GDPR vs DPDP: What India's Data Protection Law Does Differently

If your business has spent the last few years grappling with the European Union's General Data Protection Regulation (GDPR), you might assume India's Digital Personal Data Protection Act, 2023 (DPDP Act) is simply GDPR with a Delhi postcode. That assumption will cost you.

The DPDP Act is not a copy-paste of GDPR. It is a deliberately different framework shaped by India's digital scale, its constitutional privacy jurisprudence (stemming from Justice K.S. Puttaswamy v. Union of India), and the government's need to balance citizen protection with economic growth. Understanding where the two laws diverge is essential for any business operating across both jurisdictions - or for Indian businesses that mistakenly calibrated their compliance to European standards without checking what their own parliament actually wrote.

This article breaks down the eight most important differences and explains what is genuinely unique about India's approach.

---

1. Scope: Digital Only vs. Everything Digital and Analogue

GDPR (Article 2) applies to the processing of personal data wholly or partly by automated means, as well as non-automated processing if the data forms part of a filing system. It captures both digital databases and well-organised paper records.

DPDP Act (Section 3) applies to digital personal data - data collected in digital form, or non-digital data that is subsequently digitised. Offline paper records that never enter a digital system fall outside the Act's scope.

2. Sensitive Data: Two Very Different Philosophies

GDPR Article 9 creates an explicit category of "special categories of personal data" - racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and sex life or orientation. Processing this data is prohibited unless a specific exemption applies.

DPDP Act takes a fundamentally different approach. The Act does not differentiate between general and sensitive personal data in the manner GDPR does. Instead, it focuses on whether valid consent exists for the data being processed, regardless of sensitivity.

3. Lawful Basis: Six Grounds vs. Consent-First

GDPR Article 6 provides six lawful bases for processing: consent, contract, legal obligation, vital interests, public task, and legitimate interests. A European business can rely on "legitimate interests" for marketing, analytics, or fraud prevention without ever asking the individual.

DPDP Act (Sections 4-7) makes consent the primary lawful basis. Section 7 provides narrow "legitimate uses" - such as state benefits, medical emergencies, legal disclosures, and employer-employee relationships - but there is no broad "legitimate interests" equivalent that allows businesses to process data for commercial purposes without consent.

4. Consent Quality: Similar Language, Different Architecture

Both laws demand high-quality consent. GDPR requires it to be "freely given, specific, informed and unambiguous." DPDP Section 6 requires consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action."

The difference is not in the adjectives. It is in the record-keeping and infrastructure.

DPDP uniquely introduces Consent Managers - independent entities that enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform. GDPR has no equivalent institution.

5. Cross-Border Data Transfers: Adequacy vs. Negative List

GDPR Chapter V permits transfers to countries that the European Commission has deemed "adequate," or through mechanisms like Standard Contractual Clauses (SCCs) and Binding Corporate Rules. The burden is on the business to demonstrate that the destination provides adequate protection.

DPDP Act (Section 16) takes a "negative list" approach. Cross-border transfers are generally permitted except to countries that the Central Government specifically prohibits by notification.

6. Children: Under-16 vs. Under-18 with Behavioural Lockdown

GDPR Article 8 requires parental consent for children under 16, though Member States may lower this to 13. It does not impose an automatic prohibition on tracking or targeted advertising.

DPDP Section 9 is substantially stricter:

• Parental consent is required for all individuals under 18 - no flexibility
• Data Fiduciaries are prohibited from tracking or undertaking behavioural monitoring of children
• Targeted advertising directed at children is banned outright
• Consent must be verifiable - not merely a checkbox claiming the user is over 18

7. Obligations: Direct on Everyone vs. Fiduciary-Centric

GDPR places direct obligations on both controllers and processors. A cloud hosting provider that processes personal data on behalf of a retailer has independent compliance duties under GDPR.

DPDP Act places the primary compliance burden on the Data Fiduciary. Data Processors operate under contractual obligations set by the Data Fiduciary. The direct regulatory liability rests with the entity that determined the purpose and means of processing.

8. Enforcement Architecture: Regulator vs. Board

GDPR empowers national Data Protection Authorities (DPAs) across 27 Member States. These authorities can issue guidance, approve codes of conduct, and levy fines up to €20 million or 4% of global annual turnover.

DPDP Act establishes the Data Protection Board of India (DPBI). Unlike GDPR's DPAs, the Board's role is primarily adjudicative - investigating complaints and issuing penalties - rather than issuing broad guidance or regulations. The penalties are fixed sums (up to ₹250 crore per contravention) rather than percentages of revenue.

---

Side-by-Side Comparison

Dimension	GDPR	DPDP Act
Scope	Digital + structured paper records	Digital data only (or digitised data)
Sensitive data	Separate "special category" regime (Article 9)	No formal sensitive data category; consent-based
Lawful bases	Six bases including "legitimate interests"	Primarily consent; narrow "legitimate uses"
Consent infrastructure	No central consent manager	Registered Consent Managers (from ~Nov 2026)
Cross-border transfers	Adequacy decisions + SCCs	Permitted except to prohibited countries (negative list)
Child protection threshold	Under 16 (or 13 per Member State)	Under 18; tracking and targeted ads banned
Processor obligations	Direct obligations on processors	Primarily on the Data Fiduciary
Enforcement	DPAs; up to 4% global turnover	Data Protection Board; up to ₹250 crore fixed

---

What Is Genuinely Unique About DPDP?

Beyond the comparison points, three features of India's law are genuinely without parallel in European data protection:

The Nomination Right

DPDP Section 14 allows a Data Principal to nominate another individual to exercise their rights in case of death or incapacity. This is purpose-built for India's family-centric social structure, where elderly parents or spouses often manage financial and health matters collectively. There is no GDPR equivalent.

Integration with Digital Public Infrastructure

DPDP is designed to work alongside India's DigiLocker, ABHA (Ayushman Bharat Health Account), and UPI ecosystems. The law does not merely regulate data collection; it enables secure, consent-based data sharing within government-backed digital infrastructure. GDPR was never conceived as part of a national digital public infrastructure strategy.

The Phased, Calibrated Rollout

India's government deliberately chose phased implementation - basic rules first, Consent Managers next, full enforcement from May 2027 - allowing businesses time to adapt. GDPR was enforceable in full from day one (25 May 2018). India's approach reflects the reality that millions of Indian SMBs need time to transition from paper registers to auditable digital consent systems.

---

This is the second blog in our DPDP compliance series. Start from the beginning: What Is DPDP? A Guide for SMBs →