By Akash Sengar · · 6 min read
The short answer
India's Digital Personal Data Protection Act, 2023 and the EU's General Data Protection Regulation share principles such as purpose limitation, security safeguards and individual rights. They differ in scope, legal bases, children's data, breach reporting and penalties. An Indian company can be subject to both at once, and complying with one does not automatically satisfy the other.
Does GDPR apply to Indian companies?
It can. Under Article 3 of the GDPR, the Regulation applies to organisations outside the EU when they offer goods or services to people in the EU, or monitor their behaviour in the EU. An Indian SaaS company with EU customers, or an e-commerce site that ships to EU addresses, is likely in scope. An Indian company processing data as a service provider for an EU client is usually bound by GDPR terms through the contract, and may be directly in scope too.
Non-EU organisations in scope generally need to appoint a representative in the EU under Article 27, with limited exceptions. Our GDPR page explains this further.
Key differences side by side
| Topic | DPDP Act, 2023 | GDPR |
|---|---|---|
| Data covered | Digital personal data, and non-digital data later digitised (s.3) | All personal data processed wholly or partly by automated means, or in a filing system (Art. 2) |
| Territorial scope | Processing in India, and outside India if offering goods or services to people in India (s.3) | EU establishments, and non-EU organisations offering goods or services to, or monitoring, people in the EU (Art. 3) |
| Legal basis | Consent, or specified 'certain legitimate uses' (ss.6–7) | Six lawful bases, including contract, legal obligation and legitimate interests (Art. 6) |
| Children | Under 18; verifiable parental consent; no tracking, behavioural monitoring or targeted advertising (s.9) | Member states set 13–16 for consent to online services (Art. 8) |
| Individual rights | Information, correction and erasure, grievance redress, nominate a person (ss.11–14) | Access, rectification, erasure, restriction, portability, objection and rights on automated decisions (Arts. 15–22) |
| Breach notification | Every personal data breach to the Board and each affected person (s.8(6), Rule 7) | To the supervisory authority within 72 hours unless unlikely to cause risk; to individuals if high risk (Arts. 33–34) |
| Cross-border transfers | Allowed except to countries the government restricts by notification (s.16) | Only with adequacy, appropriate safeguards such as SCCs, or derogations (Chapter V) |
| Officer | Significant Data Fiduciaries must appoint a DPO based in India (s.10) | DPO required for public bodies and certain large-scale processing (Art. 37) |
| Penalties | Up to ₹250 crore per breach, set by the Schedule | Up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83) |
| Regulator | Data Protection Board of India | National supervisory authorities, coordinated by the EDPB |
Consent and legitimate uses vs lawful bases
This is the biggest practical difference. GDPR offers six lawful bases, and many businesses rely on "legitimate interests" for things like fraud prevention or basic analytics. The DPDP Act has no general legitimate-interests basis. You need consent, unless your purpose falls within the listed "certain legitimate uses" in section 7, such as data a person has voluntarily provided for a specified purpose, employment purposes, or legal obligations (DPDP Act).
DPDP consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and preceded by a notice. Rule 3 of the DPDP Rules sets out what that notice must contain.
Children's data
GDPR lets EU member states set the age of digital consent between 13 and 16. The DPDP Act treats everyone under 18 as a child and requires verifiable consent of a parent or lawful guardian. It also bars tracking, behavioural monitoring and targeted advertising directed at children (s.9). Ed-tech, gaming and consumer apps with younger users need the most work here.
Breach notification
GDPR has a risk threshold: you notify the authority within 72 hours unless the breach is unlikely to result in a risk, and tell individuals only when the risk is high. The DPDP Act has no such threshold: every personal data breach goes to the Board and to each affected person. Under Rule 7, the initial intimation is followed by a detailed report to the Board within 72 hours (DPDP Rules). A breach process built for GDPR alone will under-report in India.
Cross-border transfers
GDPR restricts transfers out of the EU unless a mechanism such as an adequacy decision or Standard Contractual Clauses applies. The DPDP Act takes the opposite approach: transfers are allowed except to countries the government restricts by notification, though sector rules, for example from RBI, can still require data to stay in India.
Individual rights in practice
GDPR gives people a wider set of rights, including data portability, the right to object and rights around automated decisions. The DPDP Act gives Data Principals the right to information about processing, correction and erasure, grievance redress and the right to nominate someone to act for them after death or incapacity (DPDP Act, ss.11–14). The DPDP Rules require a fiduciary to publish how people can exercise these rights and to answer grievances within a period of no more than 90 days (DPDP Rules).
The DPDP Act also places duties on Data Principals themselves, for example not to register false or frivolous grievances, which has no direct GDPR equivalent.
Significant Data Fiduciaries and DPOs
GDPR requires a Data Protection Officer for public bodies and for organisations whose core activities involve large-scale monitoring or special category data. The DPDP Act instead lets the government notify certain fiduciaries as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of data and the risk to people. These must appoint a DPO based in India who answers to the board, appoint an independent data auditor and carry out periodic Data Protection Impact Assessments and audits (s.10). Most SMEs will not be Significant Data Fiduciaries, but should still name a person responsible for privacy questions.
Penalties and enforcement
GDPR fines are set by national supervisory authorities, up to €20 million or 4% of worldwide annual turnover for the most serious breaches (Art. 83). Under the DPDP Act, the Data Protection Board can impose penalties set out in the Schedule, the highest being up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach (Schedule). The DPDP Act does not provide for compensation to individuals in the way GDPR Article 82 does.
If you are subject to both
- Map your personal data once, recording for each activity which law applies.
- Write notices that meet both: the GDPR transparency items and the DPDP Rule 3 items.
- Review every activity relying on legitimate interests: under DPDP it may need consent.
- Use one breach process with the stricter rules: notify the Board and individuals for Indian data, and run the GDPR risk assessment for EU data.
- Handle rights requests through one workflow, with the wider GDPR set available to EU residents.
The DPDP page covers the Indian timeline, and our DPDP Rules timeline lists what to do before May 2027. This guide is general information, not legal advice; confirm your position with counsel.
This guide is general guidance, not legal advice.
