Last reviewed: 27 August 2026. Basis: DPDP Act, 2023 and DPDP Rules, 2025 (notified November 2025).
The DPDP Act is not an Indian copy of GDPR. It shares the vocabulary of notice, consent, rights and breach reporting, but it drops legitimate interests, sensitive data categories and the one-month DSAR clock, and it replaces turnover-based fines with fixed rupee caps of up to Rs 250 crore. An Indian mid-market firm with a GDPR programme for EU customers can reuse roughly a third of its artefacts as they stand, must rewrite a third, and needs to build the rest. This page sets out the 15 differences in one table, then sorts your GDPR artefacts into reuse, rewrite and build-new lists.
Is DPDP same as GDPR? Why the short answer is no
Many Indian firms serving EU customers assume that “GDPR compliant” means “DPDP covered”. In our reading that is the most expensive assumption a compliance lead can make this year.
The two laws share a lineage: a controller-style entity (controller, data fiduciary), a processor, an individual (data subject, data principal) and a regulator. Both require notice, access and correction rights, security safeguards and breach reporting.
The similarity stops at the architecture. GDPR is a broad, principle-driven regulation with six lawful bases and a large body of guidance. The DPDP Act is narrower and more prescriptive: it applies only to digital personal data, it recognises consent plus a closed list of “legitimate uses” under Section 7, and it leaves detail to the DPDP Rules, 2025 (notified November 2025) and future notifications. If you are new to the Indian framework, start with our DPDP 101 explainer.
Timing matters. Most substantive DPDP obligations become enforceable in May 2027, 18 months after the Rules were notified, with consent manager provisions at 12 months. That is the window for closing the gap.
DPDP Act vs GDPR differences: the 15-row comparison
The table below is the core of this page. Use the reuse, rewrite and build-new lists that follow to plan the work.
| # | Area | GDPR | DPDP Act, 2023 and Rules, 2025 | Programme impact |
|---|---|---|---|---|
| 1 | Scope | Personal data in any form, including structured paper records | Digital personal data only, including data digitised after collection | Inventory must flag paper-only records as GDPR-only |
| 2 | Personal data definition | Identified or identifiable natural person; pseudonymised data explicitly in scope | Data about an individual identifiable by or in relation to it; no pseudonymisation concept | Classification survives; pseudonymisation buys no lighter regime |
| 3 | Sensitive data | Special categories with Article 9 restrictions | No sensitive category; heightened duties only for children and SDFs | Article 9 workflows retire for India-only data; children’s data needs a new track |
| 4 | Lawful bases | Six bases under Article 6 | Consent under Section 6, or a Section 7 legitimate use (voluntary provision, employment, medical emergency, State functions, among others) | Activities mapped to contract or legitimate interests must be remapped |
| 5 | Legitimate interests | Available with a documented balancing test | No equivalent; Section 7 is a closed list | Marketing and analytics that relied on LIAs will generally need consent |
| 6 | Children: age and consent | Under 16 by default, member states may lower to 13 | Under 18; verifiable parental consent under Section 9; no tracking or targeted ads at children | Age gates move to 18; ad-tech needs a children’s exclusion |
| 7 | DPO requirement | Mandatory for public bodies and large-scale monitoring or special category processing | Only for SDFs under Section 10; DPO must be based in India | An EU-based DPO does not satisfy DPDP if you are an SDF |
| 8 | DPIA | Required for high-risk processing under Article 35 | Periodic DPIA only for SDFs, alongside an independent data audit | Templates reusable; trigger and cadence differ |
| 9 | Breach notification timelines and recipients | 72 hours to the authority; individuals only where high risk | Board and every affected principal “without delay”; detailed report to the Board within 72 hours; no risk threshold | Individual notification starts at once, not after a risk gate |
| 10 | Penalties structure | Up to 4% of global turnover or EUR 20 million | Fixed caps: up to Rs 250 crore (security safeguards), Rs 200 crore (breach notification, children), Rs 150 crore (SDF duties), Rs 50 crore (other) | Turnover-based risk models misstate Indian exposure |
| 11 | Cross-border mechanism and localisation | Adequacy, SCCs, BCRs, transfer impact assessments; no general localisation | Permitted under Section 16 except to countries restricted by Central Government notification; sectoral localisation (RBI and others) sits on top | SCC packs unnecessary for India-outbound transfers; sector rules still apply |
| 12 | DSAR windows | One month, extendable by two for complex requests | Set and published by the fiduciary; Rules cap it at 90 days | Longer clock possible, but only if published |
| 13 | Right to portability | Explicit right under Article 20 | None; rights are access, correction and erasure, grievance redressal and nomination under Sections 11 to 14 | Portability tooling optional; nomination handling is new |
| 14 | Processor contracts | Article 28 mandates specific clauses | Engagement “only under a valid contract”; fiduciary remains responsible regardless; Rules require contractual security measures | Article 28 DPAs need India clauses on breach timing and Board cooperation |
| 15 | Records of processing | Article 30 ROPA mandatory | No express obligation; in practice needed to evidence Section 8 duties | Keep the ROPA; add Section 6 and 7 basis and retention columns |
Row 11 is covered in our cross-border transfer guide. Two other rows deserve attention. Row 5 is where most GDPR programmes depend structurally on a mechanism DPDP does not offer. Row 9 is where an EU-tuned runbook will make you late, because DPDP requires you to tell affected individuals without delay rather than after a risk threshold is crossed. Our 72-hour breach response article walks through the Indian sequence, including how the CERT-In six-hour direction sits alongside it.
GDPR compliant company, DPDP India obligations: what changes in practice
Consider a Bengaluru SaaS company with 300 staff, EU enterprise customers and a GDPR programme built in 2019.
Lawful basis remapping
Its ROPA lists 42 activities: nineteen on “contract”, eleven on “legitimate interests”, nine on consent, three on legal obligation. Some contract entries fit “voluntary provision” under Section 7, but the marketing and analytics entries fit no Section 7 head and need consent under Section 6. That consent must be free, specific, informed, unconditional and unambiguous, with withdrawal as easy as giving it, which rules out bundled consents copied from a cookie banner. Our Section 7 lawful basis explainer shows the mapping activity by activity.
Children’s data
The company runs a student edition used by some 17-year-olds, with a GDPR age gate at 16. Under Section 9 it needs verifiable parental consent for anyone under 18 and must switch off tracking and targeted advertising for that cohort. Penalty exposure for getting this wrong is up to Rs 200 crore.
Breach response
The GDPR runbook has a gate: assess risk, notify the authority within 72 hours, notify individuals only if the risk is high. The DPDP runbook has no gate for individuals. Intimation to affected data principals and to the Board goes out without delay, and a detailed report reaches the Board within 72 hours. In parallel, listed cyber incidents go to CERT-In within six hours.
Significant Data Fiduciary exposure
If notified as an SDF, the company must appoint an India-based DPO, engage an independent data auditor and run periodic DPIAs. Its EU-based DPO does not satisfy the residency requirement. Use the SDF Classifier tool to test whether your profile is likely to fall into scope.
DPDP GDPR mapping: artefacts you can reuse as-is
These carry across with little more than updated legal references.
Data inventory and data flow maps. What you hold, where it flows and who touches it does not change with the law. Add a digital-or-paper column, since only digital personal data is in DPDP scope.
Information security policies and controls. Encryption, access control, logging and monitoring, and backups are the DPDP Rules’ reasonable security safeguards almost verbatim. Confirm log retention meets the one-year DPDP floor and the CERT-In 180-day in-India requirement.
Vendor due diligence questionnaires. Add one question: can the vendor support “without delay” breach intimation?
Training on privacy fundamentals and governance structure. Purpose limitation, minimisation and need-to-know apply equally; only legal references and penalty slides change. Steering committees and escalation paths continue unchanged. See our DPDP training options for India-specific modules.
DPDP GDPR mapping: artefacts you must rewrite
These share a purpose with their DPDP equivalent but their content would fail an Indian audit.
Privacy notices and consent flows. Section 5 requires notice of the data processed, the purpose, how to exercise rights and how to complain to the Board. GDPR notices are longer, mention legitimate interests and cite EU authorities. A Section 5 notice should be shorter, purpose-specific and issued with or before the consent request. Consent flows need withdrawal as easy as consent and purpose-specific ties; rebuild rather than patch.
Records of processing. Keep the structure; rewrite the lawful basis column to Section 6 or 7 heads, add the retention trigger (erasure when purpose is served or consent withdrawn) and flag children’s data.
Processor agreements. An Article 28 DPA is a good skeleton. Add breach intimation aligned to “without delay”, cooperation with the Board, and a statement that the fiduciary remains responsible regardless of the processor. Our vendor remediation guide lists the clauses most often missing.
Breach runbook. Rebuild around three clocks: CERT-In six hours, DPDP “without delay” intimation, and the 72-hour detailed report to the Board. Remove the risk gate for individual notification.
DSAR procedure. Publish your response period (up to 90 days), add nomination requests, drop portability for India-only data, and route grievances to a named Section 8 contact before they reach the Board. The DSAR workflow article provides a template process.
Penalty and risk register. Replace turnover-percentage exposure with the fixed Schedule caps; the Penalty Exposure Estimator gives a rupee figure for board reporting.
DPDP GDPR mapping: artefacts you must build new
These have no GDPR counterpart, or one so different that starting fresh is faster.
Verifiable parental consent mechanism. Section 9 needs a verification method, a consent record, and a technical flag that switches off tracking and targeted advertising for under-18 users.
Section 7 legitimate use register. For each activity not based on consent, which Section 7 head applies and why. This replaces the LIA library and, in our reading, is the document the Board will ask for first.
SDF readiness pack. If classification is plausible, prepare the India-based DPO appointment, data audit scope and DPIA calendar now.
Retention and inactivity erasure logic. Specified large fiduciaries (e-commerce with 2 crore or more users, online gaming 50 lakh or more, social media 2 crore or more) must erase after three years of inactivity with 48 hours prior notice. Even outside those classes, Section 8 requires erasure once the purpose is served, and most GDPR retention schedules have no automated trigger.
Board-facing grievance log. The Data Protection Board is a new regulator. Keep a log of grievances, response times and escalations that can be produced on request.
Rather than drafting from a blank page, the 16 DPDP Starter Templates include notices, a breach runbook and vendor agreements aligned to the Act and Rules.
Frequently Asked Questions
If we are GDPR compliant, are we automatically DPDP compliant?
No. GDPR compliance gives you a strong foundation in security controls, data inventories and governance, but DPDP removes legitimate interests, sets the children’s threshold at 18, changes breach notification recipients and timing, and uses fixed rupee penalties. In our experience roughly a third of GDPR artefacts can be reused as-is, a third need rewriting and a third must be built new.
Can we keep using legitimate interests for marketing and analytics in India?
Not for data in DPDP scope. Section 7 provides a closed list of legitimate uses with no balancing test, and marketing or product analytics does not fall within it. Those activities will generally need consent under Section 6, with withdrawal as easy as giving consent.
Does our EU-based DPO satisfy the DPDP Act?
Only if you are not a Significant Data Fiduciary. SDFs must appoint a DPO based in India under Section 10 and must also engage an independent data auditor and conduct periodic DPIAs. Non-SDFs are not required to appoint a DPO but must publish a contact for grievances.
How do the breach notification rules differ between GDPR and DPDP?
GDPR requires notification to the supervisory authority within 72 hours and to individuals only where there is a high risk. DPDP requires intimation to the Board and to every affected data principal without delay, followed by a detailed report to the Board within 72 hours, with no risk threshold for informing individuals. CERT-In’s six-hour reporting direction applies in parallel for listed cyber incidents.
Do we need Standard Contractual Clauses for transfers out of India?
No. Section 16 permits cross-border transfers except to countries restricted by Central Government notification, and there is no SCC or adequacy mechanism. Sector regulators such as the RBI may still impose localisation on specific data sets, so check sectoral rules before assuming a transfer is free.
Related explainers
Next step
If your GDPR programme is mature and you want a defensible DPDP position before May 2027, the fastest route is a GDPR-to-DPDP gap assessment that sorts every artefact into reuse, rewrite or build new and hands you a sequenced plan. That is what the Readiness Sprint delivers.