DPDPA vs GDPR — What Actually Changed
India did not copy the GDPR. The Digital Personal Data Protection Act, 2023 makes distinct structural, philosophical, and enforcement choices across 15 critical dimensions. This analysis maps every difference.
"GDPR compliance does not equal DPDPA compliance. Companies assuming their GDPR programme satisfies Indian law face structural gaps in consent architecture, penalty exposure, cross-border treatment, and enforcement jurisdiction."
15-Dimension Comparison
Scope of Data
Digital personal data only (Section 2(n)). Paper/manual records are excluded.
All personal data — digital, paper, automated, and manual filing systems (Art. 2).
Practitioner Insight: DPDPA has narrower scope. GDPR covers physical filing cabinets; DPDPA does not.
Lawful Bases for Processing
Binary model — Consent (Section 6) or Deemed Consent/Legitimate Uses (Section 7). No separate "legitimate interest" basis.
Six lawful bases including legitimate interest, contractual necessity, vital interest (Art. 6).
Practitioner Insight: DPDPA's binary model simplifies classification but removes the flexibility of GDPR's legitimate interest balancing test.
Consent Requirements
Free, specific, informed, unambiguous, with Section 5 notice. Must be as easy to withdraw as to give (Section 6(4)). Consent Managers registered under Rule 3-4.
Free, specific, informed, unambiguous (Art. 7). No formal "Consent Manager" concept.
Practitioner Insight: DPDPA introduces a regulated Consent Manager role — a structural innovation with no GDPR equivalent.
Children's Data
Under 18 requires verifiable parental consent. Tracking, behavioural monitoring, and targeted advertising directed at children prohibited (Section 9). Rule 12 exemptions for prescribed categories.
Under 16 (or 13 in some member states). Parental consent required. No blanket advertising prohibition (Art. 8).
Practitioner Insight: DPDPA is more protective — higher age threshold (18 vs 13-16) and explicit advertising prohibition.
Cross-Border Transfers
Permissive-with-exception model — transfers allowed except to notified restricted territories (Section 16 "negative list"). Sectoral regulators (RBI, IRDAI, SEBI) impose additional localisation.
Restrictive-with-exception — transfers prohibited unless adequacy decision, SCCs, BCRs, or derogation (Art. 44-50).
Practitioner Insight: Opposite default positions. GDPR blocks transfers unless exception applies; DPDPA allows unless territory is blacklisted.
Data Protection Officer
No mandatory DPO for all fiduciaries. Significant Data Fiduciaries must appoint a DPO in India (Section 10, Rule 11). Contact person required otherwise.
Mandatory DPO for public authorities, large-scale special category processing, and systematic monitoring (Art. 37-39).
Practitioner Insight: DPDPA's DPO mandate is narrower — applies only to SDFs, not to all organisations meeting certain criteria.
Penalty Structure
Fixed-slab penalties in Schedule — up to ₹250 crore for specified contraventions. Board-determined quantum.
Up to €20 million or 4% of global annual turnover, whichever is higher (Art. 83).
Practitioner Insight: GDPR's percentage-of-turnover model scales with company size. DPDPA's fixed slabs apply equally regardless of revenue.
Enforcement Body
Data Protection Board of India — quasi-judicial body, digital-by-design, not a regulator in the supervisory sense.
Supervisory Authorities in each member state + European Data Protection Board for cross-border cases.
Practitioner Insight: DPDPA's single national Board contrasts with GDPR's multi-authority model that creates forum-shopping concerns.
Right to Data Portability
Not included in DPDPA. Data Principals have correction and erasure rights (Section 12) but cannot demand data in portable format.
Explicit right to receive data in structured, commonly used, machine-readable format (Art. 20).
Practitioner Insight: Significant omission in DPDPA. Companies migrating from GDPR compliance should note portability infrastructure is not required.
Right to Object / Restrict
No explicit right to object to processing or restrict processing. Withdrawal of consent is the primary mechanism.
Right to object (Art. 21) and right to restriction (Art. 18) provide granular control beyond consent withdrawal.
Practitioner Insight: DPDPA's binary consent model means withdrawal is the nuclear option — no intermediate restriction possible.
Breach Notification
Mandatory notification to Data Protection Board under Section 8(6). Form and manner prescribed by Rule 7. No statutory 72-hour deadline — timeline per rules.
Notification to supervisory authority within 72 hours (Art. 33). Data subject notification if high risk (Art. 34).
Practitioner Insight: GDPR's 72-hour clock is statutory. DPDPA delegates timeline to rules, allowing more flexibility in notification procedures.
Data Protection Impact Assessment
Required only for Significant Data Fiduciaries under Rule 14. Not a universal obligation.
Required when processing is likely to result in high risk (Art. 35). Applies to all controllers meeting threshold.
Practitioner Insight: DPDPA limits DPIA to SDFs. Many high-risk processors outside SDF classification escape this requirement.
Territorial Reach
Applies to processing of digital personal data within India, and processing outside India if offering goods/services to data principals in India (Section 3).
Applies to processing by EU establishments and monitoring/offering to EU data subjects (Art. 3).
Practitioner Insight: Similar extraterritorial reach, but DPDPA's "digital personal data" qualifier narrows scope compared to GDPR.
Government Exemptions
Central Government can exempt any government instrumentality from all or any DPDPA provisions in the interest of sovereignty, security, or public order (Section 17).
National security exemptions exist but are narrower. Member states cannot blanket-exempt government bodies.
Practitioner Insight: DPDPA's Section 17 exemptions are significantly broader than any GDPR equivalent — a structural design choice reflecting India's regulatory philosophy.
Algorithmic Transparency
SDFs required to complete Algorithmic Risk Assessment and Data Protection Impact Assessment under Rules 14-15.
Right not to be subject to solely automated decision-making (Art. 22). DPIA for automated profiling.
Practitioner Insight: Both address algorithmic accountability, but through different mechanisms — DPDPA via SDF rules, GDPR via individual rights.
For Companies Operating in Both Jurisdictions
Parallel Compliance Tracks
Run GDPR and DPDPA compliance as parallel programmes with shared infrastructure but jurisdiction-specific policies, notices, and consent mechanisms.
Consent Architecture Split
GDPR allows legitimate interest processing without consent. DPDPA does not. Your consent collection for Indian data principals must be broader than for EU residents.
Cross-Border Transfer Strategy
GDPR uses SCCs and adequacy. DPDPA uses a negative list. Build transfer mechanisms that satisfy the more restrictive regime for each data flow direction.
Deepen Your Understanding
India Did Not Copy GDPR
Full structural divergence analysis
GDPR Enforcement Lessons
€4.5B+ in fines — lessons for DPDPA
DPDPA Deep Dive
Section-by-section analysis
Cross-Border Transfers
Section 16 & RBI/SEBI localisation
DPDPA Compliance Checklist
8-phase implementation guide
For Foreign Companies
12-country DPDPA guidance hub
EU Regulations Hub
GDPR, AI Act, and more
DPDPA Consulting
Counsel-led advisory services
Navigate Both Regimes with Confidence
Whether you need DPDPA compliance for your India operations or dual GDPR-DPDPA alignment, our 27 years of regulatory practice provide the depth your programme needs.
Request a Confidential Briefing
Our data privacy counsel will reach out within one working day.
What practitioners and boards are asking
What are the key differences between DPDPA and GDPR?
DPDPA 2023 and GDPR differ across 15 critical dimensions. DPDPA covers only digital personal data (not paper records), uses a binary consent model (consent or deemed consent. no standalone legitimate interest), imposes fixed slab penalties under a Schedule (not percentage of turnover), creates a single national Data Protection Board (not multiple supervisory authorities), uses a negative list model for cross border transfers (not restrictive with exception), and does not include rights to data portability or restriction of processing. India did not copy the GDPR.
Can GDPR compliance satisfy DPDPA requirements?
No. GDPR compliance does not satisfy DPDPA. Key gaps include the binary consent model (no legitimate interest as standalone basis), mandatory Data Protection Board notification procedures, children's data provisions under Section 9 with a higher age threshold of 18, and India specific cross border transfer rules under Section 16. Companies need parallel compliance tracks. AMLEGALS provides dual GDPR DPDPA alignment advisory.