Comparison · California and India
CCPA vs DPDP
The California Consumer Privacy Act as amended by the CPRA, and India's Digital Personal Data Protection Act, 2023 side by side, on the same criteria, with the Civil Code section or DPDP section behind every cell. Written for an Indian company that built its privacy programme for US customers on an opt-out model and is now being asked about consent at home, and for the reverse.
Sources: California Consumer Privacy Act of 2018 (Civil Code 1798.100 onwards), text effective 1 Jan 2026, as posted by the CPPA; CCPA Regulations, 11 CCR Division 6, Chapter 1, effective 1 Jan 2026; CPPA, Updated monetary thresholds in the CCPA, effective 1 Jan 2025; Digital Personal Data Protection Act, 2023 (Act 22 of 2023), Gazette copy; Digital Personal Data Protection Rules, 2025, G.S.R. 846(E)
Side by side
Thirteen criteria, reviewed 4 Nov 2026. Each cell names its source. Scroll sideways on a phone.
| Criterion | CCPA/CPRA (California) | DPDP (India) |
|---|---|---|
| Who it binds | For-profit businesses doing business in California that meet one threshold: annual gross revenue above USD 26,625,000 (adjusted from USD 25 million from 1 Jan 2025); or buying, selling or sharing personal information of 100,000 or more consumers or households; or earning 50 percent or more of revenue from selling or sharing it. Service providers, contractors and third parties are bound through contract and some direct duties.Civ. Code 1798.140(d), 1798.199.95(d) | Every Data Fiduciary, with no revenue or volume threshold. The Central Government may exempt notified classes, including startups, from some duties, and may designate Significant Data Fiduciaries for extra ones.s. 2(i), 10, 17(3) |
| Whom it protects | Consumers: natural persons who are California residents, in whatever capacity, including as employees and business contacts.Civ. Code 1798.140(i) | Data Principals: the individuals the data relates to, for processing in India, plus people in India offered goods or services from abroad. Nationality does not matter.s. 2(j), 3 |
| What data | Personal information: information that identifies, relates to, describes or could reasonably be linked with a consumer or household, in any form. Publicly available and deidentified information are excluded.Civ. Code 1798.140(v) | Digital personal data: data about an identifiable individual, collected in digital form or digitised later. Data the individual made public, or that must be published by law, is excluded.s. 2(n), 2(t), 3 |
| The model | Notice and opt-out. A business may collect and use personal information after a notice at collection, within what is reasonably necessary and proportionate. Consumers may opt out of sale and sharing and limit use of sensitive personal information. Opt-in consent only for selling or sharing the data of consumers under 16, and for financial incentive programmes.Civ. Code 1798.100(a), (c), 1798.120, 1798.121, 1798.125(b) | Consent or a listed legitimate use. Processing needs the Data Principal's free, specific, informed, unconditional and unambiguous consent, given after a notice, or must fall within the uses in s. 7. There is no opt-out model and no general legitimate interests ground.s. 4, 5, 6, 7 |
| Sensitive data | Sensitive personal information is a defined category: government identifiers, account credentials, precise geolocation, racial or ethnic origin, religion, union membership, contents of mail, genetic and biometric data, health, sex life and sexual orientation. Consumers can limit its use to what is necessary to provide the service.Civ. Code 1798.121, 1798.140(ae) | No sensitive category. All digital personal data is treated alike; the extra duties attach to children and to Significant Data Fiduciaries.s. 2(t), 9, 10 |
| Children | Opt-in before selling or sharing the data of a consumer the business knows is under 16: the teen's own authorisation at 13 to 15, a parent's or guardian's below 13. Wilful disregard of age counts as knowledge.Civ. Code 1798.120(c) | A child is anyone under 18. Verifiable parental consent before any processing, not just before selling; no tracking, behavioural monitoring or targeted advertising directed at children.s. 2(f), 9; Rule 10 |
| Rights and response time | Know and access, delete, correct, opt out of sale or sharing, limit sensitive use, and no retaliation. Access, deletion and correction are answered within 45 days, extendable once by 45 days. Opt-outs are honoured through a 'Do Not Sell or Share My Personal Information' link and a browser opt-out preference signal.Civ. Code 1798.100 to 1798.125, 1798.130(a)(2), 1798.135 | Access to a summary of processing and sharing, correction and erasure, grievance redressal and nomination. No opt-out or portability right. Grievances are answered within the period the fiduciary publishes, not exceeding 90 days.s. 11 to 14; Rule 14(3) |
| Breach | The CCPA has no notification clause of its own; California's general breach law requires notice to affected residents in the most expedient time possible and to the Attorney General when more than 500 residents are affected. The CCPA adds a private right of action when a breach follows a failure to maintain reasonable security: USD 107 to USD 799 per consumer per incident or actual damages, whichever is greater.Civ. Code 1798.82; 1798.150(a); 1798.199.95(d) | Intimation to the Board and to each affected Data Principal without delay, and a detailed report to the Board within 72 hours or a longer period the Board allows. No private right of action: civil courts are barred from matters the Board is empowered to decide.s. 8(6), 39; Rule 7 |
| Vendors | Service providers and contractors must be under a written contract that limits use to specified business purposes, bars selling or sharing, and gives the business audit and remediation rights. Disclosures to third parties need contract terms too.Civ. Code 1798.100(d), 1798.140(ag), (j) | A Data Processor may be engaged only under a valid contract. The fiduciary stays responsible for processing done on its behalf, must cause the processor to erase data, and must put reasonable security safeguards into the contract.s. 8(1), 8(2), 8(7)(b); Rule 6(1)(f) |
| Cross-border transfer | No transfer restriction. The duties travel with the data through the service provider, contractor and third party contracts.Civ. Code 1798.100(d) | Allowed to any country the Central Government has not restricted by notification. The Rules let the Government set requirements for making personal data available to a foreign State.s. 16; Rule 15 |
| Assessments and audits | Regulations effective 1 Jan 2026 require risk assessments for high-risk processing, with attestations and summaries filed with the agency by 1 Apr 2028, and annual independent cybersecurity audits phased in by revenue: certifications due 1 Apr 2028 above USD 100 million, 1 Apr 2029 for USD 50 to 100 million, 1 Apr 2030 below USD 50 million. Automated decisionmaking rules apply from 1 Jan 2027.Civ. Code 1798.185(a)(14); 11 CCR 7121, 7155, 7157, 7200 | Only Significant Data Fiduciaries: a Data Protection Impact Assessment and an audit once every twelve months, with significant observations reported to the Board; a Data Protection Officer based in India; an independent data auditor.s. 10(2); Rule 13 |
| Regulator | The California Privacy Protection Agency, governed by a five-member board, with administrative enforcement and rulemaking; the Attorney General brings civil actions.Civ. Code 1798.199.10, 1798.199.40, 1798.199.90 | The Data Protection Board of India, established by notification on 13 Nov 2025 and functioning as a digital office. Appeals to the Telecom Disputes Settlement and Appellate Tribunal within 60 days.s. 18, 28, 29 |
| Penalty | Administrative fines of up to USD 2,663 per violation, or USD 7,988 per intentional violation or violation involving a consumer known to be under 16, as adjusted from 1 Jan 2025; the Attorney General's civil penalty is the same. Per violation, with no turnover cap.Civ. Code 1798.155(a), 1798.199.90(a), 1798.199.95(d) | Up to Rs 250 crore for failing to take reasonable security safeguards; Rs 200 crore for breach notification and children's duties; Rs 150 crore for Significant Data Fiduciary duties; Rs 50 crore for any other breach. Imposed by the Board after inquiry.s. 33; Schedule |
The differences that matter
Opt-out versus consent
Under the CCPA you may collect and use personal information once you have given notice; the consumer's control is the right to opt out of sale and sharing and to limit sensitive uses. Under DPDP nothing happens until the Data Principal consents, or the use is one of the specific ones in s. 7. A 'Do Not Sell or Share' link and a cookie banner that defaults to on do not meet s. 6. Indian companies that built for California must turn the default around.
Thresholds versus everyone
The CCPA binds only businesses above a revenue, volume or data-sale threshold, so many small Indian vendors are outside it entirely. DPDP binds every Data Fiduciary from day one, however small; relief comes only through a government notification under s. 17(3). The question in California is whether you are covered; the question in India is which obligations apply to you.
Sixteen versus eighteen, and what consent is for
California's age rules bite only on selling or sharing: a teen of 13 to 15 can authorise it, a parent must below 13. DPDP treats everyone under 18 as a child for every processing purpose, requires verifiable parental consent before any processing, and bans tracking and targeted advertising at children outright. An age-gated US product usually needs a different sign-up flow for India.
Who comes after you
The CCPA has a dedicated agency, the Attorney General and, for breaches caused by poor security, the consumers themselves through a private right of action with statutory damages per person. DPDP routes everything through the Data Protection Board: the Data Principal complains to the fiduciary first, then to the Board, and civil courts are barred under s. 39. California's penalties are small per violation and multiply; India's are capped per instance but start in the hundreds of crores.
Questions
We comply with the CCPA. How far does that get us under DPDP?
Your data inventory, notices, vendor contracts, security programme and rights-handling workflow carry over. Your legal basis does not: everything that runs on notice and opt-out in California needs consent or a s. 7 use in India. Your age gate moves from 16 to 18 and from selling to all processing. Your 45-day request clock becomes a published grievance period of up to 90 days under Rule 14(3), and your breach plan gains two recipients, the Board and every affected person.
Does DPDP have anything like 'sale' or 'sharing' of personal data?
No. DPDP does not single out sale or cross-context behavioural advertising. Disclosure to another fiduciary is simply processing that needs consent for a specified purpose, and the fiduciary must ensure the data is complete, accurate and consistent before disclosing it under s. 8(3). The one place advertising is named is s. 9(3), which bans targeted advertising directed at children.
Does the CCPA apply to an Indian company with no office in the US?
It can. The test in Civ. Code 1798.140(d) is doing business in California and meeting a threshold, not having an establishment there; California residents' data processed by an Indian SaaS vendor can bring it in, and its US customers will push the service provider terms of 1798.140(ag) down by contract in any case. DPDP's reach is the mirror image: s. 3(b) covers processing outside India connected with offering goods or services to people in India.
Which has the heavier audit burden?
For a large company, California from 2028: annual independent cybersecurity audits and risk assessment filings under the regulations effective 1 Jan 2026, phased in by revenue. For everyone else, DPDP, because the duties apply regardless of size; only Significant Data Fiduciaries notified under s. 10 carry the formal annual DPIA and audit of Rule 13.
Read next
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators