DPDP Act vs GDPR: key differences for Indian companies
Reviewed against the law as of 28 September 2026
How India's DPDP Act differs from GDPR: scope, lawful bases, breach reporting, children, transfers, rights and penalties, and what carries over.
Many Indian companies already work with GDPR because they serve European customers. The DPDP Act borrows familiar ideas, but it is shorter, more prescriptive in places, and different in ways that matter for implementation.
Side by side
| Topic | GDPR | DPDP Act 2023 |
|---|---|---|
| Scope | Personal data in any form (automated, or in a filing system) | Digital personal data, including data collected offline and later digitised |
| Publicly available data | Covered | Excluded when made public by the person or under a legal obligation |
| Lawful bases | Six, including contract and legitimate interests | Consent, or a closed list of legitimate uses |
| Sensitive data | Special categories with stricter rules | No separate category; children's data has extra rules |
| Children | Consent age 13 to 16, by country | Under 18; verifiable parental consent; no tracking or targeted ads |
| Notice languages | Clear and plain language | English or any Eighth Schedule language, on request |
| Consent Managers | None | Registered intermediaries to give and withdraw consent |
| Breach reporting | To the authority within 72 hours if a risk; to people if high risk | To the Board and every affected person for every breach; detailed Board report within 72 hours |
| Rights | Access, rectification, erasure, restriction, portability, objection, automated decisions | Access summary, correction, completion, updating, erasure, grievance, nomination |
| DPO | Required for certain controllers and processors | Required for Significant Data Fiduciaries |
| Transfers | Adequacy, safeguards such as SCCs | Allowed except to countries the government restricts |
| Penalties | Up to €20 million or 4% of worldwide turnover | Fixed maximums per type of failure, up to ₹250 crore |
| Compensation to individuals | Yes | No; penalties go to the government |
What carries over from GDPR work
- Data inventories and records of processing.
- Security controls, encryption, access control and logging.
- Processor contracts, updated for DPDP specifics.
- Rights request workflows, adjusted for the DPDP rights and the ninety-day limit.
- Breach response playbooks, adjusted for notifying every breach.
What needs new work
- Lawful basis review. Processing on "legitimate interests" or "contract" needs to fit consent or a section 7 legitimate use.
- Notices. Itemised, standalone and available in Indian languages.
- Children. Age thresholds and tracking rules are stricter.
- Breach reporting. Every breach, to the Board and to each person, plus CERT-In within six hours.
- CERT-In. Log retention in India and NIC or NPL time sync have no GDPR equivalent.
TrustNiq maps DPDP and CERT-In obligations to controls tested on your systems, and shows ISO 27001, NIST CSF and SOC 2 against the same evidence. See pricing.
Frequently asked questions
If we comply with GDPR, are we DPDP compliant?
Not automatically. GDPR work on inventories, security and rights handling carries over, but DPDP differs on lawful bases, breach reporting, children's age, notice languages and Consent Managers, and needs its own gap review.
Does DPDP have special categories of data like GDPR?
No. The DPDP Act treats all personal data alike, although children's data has extra rules and the volume and sensitivity of data can lead to Significant Data Fiduciary status.
Sources
- Digital Personal Data Protection Act, 2023meity.gov.in
- Regulation (EU) 2016/679 (GDPR), EUR-Lexeur-lex.europa.eu
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.