Already GDPR compliant? Here are the important differences between India's DPDP Act and the EU's GDPR.
Scope
The GDPR applies to personal data in any form, while the DPDP Act focuses on digital personal data, including data that is digitised after collection.
Grounds for processing
The GDPR offers six lawful bases, including legitimate interests. The DPDP Act relies primarily on consent, supplemented by a defined list of 'certain legitimate uses' — there is no broad legitimate-interests ground.
Sensitive data and children
The DPDP Act does not create separate categories of sensitive personal data, but it requires verifiable parental consent for processing the personal data of children under 18, compared to the GDPR's age threshold of 13 to 16 depending on the member state.
Penalties
GDPR fines are linked to global turnover, whereas the DPDP Act prescribes fixed maximum penalties per category of breach, up to ₹250 crore.
What this means for you
GDPR compliance is a strong foundation, but it does not automatically make you DPDP compliant. A targeted gap assessment helps you reuse existing controls and close India-specific gaps.
This article provides general information and does not constitute legal advice.