GDPR vs DPDP Act vs CCPA: The Complete Comparison Guide for Multinational Compliance

Comparing GDPR vs DPDP Act vs CCPA is now unavoidable for any organization with users in Europe, India and the United States. Each framework has its own philosophy, enforcement mechanisms, and compliance requirements — and organizations operating globally face a complex puzzle: GDPR in Europe, DPDPA in India, CCPA in California.

This guide is written for privacy officers, legal teams, and compliance leaders at multinational organizations who need to understand how these three regimes differ and where they overlap. If India’s law is new to you, our primer on what the DPDP Act covers, its rules and penalties is a useful starting point.

You’ll get a 20+ parameter comparison matrix, a functional-area breakdown (consent, breach notification, individual rights, data transfers, enforcement), a gap analysis for multinationals, three harmonization strategies, and comparative case studies. Key Reality: There is no single “global standard” for data protection. Organizations must comply with each jurisdiction’s specific requirements. However, understanding the philosophies behind each framework helps identify harmonization opportunities.

GDPR vs DPDP Act vs CCPA: Comprehensive Comparison Matrix (20+ Parameters)

DPDP Act vs GDPR vs CCPA: Detailed Comparison by Functional Area

1. How Do Consent and Legal Basis Differ Under GDPR, DPDP Act and CCPA?

GDPR Approach: Six legal bases for processing (consent, contract, legal obligation, vital interests, public task, legitimate interests). Organizations can rely on legitimate interests without explicit consent if they balance interests appropriately.

DPDPA Approach: Stricter consent focus. Consent required unless processing falls under narrow exemptions (legal obligation, emergency, vital interests). No “legitimate interests” legal basis equivalent.

CCPA Approach: Assumes opt-out is acceptable for non-sensitive data. Opt-in required only for targeted advertising and sale of data. Sensitive data requires stricter opt-in.

Practical Implication: Under GDPR + DPDPA, your legitimate interest-based marketing is non-compliant with DPDPA unless you have explicit Indian consent. Under CCPA, California residents can opt-out of targeted ads while maintaining your service.

Example: A multinational e-commerce platform wants to retarget non-converting visitors with advertisements.

• GDPR: Can process using legitimate interest basis (business necessity) if documented impact assessment shows interests are balanced
• DPDPA: Must obtain prior explicit consent from Indian users; no legitimate interest exception available
• CCPA: California users can opt-out; if they haven’t opted out, retargeting is permitted

Compliance Strategy: Obtain explicit consent for Indian users; use legitimate interest for EU (with documented assessment); offer California opt-out mechanism.

2. Data Breach Notification: 72-Hour Rules Compared

Timeline Comparison:

• GDPR: Without undue delay; 72 hours to data protection authority; public notification if high risk
• DPDPA: 72 hours to Data Protection Board (same timeline but to regulator, not public by default)
• CCPA: Without unreasonable delay; 45-day average; California Attorney General notified only if >500 Californians affected; public notification always required

Compliance Strategy: Synchronize breach detection and notification procedures. The 72-hour DPDPA deadline is the most stringent, so design your process to meet that requirement.

3. Rights to Access and Deletion: Timelines and Exceptions

Access Right Timeline:

• GDPR: 30 days (extendable to 90 days for complex requests)
• DPDPA: No specific timeline stated (but fiduciary principle suggests reasonable timeframe; practice is 15-30 days)
• CCPA: 45 days

Deletion Right Comparison:

• GDPR: Right to erasure with broad exceptions (legal obligation, public interest, exercise of rights, etc.)
• DPDPA: Right to deletion; removal from primary systems within 30 days; some exceptions allowed
• CCPA: Right to deletion with exceptions for legal obligations, fraud prevention, other specific purposes

Critical Difference: DPDPA requires deletion from “primary systems” within 30 days (not backups), while GDPR’s right is more absolute.

4. International Data Transfers: Where GDPR and the DPDP Act Diverge Most

GDPR Framework: Extensive regulations (adequacy decisions, standard contractual clauses, binding corporate rules, derogations)

DPDPA Framework: Personal data cannot be transferred outside India. Sensitive personal data cannot be transferred without explicit consent and Data Protection Board approval. Critical personal data cannot be transferred outside India even with consent. For a deeper dive into these rules, see our guide to cross-border data transfer under the DPDP Act.

CCPA Framework: No specific transfer restriction; California law applies globally to California residents’ data

Practical Impact for Multinational Organizations: If you process Indians’ personal data, you cannot rely on a global consent to justify transfers. You must keep India-based backups, disaster recovery, and processing.

Critical Compliance Error: Many organizations implement a global compliance program based on GDPR standards but then transfer all data to a centralized global datacenter. This violates DPDPA. You must maintain separate India-based infrastructure for Indian data principals.

5. Enforcement and Penalties: Fines, Boards and Private Lawsuits

GDPR: Two-tiered fines. National regulators have significant discretion. Class actions possible in some EU member states.

DPDPA: Fixed penalty levels (Rs. 2 crore general, Rs. 5 crore for sensitive data). Data Protection Board determines violations. Supreme Court review available.

CCPA: Attorney General enforcement + private right of action (unique feature). Statutory damages of $100-$750 per consumer per incident for data breaches create high exposure.

Key Difference: CCPA is the only framework enabling direct consumer lawsuits. This creates potential for massive class actions. For example, a data breach affecting 1 million California consumers could result in $100-750 million statutory liability.

Gap Analysis for Multinational Privacy Compliance

Harmonization Strategies: Building a Single Global Privacy Framework

Strategy 1: Adopt the Most Restrictive Standard

Approach: Implement controls meeting the strictest requirements across all jurisdictions and apply globally.

Application:

• Use DPDPA’s consent-first model for all data subjects globally (most restrictive)
• Adopt DPDPA’s 30-day deletion timeline for all deletions
• Implement GDPR’s impact assessment requirements globally
• Use CCPA’s private right of action sensitivity to strengthen audit procedures

Pros: Simplest to implement; ensures compliance with all frameworks; reduces operational confusion

Cons: More expensive; may be more restrictive than necessary in some jurisdictions; reduces operational efficiency

Strategy 2: Geo-Specific Compliance Modules

Approach: Maintain separate compliance procedures for GDPR, DPDPA, and CCPA regions, synchronized through a unified data governance framework.

Application:

• GDPR Region: Implement legitimate interest basis where appropriate; use GDPR’s consent model
• India Region: Strict consent requirement; separate data residency; DPDPA DPA requirements
• California Region: Opt-out mechanisms for non-sensitive; opt-in for sensitive; prepare for private litigation

Pros: Operational efficiency; compliance tailored to each jurisdiction’s actual requirements

Cons: Complex implementation; requires sophisticated data governance infrastructure; higher risk of misconfiguration

Strategy 3: Unified Privacy Platform with Configurable Rules Engine

Approach: Implement a centralized privacy platform capable of applying different rules based on data subject location.

Technical Implementation:

• Geo-location detection of data subjects
• Rules engine applying jurisdiction-specific consent requirements
• Configurable data residency enforcement (separate data stores for India — essential given the DPDP Act’s restrictions on transferring personal data outside India)
• Jurisdiction-specific deletion procedures (DPDPA 30-day rule vs. GDPR flexible deletion)
• Audit logs tracking which rules applied to which data subjects

Pros: Scalable; provides compliance assurance at scale; audit trails justify decisions

Cons: High implementation cost (Rs. 2+ crore); requires specialized expertise; ongoing maintenance

Research References and Standards Bodies

Key References for Further Research:

• GDPR: EDPB Guidelines 05/2020 on consent (latest guidance on consent standards)
• DPDPA: Data Protection Rules, 2025 (official government regulations)
• CCPA: CPRA (California Privacy Rights Act, 2020) — effective January 2023, amended CCPA significantly
• Comparative Analysis: IAPP (International Association of Privacy Professionals) maintains comparative matrices
• DLA Piper: Annual global privacy law comparison charts
• Gartner: Privacy compliance technology research and vendor comparisons

Philosophy: Three Diverging Visions of Privacy Protection

GDPR’s Philosophy: Privacy as a Fundamental Human Right

GDPR treats privacy as inherent to human dignity. It’s not just about protecting data but about maintaining individual autonomy and freedom in the digital age. This foundational approach allows for some flexibility (legitimate interests) but with strong procedural safeguards (impact assessments, proportionality).

DPDPA’s Philosophy: Privacy Through Fiduciary Relationships

Rather than focusing purely on “rights,” the DPDP Act frames data protection as a relationship of trust. The Data Fiduciary is held to fiduciary standards — the same standards applied to trustees, guardians, and other relationships involving vulnerability. This approach demands transparency, loyalty, and accountability similar to legal fiduciary duties.

CCPA’s Philosophy: Privacy as a Consumer Choice

CCPA views privacy primarily as a market mechanism. Consumers should have choices about their data; businesses should disclose practices. The private right of action reflects the philosophy that consumers are the enforcement mechanism — they can sue for violations. This market-based approach assumes competition and consumer empowerment will drive better privacy practices.

Implications for Organizations:

• Under GDPR: Design for human dignity. Build trust through procedural transparency.
• Under DPDPA: Adopt fiduciary mindset. Data principals are in your care; act accordingly.
• Under CCPA: Expect litigation. Robust audit trails and compliance documentation are your defense.

Comparative Case Studies: GDPR vs DPDPA vs CCPA in Practice

Case Study 1: Social Media Platform Data Retention

Scenario: User deletes account. Platform wants to retain data for 1 year for account recovery.

GDPR Compliance: With documented legitimate interest in account recovery and proper impact assessment, can retain for reasonable period (typically 30-90 days is standard)

DPDPA Compliance: User has right to deletion within 30 days. Cannot retain beyond that period unless legally mandated.

CCPA Compliance: Must delete within 45 days with specific exceptions (legal compliance, fraud prevention)

Compliance Outcome: Delete within 30 days globally (DPDPA is most restrictive). Cannot use 1-year retention policy.

Case Study 2: Biometric Data Collection for Fraud Prevention

Scenario: Financial service provider wants facial recognition for login security.

GDPR Compliance: Requires explicit consent (biometric data is “special category”); impact assessment; proportionality assessment

DPDPA Compliance: Facial recognition data is critical personal data. Requires prior explicit consent. DPDPA Section 8(5) provides some exemptions for fraud prevention, but only if narrowly tailored.

CCPA Compliance: Biometric data is sensitive personal information; requires opt-in consent (more lenient than GDPR/DPDPA as exemption exists for fraud prevention)

Compliance Outcome: Obtain prior explicit opt-in consent. Cannot use legitimate interest or fraud prevention exemption alone under DPDPA. Implement strict retention limits (delete after 90 days of inactivity).

Frequently Asked Questions

What is the difference between GDPR and the DPDP Act?

GDPR treats privacy as a fundamental human right with six legal bases for processing (including legitimate interests), while India’s DPDP Act frames data protection as a fiduciary relationship and is consent-first, with no legitimate-interest equivalent. The DPDP Act also restricts transferring personal data outside India and requires deletion from primary systems within 30 days, whereas GDPR permits transfers via adequacy decisions and contractual safeguards.

What are the maximum penalties under GDPR, the DPDP Act and CCPA?

GDPR fines reach 10 million euros or 2% of global revenue for less serious violations, and 20 million euros or 4% for serious ones. The DPDPA sets fixed penalty levels of Rs. 2 crore for general violations and Rs. 5 crore for sensitive/critical data breaches. CCPA imposes $2,500 per violation ($7,500 if intentional) plus statutory damages of $100-$750 per consumer per incident through private lawsuits.

What is the data breach notification timeline under each law?

Both GDPR and the DPDP Act require notification within 72 hours — GDPR to the data protection authority, the DPDPA to the Data Protection Board of India. CCPA requires notification without unreasonable delay (45-day average), notifying the California Attorney General only when more than 500 Californians are affected, but public disclosure is always required.

Can personal data be transferred outside India under the DPDP Act?

Under the DPDPA, personal data cannot be transferred outside India, and sensitive personal data can only be transferred with explicit consent plus Data Protection Board approval; critical personal data cannot leave India even with consent. Multinationals must therefore maintain separate India-based infrastructure, backups and disaster recovery for Indian data principals.

Which is stricter: GDPR, DPDP Act or CCPA?

The DPDP Act is the most restrictive on consent (consent-first with no legitimate-interest basis), deletion (30 days from primary systems) and data residency (India-only). GDPR is strictest on procedural safeguards like DPIAs, while CCPA is unique in exposing businesses to direct consumer lawsuits. Many multinationals therefore adopt the most restrictive standard globally.

What is the parental consent age under GDPR, DPDPA and CCPA?

The DPDP Act sets the highest threshold at 18 years. GDPR sets it at 16 years, though member states can lower it to 13, and CCPA sets it at 13 years with parental authorization.

Key Takeaways

• There is no single global privacy standard — GDPR, the DPDP Act and CCPA embody different philosophies: fundamental rights, fiduciary duty, and consumer choice respectively.
• The DPDP Act is consent-first with no legitimate-interest basis, requires 30-day deletion from primary systems, and restricts personal data transfers outside India.
• The 72-hour breach notification window shared by GDPR and the DPDPA is the most stringent — design your global incident process around it.
• CCPA’s private right of action ($100-$750 statutory damages per consumer per incident) creates unique class-action exposure absent from the other two regimes.
• Multinationals can harmonize via the most-restrictive-standard approach, geo-specific compliance modules, or a unified privacy platform with a configurable rules engine.
• Centralizing all data in a global datacenter under a GDPR-modeled program violates the DPDPA — separate India-based infrastructure is required.

Conclusion: No Single Global Standard

Organizations must accept that there is no unified “global privacy standard.” GDPR, DPDPA, and CCPA reflect different cultural values, legal traditions, and enforcement philosophies. The most pragmatic approach is to build a privacy infrastructure that meets the strictest requirements across all jurisdictions and apply those standards globally. This not only ensures compliance but also strengthens trust with your data subjects worldwide.