-commerce must adhere to a 3-year retention limit. This stipulation necessitates that organisations maintain real-time, auditable records of consent and corresponding data retention timelines.
The DPDPA also places certain responsibilities on Data Principals. Filing false grievances or providing inaccurate information can result in penalties. To ensure transparency, organisations must update their privacy notices to clearly outline these responsibilities.
Impact on Privacy and Compliance Teams
The rights outlined by the DPDPA bring unique challenges for compliance teams. For instance, when responding to rights requests, businesses must disclose specific third-party names rather than general categories. This requires detailed and up-to-date data mapping, which can be difficult to achieve manually.
Additionally, the DPDPA mandates a formal grievance redressal process, requiring businesses to address or formally respond to grievances within 90 days before they can be escalated to the Data Protection Board of India. Missing this deadline could lead to regulatory scrutiny, making robust tracking systems essential.
“Consent management, in the DPDPA’s design, is operational infrastructure - not a compliance notice on a web page.” - Consently
For organisations already managing GDPR Subject Access Requests manually, integrating the DPDPA’s requirements - such as nomination workflows, 90-day grievance timelines, and consent-triggered deletion - can stretch privacy teams. Automating these processes, from synchronising deletion across storage systems to monitoring grievance timelines, is critical to achieving compliance without increasing operational risks.
Enforcement, Penalties, and Breach Reporting
Breach Notification Timelines and Requirements
The approach to handling data breaches under GDPR and DPDPA differs significantly.
GDPR mandates that businesses notify their supervisory authority within 72 hours of discovering a breach. However, they are required to inform users only if the breach presents a “high risk” to individuals’ rights and freedoms. DPDPA, on the other hand, takes a stricter stance - all breaches, regardless of severity, must be reported to the Data Protection Board (DPB) and affected users.
As the TCSA Compliance Team highlights:
“Even a low-risk breach (e.g., accidental exposure of email addresses) requires user notification under DPDP, whereas GDPR might not.”
This means Indian companies cannot rely on a risk-based approach to decide whether a breach warrants notification. Even minor incidents demand full disclosure. This necessitates the creation of breach response templates tailored specifically for India and the appointment of on-ground personnel to handle direct communications with the DPB.
These stringent reporting requirements are directly tied to the heavy penalties outlined in DPDPA.
Penalties and Enforcement Authorities
The enforcement and penalty structures under GDPR and DPDPA diverge sharply, with significant implications for businesses.
GDPR calculates fines as a percentage of global annual turnover - up to 4% or €20 million, whichever is higher. This approach means smaller businesses with lower revenues face proportionally smaller fines. In contrast, DPDPA imposes fixed penalties for violations, irrespective of company size. This creates a situation where both startups and large corporations are subject to the same maximum fine of ₹250 crores (approximately €27 million).
Here’s a breakdown of DPDPA’s tiered penalty structure:
| Violation | DPDPA Penalty |
|---|---|
| Failure to notify the DPB or users of a breach | Up to ₹50 crores |
| Violation of data retention obligations | Up to ₹150 crores |
| Violation of children’s data obligations | Up to ₹200 crores |
| Maximum penalty per violation | Up to ₹250 crores |
Goldie Dhama, Partner at Deloitte Touche Tohmatsu India LLP, explains:
“Under DPDP, only the data fiduciary is liable to the regulator (Data Protection Board), and any bilateral claims between the data fiduciary and data processor are to be addressed under the data processing contractual agreement.”
Under GDPR, both data controllers and processors share direct statutory liability. In contrast, DPDPA places all regulatory responsibility on the Data Fiduciary, even if a third-party processor causes the breach. This makes it crucial for Indian businesses to include strong indemnity clauses and enforce strict security measures in data processing agreements.
The DPB operates differently from EU supervisory authorities. It functions as a centralised adjudicatory body, focused on investigating complaints and imposing fines. However, it lacks independent rulemaking authority, which rests with the Central Government. Additionally, for repeat violations, the Government has the power to block public access to a Data Fiduciary’s platform entirely. DPDPA enforcement will officially begin on 13 May 2027, following an 18-month implementation period.
Turn Fixed-Penalty Exposure Into a Board-Ready Risk View
Because DPDPA penalties are fixed rather than turnover-linked, the same ₹250 crore ceiling applies whether you are a Series A fintech or a listed enterprise — which makes prioritisation, not scale, the deciding factor in where you spend your next compliance rupee. A unified risk register lets your team map each DPDPA obligation to a named owner, a control, and a quantified exposure in one place, so a two-week spreadsheet reconciliation becomes a live view your board can read in minutes. Teams using CISOGenie’s risk management module correlate DPDPA, GDPR and framework risks in a single register, cutting duplicated assessment effort and giving you defensible evidence of prioritisation without adding headcount.
Cross-Border Data Transfers and Data Localisation
Understanding cross-border data transfers is essential for businesses juggling compliance with both GDPR and DPDPA. The way these frameworks handle data transfers and localisation is quite different, and navigating these differences requires careful planning.
GDPR Adequacy Decisions vs DPDPA Localisation Rules
GDPR restricts data transfers outside the EU unless the destination country has an adequacy decision or other safeguards like Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). DPDPA, on the other hand, takes a different approach. Transfers are generally allowed unless the Indian government specifically blacklists a destination.
As explained by the TCSA Compliance Team:
“India will maintain a whitelist of approved countries… If transferring to non-whitelisted countries, you need specific government-approved contract templates.”
Unlike GDPR, DPDPA doesn’t enforce a blanket localisation requirement. Instead, it empowers the government to notify certain data categories or Significant Data Fiduciaries (SDFs) - those handling data of over 20 lakh Indian users - to store data within India. However, sector-specific rules from regulators like the RBI (for payment data) and SEBI (for trading data) already mandate localisation, regardless of DPDPA’s provisions.
Looking ahead, the European Data Protection Supervisor has expressed reservations about granting India adequacy status due to concerns over government exemptions and the independence of the Data Protection Board.
“As India pushes to be a global data hub, the EDPS’s cautious stance underscores how implementation gaps in the DPDPA risk undermining international confidence.” - Tanusha Tyagi, Research Assistant, Observer Research Foundation
| Aspect | GDPR (EU) | DPDPA (India) |
|---|---|---|
| Transfer Logic | Restricted unless destination is “adequate” | Permitted unless destination is blacklisted |
| Primary Safeguards | Adequacy decisions, SCCs, BCRs | Government-approved contract templates |
| Localisation Mandate | None | No general mandate; SDF-specific and sector-specific rules apply |
| Sectoral Overlap | Generally harmonised | Must coexist with RBI and SEBI localisation rules |
| BPO Exemption | Applies to all processing in the EU | Exempt for foreign data processed under outsourcing contracts |
What This Means for Indian Enterprises
For Indian businesses, managing compliance with these dual frameworks is no small task. Your existing GDPR SCCs won’t automatically satisfy DPDPA requirements. The Data Protection Board (DPB) is expected to release standard contract templates by Q2–Q3 2026. Until then, businesses should continue using GDPR SCCs while preparing to adopt the new templates as they become available.
“The DPDPA does not currently specify additional measures to be followed for international data transfers, although these may be set out subsequently in further regulations.” - Cyril Amarchand Mangaldas
Vendor risk management becomes a more pressing concern under DPDPA. The law places regulatory liability solely on the Data Fiduciary, even for breaches caused by third-party processors. This makes thorough audits of global vendors essential. Storing a local copy of Indian user data, even when not legally required, can simplify regulatory investigations and offer a safety net if certain cross-border transfers are restricted later.
For businesses nearing the 20-lakh-user mark, early preparation for SDF classification is a wise move. This includes conducting annual audits and planning for potential localisation requirements.
As cross-border data rules evolve, businesses must prioritise strong vendor risk management and consider automating compliance processes to keep pace with these complex requirements.
Key Actions for Indian Businesses Managing Both Frameworks
Compliance Actions for Dual-Regime Operations
If your organisation already complies with GDPR, you’re in a strong position to address India’s DPDPA requirements. As the TCSA Compliance Team explains:
“Your GDPR investment saves you 60-70% of DPDP implementation cost.”
However, bridging the remaining 30–40% will require focused efforts. Typically, this gap can be closed with an investment of ₹7–11 lakhs, while a one-week gap analysis might cost ₹1–2 lakhs. For businesses starting from scratch, building DPDPA compliance could cost ₹18–25 lakhs.
One of the most critical areas to address is your consent architecture. Unlike GDPR, which allows “legitimate interests” as a lawful basis for processing, DPDPA mandates explicit, purpose-specific consent for any commercial activity. This means revisiting and retrofitting any processes relying on legitimate interests. As S. Chandrasekhar, Aman Varma, and Sudeshna Banerjee point out: “Consent under DPDPA is therefore not just a policy exercise, but an IT and product design (UI/UX) challenge”. Your user interfaces must make it as easy to withdraw consent as it is to give it.
Two other areas need immediate attention:
- Children’s Data: Under DPDPA, the age of digital consent is set at 18, with no exceptions. GDPR, by contrast, sets it at 16 and allows EU member states to lower it to 13. If your platform serves Indian users, you will need to implement verifiable parental consent mechanisms for anyone under 18.
- Language Localisation: Privacy notices must be available in English and any of the 22 scheduled Indian languages, depending on user preference. These notices should be written in simple, clear language. Translation costs for three to four languages could range from ₹50,000 to ₹1 lakh.
Addressing these gaps ensures compliance with both DPDPA and GDPR while reducing operational risks.
Additionally, for vendor management, consider adding a DPDPA-specific addendum to your existing GDPR Data Processing Agreements. This will help account for India’s breach notification rules and regulations around children’s data, without overhauling your global contracts.
Given the complexity of managing these requirements, automating compliance monitoring is becoming increasingly important.
Model the Cost of Closing the Remaining 30–40%
The numbers in this section — ₹7–11 lakhs to bridge a GDPR-to-DPDPA gap, ₹18–25 lakhs to build from scratch — are budget conversations, not compliance conversations, and they land better when you can show the arithmetic. Modelling the tooling, audit-prep and translation line items side by side against automated workflows lets you present a defensible number to finance in an afternoon instead of across three planning cycles, and makes the trade-off between analyst hours and platform spend explicit rather than assumed.
Using AI to Maintain Continuous Compliance
Automation is key to handling the compliance challenges posed by operating under two frameworks. Managing GDPR and DPDPA manually - with their differing consent requirements, breach reporting timelines, audit rules, and localisation standards - can increase operational risks. For example, DPDPA requires notifying the Data Protection Board and all affected users for every breach, regardless of severity. GDPR, on the other hand, only mandates this for breaches deemed “high risk”. Without automation, keeping track of these nuances in a distributed organisation can be overwhelming.
This is where an AI-native GRC platform like CISOGenie becomes invaluable. Instead of relying on spreadsheets and manual tracking, CISOGenie uses autonomous AI agents to continuously monitor compliance across multiple frameworks, including DPDPA and GDPR. It automates evidence collection, keeps audit-ready documentation up-to-date, and flags compliance gaps in real time, ensuring your organisation is always prepared for regulatory scrutiny.
For businesses nearing the 20-lakh-user threshold that qualifies them as a Significant Data Fiduciary (SDF), the stakes are even higher. SDFs must undergo mandatory annual independent audits and conduct Data Protection Impact Assessments. CISOGenie’s centralised dashboards and automated workflows are designed to ease the burden on GRC and privacy teams, ensuring continuous audit readiness.
Conclusion: Managing Compliance Across Multiple Regulations
Though GDPR and DPDPA aim to safeguard personal data, their methods differ significantly. These distinctions influence your systems, products, and vendor agreements. For instance, DPDPA mandates consent as the default, requires breach notifications for all incidents (regardless of severity), and sets a strict age limit of 18 for handling children’s data.
For Indian businesses, this means your GDPR compliance efforts provide a useful starting point but are far from sufficient. Simply put, being GDPR-compliant does not automatically mean you’re ready for DPDPA.
To address these gaps, a clear and strategic plan is necessary. One of the most effective methods is adopting a “maximum protection” standard - always applying the stricter rule when GDPR and DPDPA differ. For example, use DPDPA’s age threshold of 18 for children’s data, treat all breaches as notifiable, and ensure withdrawing consent is as seamless as giving it. This approach simplifies compliance, reduces risks, and strengthens your organisation’s ability to handle regulatory demands.
Time is of the essence here. With DPDPA enforcement set to begin on 13 May 2027, the clock is ticking. Manual processes simply won’t cut it when managing compliance across both frameworks. As Gartner highlights, “privacy failures are now more likely to arise from system execution gaps than from missing legal documentation”. Tools like CISOGenie, an AI-powered GRC platform, can fill this gap by offering continuous monitoring for both DPDPA and GDPR, automating evidence collection, and providing real-time alerts. This ensures your “maximum protection” standard is not just a policy but an active, operational practice.
FAQs
How do I decide if DPDPA, GDPR, or both apply to my business?
The scope of applicability hinges on where your data is processed and who your customers are. The DPDPA governs digital personal data processed within India or aimed at individuals in India. On the other hand, GDPR covers the personal data of EU residents, no matter where your business operates. CISOGenie simplifies the process by identifying overlaps, ensuring that your GDPR compliance efforts also meet DPDPA standards. It focuses on specific needs like managing consent and providing notices tailored to local requirements.
What must I change if my GDPR compliance relies on legitimate interests?
Under the DPDPA, businesses cannot rely on legitimate interests or contractual necessity as legal bases for processing personal data. Instead, you must pivot to using explicit, informed, and granular consent. This means rethinking how you approach data collection and processing.
Start by conducting data mapping and audits to organise and categorise your processing activities. For any activities that fall outside the DPDPA’s outlined legitimate uses, you’ll need to establish standalone consent mechanisms. Make sure that consent is unbundled - users should not have to agree to non-essential data processing as a condition for accessing essential services. Similarly, consent must be unconditional, ensuring individuals have genuine freedom of choice.
For example, a telecom provider cannot make a customer’s access to basic call services contingent on agreeing to share data for marketing purposes. This shift demands a clear, transparent, and user-focused approach to consent management.
How can we stay audit-ready for DPDPA without manual spreadsheets?
To prepare for the DPDPA while avoiding the hassle of manual spreadsheets, consider using an AI-powered compliance platform. These platforms simplify workflows by replacing disjointed tools and automating essential tasks like collecting evidence and monitoring compliance. For instance, tools like CISOGenie can align controls with DPDPA requirements - such as consent management and breach reporting - in real time. This ensures ongoing compliance and clarity as the enforcement deadline of 13 May 2027 draws closer.
See DPDPA and GDPR Run as One Control Set
Most Indian teams end up maintaining two compliance programmes for one data estate — one shaped by GDPR, one retrofitted for DPDPA — and the duplication shows up as repeated evidence collection, parallel audits and two sets of vendor reviews. Mapping both regimes onto a single set of controls means each piece of evidence is collected once and satisfies both, and your act-to-rule mapping stays current as DPDP Rules are notified ahead of the 13 May 2027 enforcement date. Walk through your own control set with our team and see where the overlap already covers you and where a small number of DPDPA-specific controls need to be added.