India · European Union · Practical comparison
DPDP Act vs GDPR: where a shared privacy programme needs separate checks
The DPDP Act and GDPR share familiar ideas such as transparency, security and individual rights, but their requirements are not interchangeable. If your organisation serves people in India and the EU, map each law to the processing it covers.
01 · Compare in context
The differences that commonly change implementation
| Area | India DPDP Act | EU GDPR |
|---|---|---|
| Territorial reach | Applies to digital personal data processed in India, including certain data collected offline and digitised later; it also covers processing outside India connected with offering goods or services to Data Principals in India. | Applies to processing in the context of an EU establishment and certain processing by organisations outside the EU that offer goods or services to, or monitor, people in the EU. |
| Roles and terms | Uses Data Fiduciary and Data Processor. A Data Fiduciary determines purpose and means and remains responsible for compliance. | Uses controller and processor. Controllers determine purposes and means and carry the principal accountability obligations. |
| Lawful grounds | Processing is based on consent or specified legitimate uses under the Act. The Act does not establish the GDPR’s six-basis menu. | Article 6 lists six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests, subject to their conditions. |
| Children | A child is under 18. Verifiable parental consent is the general rule, with specified statutory exceptions and limits on detrimental processing, tracking and targeted advertising. | For consent to information society services offered directly to a child, Article 8 sets a default age of 16, with Member States able to lower it to no less than 13. Other child protections also apply. |
| Individual rights | Includes access to information, correction, completion, updating and erasure, grievance redressal and nomination, as set out in the Act. | Includes access, rectification, erasure, restriction, data portability, objection and protections around certain automated decisions, subject to exceptions. |
| Breach response | Notify the Board and affected Data Principals as prescribed. Rule 7 requires affected-person intimation without delay and detailed Board information within 72 hours, subject to the Rule. | Notify the supervisory authority within 72 hours where feasible when a breach is likely to risk individuals’ rights and freedoms; notify affected people without undue delay when high risk applies. |
| Transfers | Transfers outside India are generally permitted subject to restrictions the Central Government may specify and other applicable Indian law. | Transfers outside the EEA require a Chapter V mechanism, such as adequacy or appropriate safeguards, subject to conditions. |
| Enforcement and fines | The Data Protection Board may impose penalties under the Act’s Schedule; the maximum listed penalty is ₹250 crore for a specified security safeguard breach. | Supervisory authorities can impose fines up to €20 million or 4% of worldwide annual turnover for certain infringements, whichever is higher, subject to Article 83. |
This table is a high-level orientation. Each law has exceptions, detailed conditions, local rules and evolving interpretations; assess the specific processing rather than relying on labels alone.
Primary sources: DPDP Act, 2023, DPDP Rules, 2025 and GDPR text.
02 · Operational impact
A shared control can still need a different rulebook
The biggest risk in a cross-border programme is assuming that one form, retention period or response script satisfies both laws without checking the details.
Keep lawful basis separate
GDPR processing may rely on a non-consent basis. Under DPDP, map the activity to consent or a specified legitimate use and provide the required notice.
Route people to the right process
DPDP includes nomination and a grievance-first route before a Board approach. GDPR includes rights such as portability and restriction with its own response rules.
Align age and escalation logic
Different age thresholds and breach notification triggers can affect the same product, audience and incident playbook.
03 · Implementation
Map one data flow to each applicable law
- Identify where people are located, which entity offers the service and which systems process their data.
- Document purposes and legal grounds separately for the DPDP Act and GDPR.
- Compare notices, consent withdrawal, rights routes, grievance handling and child safeguards.
- Review incident reporting triggers, recipients and deadlines under both regimes.
- Map international transfers and vendor contracts to the applicable transfer rules.
- Assign a local owner for legal updates and keep the analysis current.
See our DPDP Act summary, Rules guide and compliance checklist.
Questions teams ask
DPDP vs GDPR FAQs
Does GDPR compliance automatically cover DPDP?
No. Some governance controls can be reused, but the laws differ in lawful grounds, child data, rights, breach handling and transfers. Map DPDP obligations independently.
Does DPDP have the GDPR legitimate interests basis?
No. DPDP provides consent and specified legitimate uses. GDPR Article 6 includes legitimate interests as one of six lawful bases, with conditions.
Are the child consent ages identical?
No. DPDP defines a child as under eighteen. GDPR’s Article 8 threshold for a child’s own consent to certain online services is set by each Member State between thirteen and sixteen.
Can I use the same privacy notice for both?
Possibly, if it clearly and accurately covers each applicable law, audience and processing purpose. A single document does not remove the need to satisfy each regime.
Make your India requirements visible in the programme
Start with a DPDP-specific checklist and connect it to your existing privacy controls.