The most comprehensive side-by-side comparison of India's DPDP Act 2023 and the EU GDPR across every major dimension of data protection law.
Dimension
🇪🇺GDPR 2018European Union / EEA
Territorial Scope
Who must comply
Narrower
Applies to processing of personal data of individuals in India. Limited extraterritorial reach — primarily covers entities in India and those offering goods/services to individuals in India.
Broader
Applies wherever EU/EEA residents' data is processed — regardless of where the processor is located. Strong extraterritorial reach under Article 3 covers any organisation serving EU users.
Legal Bases
Grounds to process data
Simplified (2 bases)
Only two grounds: (1) Consent — explicit, informed, purpose-specific; (2) Legitimate Use — 8 specific situations in §7 (legal obligations, emergencies, employment, public interest). No general balancing test.
Six Bases
Article 6 provides: consent, contract, legal obligation, vital interests, public task, and legitimate interests. The broad "legitimate interests" basis is heavily used in practice — absent in DPDP.
Consent Standard
What counts as valid consent
Very Similar
Free, specific, informed, and unambiguous. Must be as easy to withdraw as to give. No bundled consent. Cannot be conditional to service access. §6 standard closely mirrors GDPR.
Very Similar
Freely given, specific, informed, and unambiguous (Article 7). Right to withdraw at any time. Cannot be bundled. Pre-ticked boxes invalid. Very similar to DPDP — both require active opt-in.
Sensitive Data Categories
Higher-protection data types
No Formal List
DPDP has no explicit "sensitive data" article. Health, financial, biometric, and children's data attract higher scrutiny in practice. Central Government can notify sensitive categories via Rules.
Explicit Article 9 List
Racial/ethnic origin, political opinions, religion, genetic data, biometric data, health, sex life/orientation — all require explicit consent or a specific Article 9(2) exception. Much stricter than DPDP.
Children's Protection
Age threshold & rules
Stricter — Under 18
Verifiable parental consent required for anyone under 18. Targeted advertising and behavioural tracking banned outright for all under-18 users. Higher age threshold than GDPR.
Lower Threshold
Article 8 sets age at 16 for online services (member states can lower to 13). No absolute ban on tracking 16–17 year olds who can consent. Fewer absolute prohibitions than DPDP.
Individual Rights
Rights over own data
7 Rights
Access, correction, erasure, portability, consent withdrawal, nomination (unique to India), and grievance redressal. No right to object to processing or to restrict processing.
8 Rights
Access, rectification, erasure, portability, restriction of processing, objection, automated decision rights, and right to lodge supervisory authority complaints. More comprehensive than DPDP.
Right to Object / Restrict
Pause without erasure
Not Included
DPDP has no right to object or restrict. Only consent withdrawal stops consent-based processing — but cannot halt Legitimate Use processing even if the individual objects.
Explicit Rights
Articles 18 and 21 give individuals the right to restrict processing and to object — especially for direct marketing (absolute right) and legitimate-interests processing. No equivalent in DPDP.
Data Breach Notification
To whom & when
Notify All Principals
72 hours to DPB + notification to ALL affected data principals. No risk-threshold exception — every breach affecting individuals must be communicated, regardless of severity.
Risk-Threshold Rule
72 hours to supervisory authority (Article 33); notification to individuals only when breach is likely to result in high risk to their rights (Article 34). Low-risk breaches can be kept internal.
DPIA Requirement
When assessments are needed
SDF + High-Risk
Mandatory for Significant Data Fiduciaries across all significant processing. High-risk DPIA guidance to be issued in Rules. Less prescriptive format than GDPR.
More Prescriptive
Article 35 mandates DPIA for high-risk processing with specific content requirements. Prior consultation with supervisory authority for very high-risk cases. Published lists per DPA.
Data Protection Officer
DPO appointment trigger
SDF Only
DPO required only for Significant Data Fiduciaries — must be resident in India and report to the Board. All others only need to publish a Grievance Officer contact.
Broader Trigger
Article 37 requires DPO for public authorities, large-scale special-category data processors, and entities doing large-scale systematic monitoring. Broader trigger than DPDP SDF threshold.
Cross-Border Transfers
Sending data abroad
Allowlist Model
Central Government publishes approved countries. Transfers to non-allowlisted countries need additional safeguards. Simpler mechanism — no SCC equivalent yet defined.
Rich Transfer Toolkit
Adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, specific derogations. Comprehensive, well-established framework. India has not received EU adequacy status.
Accountability / ROPA
Documentation obligations
Less Prescriptive
ROPA required but format TBD in Rules. Consent audit log is primary accountability evidence. Less paperwork burden than GDPR — but still comprehensive documentation expected.
More Detailed
Article 30 specifies exact ROPA fields. Privacy notices, LIA records, DPIA logs, transfer impact assessments — extensive documentation ecosystem well-established since 2018.
Enforcement Authority
Regulatory structure
Single National DPB
One Data Protection Board for all of India. Board not fully constituted as of 2025. Appeal: TDSAT → High Court. No state-level regulators.
27 DPAs + EDPB
Each EU member state has its own DPA. EDPB coordinates cross-border enforcement. Lead supervisory authority concept. Mature, active enforcement since 2018.
Maximum Penalties
Highest possible fine
Fixed Cap
₹250 crore (≈ €28 million) for security failures. Fixed cap — not percentage of revenue. Significant in Indian market but lower than GDPR's absolute maximum for large multinationals.
Revenue-Based
Up to €20 million OR 4% of global annual revenue — whichever is higher. For large multinationals this vastly exceeds ₹250 crore. Meta fined €1.2 billion in a single GDPR case.
Data Localisation
Must data stay in-country?
Restricted Transfers
No absolute localisation in DPDP — but transfers restricted to allowlisted countries. RBI payment data localisation runs separately. Mirror data allowed abroad.
Transfer Mechanisms
No absolute localisation — data can flow outside EU with appropriate safeguards. Similar philosophy: transfers restricted but not prohibited. Both use conditional transfer frameworks.
