Comparison · DPDP and GDPR
DPDP Act versus GDPR: the differences that matter
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
The DPDP Act borrows the GDPR’s roles and rights and changes the machinery: two grounds for processing instead of six, no special category of sensitive data, a child at eighteen instead of sixteen, penalties in fixed rupee bands instead of a share of turnover, a blacklist for transfers instead of adequacy, and no right to compensation. A GDPR programme is a head start, not a finished job.
What carries over from a GDPR programme
The data map, the processor contracts, the breach procedure, the rights process and the security controls are all reusable. Roles map cleanly: controller to Data Fiduciary, processor to Data Processor, data subject to Data Principal.
What has to change
Legitimate interests as a ground disappears; everything not on the Section 7 list needs consent. Age assurance has to move to eighteen. The notice has to be rebuilt to Rule 3’s itemised form. Breach notification to individuals is unconditional. The grievance mechanism and the Section 8(9) contact are new duties with their own tests.
Side by side
| Point | DPDP Act 2023 (India) | GDPR (EU) |
|---|---|---|
| Scope | Digital personal data in India, and offshore processing tied to offering goods or services into India (s.3) | Personal data of people in the EU, including offshore processing targeting them |
| Grounds for processing | Two: consent, or a closed list of legitimate uses (s.4, s.7). No legitimate-interest ground | Six, including contract, legal obligation and legitimate interests |
| Sensitive data | No special category; one standard for all personal data | Special categories with stricter rules |
| Child | Under eighteen; verifiable parental consent; no tracking or targeted ads (s.9) | Under sixteen, member states may lower to thirteen |
| Notice | Itemised data and purpose, withdrawal, rights and Board routes (s.5, Rule 3) | Articles 13 and 14 information list |
| Breach | All breaches; individuals and Board without delay; report within 72 hours (s.8(6), Rule 7) | Authority within 72 hours if risk; individuals if high risk |
| DPO | Only Significant Data Fiduciaries (s.10); everyone publishes a contact (s.8(9)) | Required for public bodies and large-scale processing |
| Transfers | Allowed unless the country is notified as restricted (s.16) | Allowed to adequate countries or with safeguards |
| Penalties | Fixed bands up to Rs 250 crore (Schedule) | Up to 4 percent of worldwide turnover or EUR 20 million |
| Compensation | None under the Act; penalties go to the Consolidated Fund (s.34) | Right to compensation from controller or processor |
| Regulator | Data Protection Board of India, digital office (s.18, s.28) | National supervisory authorities |
Questions people ask
- We are GDPR compliant. Are we DPDP compliant?
- Not automatically. The consent-only structure, the eighteen threshold, the itemised notice and the unconditional breach notice are the usual gaps.
- Is the DPDP Act stricter than GDPR?
- Stricter on consent and children, lighter on documentation and DPOs, different on penalties. Neither is a subset of the other.
- Does GDPR still apply to us in India?
- If you process data of people in the EU in the ways Article 3 covers, yes. Both can apply at once.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.