What is the main difference between the DPDP Act and the GDPR?

The DPDP Act is narrower in its grounds and simpler in structure. It allows processing on two footings, consent or one of nine legitimate uses listed in Sec. 7, where the GDPR offers six lawful bases. It also has no special tier for sensitive data and no right to data portability.

Does the DPDP Act have legitimate interest as a lawful basis?

No. Sec. 4 allows processing only for a lawful purpose with the Data Principal's consent or for certain legitimate uses, and Sec. 7 lists those uses in a closed set. A general legitimate-interest balancing test, as in the GDPR, is not among them.

Is a GDPR-compliant company automatically DPDP-compliant?

No. Much of the groundwork carries over, including notices, records and breach processes, but the grounds, the consent rules and the rights differ. Items such as the closed set of legitimate uses in Sec. 7 and the Consent Manager mean a GDPR programme needs a gap check against the Indian Act.

Does the DPDP Act require a Data Protection Officer?

Only for a Significant Data Fiduciary. Sec. 10(2)(a) requires a Significant Data Fiduciary to appoint a Data Protection Officer based in India, responsible to its board. Other Data Fiduciaries must publish contact details of a Data Protection Officer if applicable, or of a person who can answer questions, under Sec. 8(9).

How do breach notification timelines compare?

Both run from the point of becoming aware, but the 72 hours means different things. Under the GDPR it is the first notice to the supervisory authority, and it is only required where the breach is likely to result in a risk. Under Rule 7(2)(b) it is the detailed report to the Board, which follows a description given without delay under Rule 7(2)(a), with no risk test. The Data Fiduciary must also intimate each affected Data Principal under Rule 7(1).

Compare

The GDPR is a good guide and a poor template

Last updated

12 October 2026

Where the DPDP Act, 2023 and the GDPR differ: two lawful grounds against six, no sensitive category, cross-border rules, breach clocks and penalties.

If your company already complies with the GDPR, you hold more of the DPDP Act than you think, and the differences are concentrated in a few places. The Act has fewer grounds for processing, no special category of sensitive data, no portability right, a different consent standard, and a penalty table of fixed ceilings rather than a percentage of turnover.

Treat what follows as a comparison from the Indian side. The DPDP citations are checked against the Act and Rules. The GDPR points are stated at the level of its well-known structure and you should verify article-level detail against the Regulation.

Lawful grounds: two against six

Sec. 4 allows a person to process personal data only in accordance with the Act and for a lawful purpose for which the Data Principal has given consent, or for certain legitimate uses. The legitimate uses are listed in Sec. 7, and the list is closed: voluntary provision for a specified purpose, certain State functions and benefits, legal obligations and court orders, medical emergencies, epidemics, disasters, and employment.

The GDPR's Article 6 offers six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The Indian Act has no contract basis and no general legitimate interests basis. A business that relied on legitimate interests for analytics or marketing in Europe will generally have to look to consent in India, unless a Sec. 7 use fits. Sec. 7(a) is the nearest thing to a contract basis, covering data voluntarily provided for a specified purpose where the person has not indicated she does not consent. The Act explainer sets out the nine uses.

Sec. 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose. The GDPR's definition is close. Two points have GDPR parallels: Sec. 6(4) requires withdrawal to be as easy as giving consent (GDPR Art. 7(3)), and the Data Fiduciary must prove consent (GDPR Art. 7(1)), with Sec. 6(10) extending that proof to notice. What has no GDPR counterpart is the Consent Manager in Sec. 6(7) to 6(9), a registered intermediary through which a Data Principal can give, manage, review or withdraw consent (see what a consent manager is).

No sensitive category, and a narrower rights list

The DPDP Act has no tier of sensitive personal data. The same duties apply to a name and to health records, and the Act relies on the factors in Sec. 10(1) and Sec. 33(2) to weigh risk instead. The GDPR, by contrast, treats special categories under Article 9 with stricter conditions.

The rights differ too. Chapter III of the Act gives access under Sec. 11, correction, completion, updating and erasure under Sec. 12, grievance redressal under Sec. 13 and nomination under Sec. 14. There is no right to data portability, which the GDPR gives in Article 20, and the Act does not create a general right to object or to restrict processing. Nomination, a right to name someone to act on death or incapacity, has no GDPR counterpart.

Governance: no DPO by default

The GDPR requires a DPO in defined circumstances. The DPDP Act requires one only of a Significant Data Fiduciary, notified by the Central Government under Sec. 10(1). Sec. 10(2) adds an independent data auditor and periodic Data Protection Impact Assessments for those entities, and Rule 13 sets the annual cycle. Everyone else must publish business contact information under Sec. 8(9) and Rule 9.

Breach notification: both 72 hours, built differently

Sec. 8(6) requires intimation to the Board and each affected Data Principal with no stated threshold for materiality. Rule 7(2) requires the Board to be told without delay and then given the detailed report within 72 hours of becoming aware, or a longer period the Board allows on written request. The GDPR sets 72 hours for notifying the supervisory authority and tells individuals only where the risk to them is high. The practical effect is that more incidents will need an intimation in India. See data breach notification under the DPDP Act.

Cross-border transfers: negative list, not adequacy

The GDPR restricts transfers outside the EEA unless there is an adequacy decision or an approved safeguard. The DPDP Act inverts the default. Sec. 16(1) lets the Central Government restrict transfers to countries or territories it notifies, and until it does, transfers are permitted. Sec. 16(2) preserves any Indian law that gives a higher degree of protection, and Rule 15 conditions transfers on requirements the Government specifies regarding foreign States and entities under their control. Significant Data Fiduciaries face a further localisation condition in Rule 13. More on cross-border transfer.

Penalties: ceilings, not a percentage

The Schedule to the Act sets maximums: up to 250 crore rupees for failing to take reasonable security safeguards under Sec. 8(5), 200 crore rupees each for failing to notify a breach and for breaching children's obligations, 150 crore for Significant Data Fiduciary obligations, and 50 crore for any other breach. The GDPR sets its upper tier as the higher of a fixed sum and a percentage of worldwide annual turnover. The Board decides the amount after an inquiry under Sec. 33, weighing the factors in Sec. 33(2).

Notices, a record of processing, vendor contracts, security controls and an incident process all transfer. The rebuild is in consent granularity, the withdrawal path, the retention and erasure rule in Sec. 8(7), and the shorter list of grounds. The provision map shows each in turn.

Questions people ask

What is the main difference between the DPDP Act and the GDPR?: The DPDP Act is narrower in its grounds and simpler in structure. It allows processing on two footings, consent or one of nine legitimate uses listed in Sec. 7, where the GDPR offers six lawful bases. It also has no special tier for sensitive data and no right to data portability.
Does the DPDP Act have legitimate interest as a lawful basis?: No. Sec. 4 allows processing only for a lawful purpose with the Data Principal's consent or for certain legitimate uses, and Sec. 7 lists those uses in a closed set. A general legitimate-interest balancing test, as in the GDPR, is not among them.
Is a GDPR-compliant company automatically DPDP-compliant?: No. Much of the groundwork carries over, including notices, records and breach processes, but the grounds, the consent rules and the rights differ. Items such as the closed set of legitimate uses in Sec. 7 and the Consent Manager mean a GDPR programme needs a gap check against the Indian Act.
Does the DPDP Act require a Data Protection Officer?: Only for a Significant Data Fiduciary. Sec. 10(2)(a) requires a Significant Data Fiduciary to appoint a Data Protection Officer based in India, responsible to its board. Other Data Fiduciaries must publish contact details of a Data Protection Officer if applicable, or of a person who can answer questions, under Sec. 8(9).
How do breach notification timelines compare?: Both run from the point of becoming aware, but the 72 hours means different things. Under the GDPR it is the first notice to the supervisory authority, and it is only required where the breach is likely to result in a risk. Under Rule 7(2)(b) it is the detailed report to the Board, which follows a description given without delay under Rule 7(2)(a), with no risk test. The Data Fiduciary must also intimate each affected Data Principal under Rule 7(1).

See what the DPDP Act asks, provision by provision