DPDP Act 2023 vs GDPR
The differences that actually change what you build. Importing a GDPR programme wholesale over-builds rights machinery and under-builds consent, notice, breach readiness and Indian-language support.
Is the DPDP Act the same as the GDPR? No. The DPDP Act is consent-heavy, rights-light, State-friendly, and has no sensitive-data tier.
| Topic | DPDP Act 2023 | GDPR |
|---|---|---|
| Lawful bases | 2: consent (s.6) or the closed s.7 list | 6, including legitimate interests |
| Legitimate interests | None | Art 6(1)(f) |
| Sensitive data category | None. Health, biometric, financial and caste get no special tier | Art 9 special categories |
| Extraterritorial trigger | Offering goods or services to India (s.3(b)) | Offering or monitoring behaviour |
| Child age | Under 18 (s.2(f)) | 16, states may lower to 13 |
| Targeted ads at children | Prohibited outright (s.9(3)) | Restricted, not banned |
| Breach notification threshold | None. Board and every affected individual (s.8(6)) | Risk-based |
| Breach clock | Individuals without delay; Board detailed report in 72 hours (Rule 7) | 72 hours to the DPA |
| DPO | Notified Significant Data Fiduciaries only (s.10(2)(a)) | Wider Art 37 triggers |
| Data portability | Absent | Art 20 |
| Right to object / automated decisions | Absent | Arts 21, 22 |
| Compensation to individuals | Absent. Penalties go to the Consolidated Fund (s.34) | Art 82 |
| Cross-border transfers | Negative list, permitted by default (s.16) | Adequacy, SCCs, BCRs |
| Regulator | Adjudicatory Board with no rule-making power | Independent DPAs that issue guidance |
| Duties on individuals | Yes (s.15), penalty up to Rs 10,000 | No |
| Criminal liability | None | Member-State dependent |
| Maximum penalty | Rs 250 crore | 4% of global turnover or EUR 20m |
What GDPR-trained teams most often get wrong
- Reaching for legitimate interests. It does not exist in the DPDP Act.
- Applying a harm threshold to breach notification. There isn't one.
- Building portability and automated-decision machinery nobody needs.
- Assuming a large company is automatically a Significant Data Fiduciary. It is not, until the Central Government notifies it.
- Using 13 or 16 as the child age instead of 18.
- Forgetting the Eighth Schedule language requirement: notice and consent must be available in English or any of the 22 scheduled languages (ss.5(3), 6(3)).
- Missing that the burden of proving valid notice and consent sits on the business (s.6(10)).
Last updated . Report an error.