An Indian product may fall under both laws when it processes digital personal data covered by the DPDP Act and offers goods or services to, or monitors, people in the EU/EEA. The organisation's GDPR role may be controller or processor; under DPDP it may be a Data Fiduciary or Data Processor. This guide compares the operational questions—lawful basis, consent, breach response, DPO duties and transfers—without assuming the same role under both regimes.
- Regulator: Data Protection Board of India
- Scope: Digital personal data of Data Principals in India + offshore processing for offering goods/services to India
- Lawful bases: Consent + certain legitimate uses (narrowly defined)
- Breach reporting: Follow the final Rules 2025 notice and detailed-report process
- Max penalty: ₹250 crore per instance (Schedule)
- DPO: Mandatory only for Significant Data Fiduciaries
- Transfer regime: Permitted except to notified restricted countries
- Regulator: National DPAs (BfDI, CNIL, DPC etc.) + EDPB
- Scope: Personal data of EU/EEA residents wherever processed
- Lawful bases: 6 grounds incl. legitimate interest balancing test
- Breach reporting: 72 hours to DPA; without undue delay to data subject if high risk
- Max penalty: €20M or 4% global annual turnover, whichever higher
- DPO: Mandatory for public bodies, large-scale monitoring, special-category data
- Transfer regime: SCCs / adequacy decision / BCRs only
Why the comparison matters for Indian companies in 2026
The DPDP Act received assent in August 2023 and the final DPDP Rules 2025 were published on 14 November 2025 with phased commencement. Some institutional provisions applied on notification, Consent Manager obligations follow on the twelve-month schedule, and the main Data Fiduciary duties follow on the eighteen-month schedule. The DPDP Rules deadline guide tracks that sequence. A GDPR programme is a useful baseline, but it cannot be copied wholesale because consent mechanics, DPO triggers and cross-border transfer differ.
Clause-by-clause comparison
| Topic | DPDP Act 2023 | GDPR | Practical implication |
|---|---|---|---|
| Definition of personal data | Any data about an identifiable individual in digital form | Any info relating to identified/identifiable natural person | DPDP excludes non-digital records; GDPR covers manual filing systems |
| Sensitive categories | Not separately defined | Article 9 special categories (health, biometrics, etc.) | Indian privacy notices still need to flag sensitive data under sectoral law (HIPAA-equivalent for health) |
| Consent standard | Free, specific, informed, unconditional, unambiguous — clear affirmative action | Free, specific, informed, unambiguous — affirmative action | Functionally similar — DPDP wording is slightly stricter ('unconditional') |
| Children's consent age | Below 18 — verifiable parental consent | Below 16 (member state may lower to 13) | DPDP is significantly stricter — material redesign for ed-tech and gaming products |
| Legitimate interest | Not recognised; replaced by 'certain legitimate uses' (narrow list) | Article 6(1)(f) — broad with balancing test | DPDP forces consent-by-default for marketing, analytics, profiling |
| DPO requirement | Only Significant Data Fiduciaries | Public authorities + large-scale monitoring + special-category data | DPDP threshold is volume + sensitivity; GDPR threshold is activity-based |
| Breach notification process | Final Rules 2025 require notice to affected Data Principals and the Board, followed by prescribed details | 72h to the supervisory authority where required; subjects without undue delay if high risk | One incident workflow, with separate legal tests and forms |
| Right to erasure | Yes, with retention exceptions | Yes (Art 17), with legal-basis exceptions | Aligned |
| Data portability | Not explicitly granted | Yes (Art 20) | DPDP gap for cross-border products |
| Right to object / automated decisions | Limited; significant ADM not separately regulated | Article 22 explicit rights against automated decisions | GDPR is stricter for AI-driven services |
| Cross-border transfer | Permitted except to blacklisted countries (negative list) | Adequacy / SCCs / BCRs (positive whitelist) | DPDP is more permissive — but EU side still binds Indian exporters |
| Maximum penalty | Scheduled maxima by contravention, including up to ₹250 crore for specified failures | €20M or 4% global turnover for the upper tier | Model the actual contravention and turnover; do not compare headline ceilings alone |
Side-by-side mapping of the most operationally relevant clauses
The Significant Data Fiduciary trigger
The DPDP Act lets the Government notify certain fiduciaries as Significant Data Fiduciaries (SDFs). SDFs face additional obligations, including an India-based DPO, a DPIA and an independent data audit at the prescribed cadence. The statutory criteria include the volume and sensitivity of data and risks to rights, sovereignty, security and electoral democracy. Until a business is formally designated, the sound approach is to identify which SDF controls would require long lead times and keep the evidence ready without representing that designation as automatic.
Consent: where DPDP diverges from GDPR most
GDPR provides six lawful bases, including legitimate interests where the balancing test is satisfied. DPDP instead relies on consent plus the Act's listed certain legitimate uses. A Consent Manager is an optional intermediary through which a Data Principal can give, manage, review and withdraw consent; it is not a mandatory gateway for every consent. Indian SaaS teams should map each purpose to consent or a statutory legitimate use, then make withdrawal as easy as giving consent and ensure downstream processors receive the change.
Cross-border transfer in practice
DPDP flips the GDPR model. Under GDPR, a transfer out of the EU/EEA needs a lawful Chapter V mechanism such as adequacy, SCCs, BCRs or a relevant derogation. Under DPDP section 16, the Central Government may restrict transfers to notified countries or territories, while stricter sector rules still apply. The DPDP cross-border transfer guide turns that difference into an implementation checklist. For mixed datasets, document the origin, destination and applicable mechanism for each flow rather than treating the cloud account as one legal transfer.
Breach response — running both clocks
- Hour 0: Detect — ensure your SIEM has data-classification tagging so privacy-impacting events are tagged distinctly
- Hour 0-6: CERT-In direction requires reporting within 6 hours regardless of DPDP/GDPR status
- After initial containment: Follow the current DPDP Rules notice and detailed-report process, the GDPR 72-hour DPA clock where applicable, and any sector-regulator timeline
- Hour 0-72: Notify affected principals/subjects 'without undue delay' if high risk to rights
- Day 7-30: Post-incident report — both regimes expect a remediation update; GDPR is typically more demanding on technical detail
- Day 30-90: External audit / regulator examination — pre-stage forensic evidence and chain-of-custody
What an Indian fiduciary with EU exposure should actually do
- Build a unified Record of Processing Activities (RoPA) — single source covering both GDPR Art 30 and DPDP Notice/Purpose register
- Map every processing activity to lawful basis under both regimes — consent under DPDP, Art 6 ground under GDPR
- Implement consent records and withdrawal propagation that can support a registered Consent Manager where your users choose one
- Run one DPIA template that satisfies DPDP Rules + GDPR Art 35 — risk language and likelihood tiers need to match both
- Designate one DPO with India residency (DPDP SDF requirement) who also meets GDPR Art 37 independence requirements
- Update vendor / processor contracts — DPDP requires DF-DP contractual chain; GDPR requires Art 28 DPA. One contract addendum covering both is the norm.
- Test breach notification across both timelines using tabletop exercises every six months
Penalty math: which one will hurt more?
Do not compare only the largest headline numbers. DPDP uses scheduled maximum penalties for specified contraventions, while GDPR can reach €20 million or 4% of worldwide annual turnover for the preceding financial year, depending on the infringement tier. A single event may trigger separate investigations, but the facts, legal basis and calculation differ. Model realistic exposure with counsel and confirm whether your cyber policy covers investigation costs, notification and legally insurable penalties.
Start with the current implementation dates, map the overlapping controls, and keep a separate legal basis and transfer decision for each regime.