AMLEGALS — India's DPDPA Practice — Legal 500 Asia Pacific
India Did Not
Copy GDPR.
It built something older. Something deeper.
Something 1.4 billion people's constitutional rights demanded.
The Digital Personal Data Protection Act, 2023 is not GDPR with an Indian accent.
It is a sovereign legal architecture built on the premise that personal data is a fundamental right — rooted in Justice K.S. Puttaswamy vs Union of India, 2017. A nine-judge constitutional bench. Not a Brussels directive.
GDPR flows from a Charter. DPDPA flows from a Constitution. That distinction changes every compliance decision you will make for your India operations.
If you are entering India with EU-trained compliance instincts alone, you are carrying the wrong map.
Extraterritorial Scope — Section 3If your company collects, stores, or processes personal data of Indian residents — from anywhere in the world — DPDPA applies to you. No minimum threshold. No grace period in the enacted text. The Act does not ask where your servers are. It asks whose data you hold.
Data Principals. Every Indian resident. Protected by law from day one.
Maximum penalty per instance of breach. Schedule-based. Not turnover-linked yet.
Data breach notification window to the Data Protection Board. Same as GDPR.
Year India’s Supreme Court declared privacy a fundamental right. By Constitution. Not legislation.
Supreme Court judges in the Puttaswamy bench. Unanimous on the right to privacy.
Architecture Analysis
Same Mission.
Different Philosophy.
Eight structural differences every EU counsel must understand before advising on India data operations.
This is not a table that declares a winner. Both frameworks protect the same right — the individual's control over personal data. The difference is constitutional philosophy, enforcement architecture, and the specific obligations each imposes. EU companies need both maps. Not one translated into the other.
The Constitutional Foundation
On 24 August 2017,
Nine Judges Changed Everything.
The Supreme Court of India declared privacy a fundamental right.
Not through legislation. Through the Constitution. Article 21. The right to life and personal liberty. Nine judges. Unanimous.
Justice D.Y. Chandrachud wrote that personal data is an extension of the self. That sentence is the philosophical foundation of every obligation in the DPDPA. It is why consent withdrawal under DPDPA is absolute, not subject to a balancing test. You cannot balance a controller’s legitimate interest against a person’s constitutional right.
EU companies that treat DPDPA as a lighter version of GDPR have not read that judgment. India’s data law has deeper constitutional roots than most countries’ privacy laws.
GDPR’s Article 8 protects personal data as a fundamental right under the EU Charter. But the EU Charter is not a constitution in the same sense. It binds EU institutions. The Indian Constitution binds the Indian state and — through the Puttaswamy logic — shapes the obligations of every entity that processes the personal data of Indian citizens.
That is a different kind of gravity. And it produces a different kind of compliance obligation.
“Privacy is not just a right to be left alone. It is the right to determine the narrative of your own life — to control the information that defines you in the eyes of the world.”
Supreme Court of India · 24 August 2017
Nine-Judge Constitutional Bench
The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 of the Constitution of India. All nine judges. No dissent.
The Market You Are Entering
The Scale EU Companies
Are Walking Into.
India's digital economy is not an emerging market with fragile data infrastructure. It is the world's largest biometric identity system, the highest-volume real-time payments network, and the fastest-growing internet population — all governed by one law. DPDPA.
Second largest internet population in the world. Overtaking the entire EU internet user base by a factor of two. Every one a data principal under DPDPA.
131 billion Unified Payments Interface transactions in one fiscal year. Every transaction carries personal and financial data. All within DPDPA scope.
World’s largest biometric identity system. Iris scans, fingerprints, demographic data. Sensitive personal data under DPDPA. EU companies processing Aadhaar-linked data have heightened obligations.
Government-issued digital identity repository. Education certificates, driving licences, Aadhaar. All DPDPA-governed. All accessible via API integrations EU companies may be using.
India’s stated target for its digital economy. DPDPA is the regulatory infrastructure for that economy. Compliance is not a cost of operating in India. It is the price of admission to the opportunity.
No revenue floor. No data volume floor. No user count floor. If you process personal data of Indian residents in digital form, DPDPA applies. Size is not a defence.
Extraterritorial Scope — Section 3, DPDPA 2023
The Act applies to processing of digital personal data within India. It also applies to processing of digital personal data outside India if such processing is in connection with any activity related to offering of goods or services to data principals within India.
This mirrors GDPR Article 3(2). If your website serves Indian users, your app has Indian downloads, or your service has Indian customers — DPDPA reaches you regardless of where your servers sit.
There is no grace period in the enacted text. There is no small-company exemption. The Rules, when notified, may create tiered obligations. But the Act itself does not.
EU Counsel Risk Brief
Five Assumptions
That Will Cost You.
Every EU company entering India carries assumptions built from years of GDPR practice. Most of those assumptions are partially right. Some are dangerously wrong. These are the five that produce liability.
India's Data Law
Has a Philosophy
Europe Does Not.
The Digital Atman Theory of Data Privacy proposes that personal data is not merely information. It is the digital extension of the self — the Atman, the soul, as understood in Indian philosophical tradition.
GDPR treats personal data as property with rights attached. Rights to access, to erase, to port, to object. The frame is ownership. The remedy is control.
DPDPA treats personal data as identity with dignity owed. The frame is not ownership. It is selfhood. And that difference is not semantic. It is architectural.
Property can be transferred, licensed, traded, assigned. Dignity cannot. It must be protected regardless of consent, regardless of transaction, regardless of business interest.
This is why DPDPA’s consent withdrawal mechanism is stronger than GDPR’s. When you withdraw consent under DPDPA, you reclaim your digital self. Not just your data. The controller has no residual interest to balance against. The withdrawal is absolute.
EU companies entering India with a property rights compliance model are building the wrong structure on the wrong philosophical foundation. The structure may look right. The filing cabinets may say the right things. But the foundation is cracked.
The Digital Atman Theory™ — Core Proposition
“Personal data is not what you produce. It is what you are — in digital form. A law that protects data protects the person. A law that fails data fails the person. DPDPA was written by a country that knows this in its constitutional DNA.”
The Practice
The Only Practice Built for India's Data Law Before India's Data Law Was Built.
AMLEGALS began building its DPDPA competency before the Act was enacted. Not because we saw a market. Because Puttaswamy 2017 made this law a constitutional inevitability.
- ✦Legal 500 Asia Pacific — Ranked multi speciality Indian law firm
- ✦27 Years of Indian regulatory, litigation, and advisory practice
- ✦10 Offices: Mumbai · Delhi · Bangalore · Ahmedabad · Kolkata · Hyderabad · Pune · Chennai · Jaipur · Dubai
- ✦FDPPI Ahmedabad Chapter President — Anandaday Misshra
- ✦IAPP Chair, New Delhi — Deepti Bhatia
- ✦Coined: Digital Atman Theory™ · Privacy Dividend™ · Consent Capital™ · Vibe Data Privacy™
- ✦Practice Areas: DPDPA · AI Governance · GST · Arbitration · Contract Law · Labour Law
We map what transfers from your existing compliance architecture, what does not, and what India requires that Brussels never imagined. Delivered as a structured gap report with remediation priorities and timelines.
SCCs for the EU to India leg. DPDPA whitelist compliance for the India outbound leg. One coherent cross border data flow structure covering both regulatory frameworks simultaneously.
Not GDPR consent ported to India. A consent flow built for Indian data principals — covering notice requirements, language obligations for 22 scheduled languages, withdrawal mechanisms, and Consent Manager integration.
The contact India’s law requires. Named, accessible, accountable. Structured for Data Protection Board of India interface when the adjudicatory mechanism activates. Not a FAQ page — a functional grievance channel.
The Rules are coming. We track every Ministry of Electronics and Information Technology notification, every inter-ministerial consultation, every DPBI circular. You will not be surprised by a notification that everyone else saw coming.
The Privacy Dividend™
Most EU Companies See DPDPA as Risk.
The Smart Ones See It as Entry.
India’s DPDPA creates a trust infrastructure that does not exist in most Asian markets. A regulated data environment. Enforceable rights. An independent adjudicatory body with real penalty powers.
EU companies that achieve DPDPA compliance early gain something their competitors do not: an India market entry story built on demonstrated trust. Indian consumers, regulators, and counterparties notice the difference.
Compliance is not a cost of entry. It is the entry.
The Privacy Dividend™ — the measurable return on privacy investment — is higher in India’s market right now than anywhere else in Asia. India is the only jurisdiction in Asia where privacy is a constitutional right. That changes the value of demonstrating compliance to every Indian counterparty you will ever face across a table.
It is a Competitive Position.
Companies that treat DPDPA as a box ticking exercise will spend money and remain exposed. Companies that treat it as an architecture exercise will build something that creates business value — in the Indian market and in their relationship with Indian counterparties, regulators, and customers.
minus Penalty Risk Avoided
plus Market Trust Gained
= Privacy Dividend™
Authority
What Thinking Lawyers
Are Saying About DPDPA.
India’s DPDPA is not a derivative statute. It is a first principles response to the question: what does data protection mean in a constitutional democracy of 1.4 billion people? The answer is different from Brussels. It was always going to be.
The DPDPA introduces a consent architecture that EU practitioners have not encountered before. Consent withdrawal is absolute — no controller-interest balancing, no residual processing justification. Indian data principals hold a stronger withdrawal right than their EU counterparts in this specific dimension.
The Data Protection Board of India will be the most consequential new regulatory body India creates since SEBI. It will set enforcement precedents that define the compliance obligations of every digital business in India for the next two decades. Build your posture before it activates, not after.
EU companies processing Indian personal data face a dual compliance burden that most have not mapped. SCCs govern the EU-to-India leg. DPDPA governs the India-outbound leg. Two frameworks, two directions, one operation. Most companies are solving half the problem and calling it done.
DPDPA’s nominee rights provision has no parallel in GDPR. When a data principal dies or loses capacity, a nominee can step in to exercise their data rights. EU privacy counsel advising on India operations must address this in every privacy notice, every consent framework, every data governance policy.
Every Data Fiduciary must maintain accuracy, retain data only as long as the purpose requires, protect data through appropriate security safeguards, and delete data once the purpose is served. These obligations arise from the enacted Act. Not from the pending Rules.
The Central Government will notify certain Data Fiduciaries as Significant. Additional obligations include data protection impact assessments, data audits, and appointment of a Data Protection Officer. EU companies processing large volumes of Indian personal data should assume they may be notified.
Children’s data obligations breach: up to ₹200 Crore. Failure to implement security safeguards: up to ₹250 Crore. Failure to notify a breach: up to ₹200 Crore. Non-compliance with Board directions: up to ₹50 Crore. Per instance. Not per investigation.
India is not waiting for EU companies to be ready. The Act is enacted. The Board is being constituted. The Rules are coming. The question is not whether DPDPA applies to your operations. The question is whether you want to build your compliance architecture with a firm that has spent 27 years in the jurisdiction — or explain to your board why you did not.
Your India Data Compliance
Starts With the Right Conversation.
Not a form. Not an RFQ. A conversation with a lawyer who has argued Indian regulatory law for 27 years and built a practice specifically for this moment in India's data law history.