# DPDP Act vs GDPR: 17 differences that change your compliance programme

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/dpdp-vs-gdpr/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

The DPDP Act is consent-heavy, rights-light, State-friendly, and has no sensitive-data tier.

| Topic | DPDP Act 2023 | GDPR |
|---|---|---|
| Lawful bases | **2**: consent (s.6) or the closed s.7 list | 6, including legitimate interests |
| Legitimate interests | **None** | Art 6(1)(f) |
| Sensitive data category | **None**. Health, biometric, financial and caste get no special tier | Art 9 special categories |
| Extraterritorial trigger | Offering goods or services to India (s.3(b)) | Offering **or monitoring behaviour** |
| Child age | **Under 18** (s.2(f)) | 16, states may lower to 13 |
| Targeted ads at children | **Prohibited outright** (s.9(3)) | Restricted, not banned |
| Breach notification threshold | **None**. Board and every affected individual (s.8(6)) | Risk-based |
| Breach clock | Individuals without delay; Board detailed report in 72 hours (Rule 7) | 72 hours to the DPA |
| DPO | Notified Significant Data Fiduciaries only (s.10(2)(a)) | Wider Art 37 triggers |
| Data portability | **Absent** | Art 20 |
| Right to object / automated decisions | **Absent** | Arts 21, 22 |
| Compensation to individuals | **Absent**. Penalties go to the Consolidated Fund (s.34) | Art 82 |
| Cross-border transfers | Negative list, permitted by default (s.16) | Adequacy, SCCs, BCRs |
| Regulator | Adjudicatory Board with **no rule-making power** | Independent DPAs that issue guidance |
| Duties on individuals | **Yes** (s.15), penalty up to Rs 10,000 | No |
| Criminal liability | **None** | Member-State dependent |
| Maximum penalty | Rs 250 crore | 4% of global turnover or EUR 20m |