DPDP Act vs GDPR: Key Differences

Shared foundations

It helps to start with what the two laws have in common, because it is substantial. Both are built around the idea that personal data should be processed lawfully, transparently and for defined purposes, and both make consent a central lawful basis.

Both give individuals rights over their data — to be informed, to access, to correct and to erase — and both hold a controller, or fiduciary, accountable for compliance, including for the conduct of its processors.

Both also require appropriate security and the reporting of breaches. So at the level of principles, an organisation that respects the GDPR is already most of the way to respecting the DPDP Act.

Because the shared foundations are so substantial, the most efficient mindset is to treat DPDP alignment as an extension of your existing privacy maturity rather than a separate discipline. The instincts a GDPR programme instils transfer directly.

Terminology and definitions

The vocabulary differs even where the concepts align. The GDPR's 'data controller' is the DPDP Act's 'data fiduciary'; its 'data subject' is the 'data principal'. The roles are closely analogous, but the language is distinct and worth getting right.

More substantively, the DPDP Act does not create a separate category of 'special' or 'sensitive' personal data with heightened rules, as the GDPR does. India treats all personal data under a single regime, which simplifies classification considerably.

This is one of the clearest design differences: the GDPR layers extra protections on sensitive categories, while the DPDP Act applies one consistent standard to all personal data.

The absence of a sensitive-data tier is a genuine simplification, but it does not mean sensitivity is irrelevant. The real-world risk of a breach involving health or financial data still influences security expectations and how the Board would view any harm.

Lawful bases for processing

The GDPR offers six lawful bases, including the flexible 'legitimate interests' that many organisations rely on. The DPDP Act is narrower: it centres on consent, supplemented by a defined list of 'legitimate uses' rather than an open-ended balancing test.

This matters in practice. Processing that a GDPR programme might justify under legitimate interests may, under the DPDP Act, require either consent or a specific legitimate use that genuinely fits — there is no general-purpose balancing basis to fall back on.

For organisations mapping across, this is a key area to review: activities relying on GDPR legitimate interests need to be re-examined against the Indian framework.

This is arguably the single most important area to re-examine when mapping from the GDPR. Inventory every activity currently justified by legitimate interests and confirm that, under the DPDP Act, it is supported either by consent or by a genuinely applicable legitimate use.

Individual rights compared

Both laws grant access, correction and erasure, but the GDPR's catalogue of rights is broader. It includes data portability, a general right to object, and rights concerning solely automated decision-making, none of which the DPDP Act replicates in the same form.

Conversely, the DPDP Act includes a distinctive right to nominate another person to exercise one's rights in the event of death or incapacity — a feature the GDPR lacks.

So the rights regimes overlap heavily at the core but diverge at the edges, and a GDPR rights-handling capability will cover most, though not all, of the Indian requirements.

The nomination right is a small but distinctive addition worth building for, particularly in sectors where accounts and data persist for years. A GDPR-shaped rights process will need a modest extension to accommodate it.

Cross-border transfers

This is one of the sharpest differences. The GDPR restricts international transfers by default, permitting them only to 'adequate' countries or under specific safeguards such as standard contractual clauses. The DPDP Act inverts this with a negative-list model: transfers are broadly allowed except to countries the Government specifically restricts.

For multinationals, this generally makes Indian transfer compliance simpler than GDPR transfer compliance. The heavy machinery of adequacy assessments and transfer impact assessments is not required under the Indian baseline.

Sectoral rules can still impose localisation in specific areas, but the general DPDP position on transfers is notably more permissive than the GDPR's.

For global teams, the lighter transfer regime is a welcome simplification, but it should be documented rather than assumed. Keeping a clear map of your flows lets you respond quickly if the Indian Government ever restricts a particular destination.

Penalties and enforcement structure

Both regimes carry serious penalties, but they are framed differently. The GDPR caps fines as a percentage of global turnover or a fixed euro amount, whichever is higher. The DPDP Act sets fixed rupee ceilings tied to categories of failure, up to ₹250 crore.

Enforcement structures differ too. The GDPR operates through a network of national supervisory authorities coordinated across the EU, whereas the DPDP Act centralises enforcement in a single Data Protection Board of India, with appeals to a dedicated tribunal.

The single-regulator model is simpler to engage with than the GDPR's multi-authority landscape, though both ultimately subject decisions to judicial oversight.

The fixed rupee ceilings make Indian exposure easier to quantify than the GDPR's turnover-based fines, which can help in board-level risk discussions. The single-regulator model also simplifies who you deal with compared with the EU's network of authorities.

DPO and accountability

Under the GDPR, the obligation to appoint a Data Protection Officer applies to a relatively broad set of organisations based on their processing. Under the DPDP Act, the explicit DPO requirement applies specifically to Significant Data Fiduciaries.

Both regimes share the underlying accountability principle — that organisations must be able to demonstrate compliance — but the DPDP Act concentrates its heaviest governance obligations, including DPIAs and audits, on the designated significant tier.

An organisation that is a heavy hitter under the GDPR's DPO rules may or may not be an SDF under the DPDP Act, so the two designations should be assessed separately.

Assessing SDF status independently is important precisely because the triggers differ from the GDPR's DPO thresholds. An organisation that escaped a mandatory DPO under the GDPR could still be designated significant in India, and vice versa.

Practical mapping for global teams

The practical takeaway for global teams is encouraging: a mature GDPR programme transfers well to India. The bulk of the work is mapping existing controls onto Indian definitions, adjusting notice and consent language, and reviewing activities that relied on legitimate interests.

Key adjustments include adopting the negative-list view of transfers, recognising the absence of a sensitive-data category, accounting for the narrower rights set plus the nomination right, and assessing SDF status separately from GDPR DPO triggers.

Handled as a reconciliation exercise rather than a fresh build, aligning a GDPR programme with the DPDP Act is very achievable — and doing so gives you a coherent, defensible position across both regimes.