Comparison · EU and India
GDPR vs DPDP
The EU's General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023 side by side, on the same criteria, with the article or section behind every cell. Written for a company that already does one and is being asked about the other.
Sources: Regulation (EU) 2016/679 (GDPR); Digital Personal Data Protection Act, 2023 (Act 22 of 2023), Gazette copy; Digital Personal Data Protection Act, 2023 on India Code; Digital Personal Data Protection Rules, 2025, G.S.R. 846(E)
Side by side
Fourteen criteria, reviewed 4 Nov 2026. Each cell names its source. Scroll sideways on a phone.
| Criterion | GDPR (EU) | DPDP (India) |
|---|---|---|
| What it covers | Personal data processed wholly or partly by automated means, and manual data that forms part of a filing system.Art. 2(1) | Digital personal data only: data collected in digital form, or collected on paper and digitised later.s. 2(n), 3(a) |
| Reach outside the territory | Controllers and processors outside the EU when they offer goods or services to people in the EU, or monitor their behaviour there.Art. 3(2) | Processing outside India when it is connected with offering goods or services to Data Principals in India.s. 3(b) |
| Who decides, who does the work | Controller (determines purposes and means) and processor (processes on the controller's behalf).Art. 4(7), 4(8) | Data Fiduciary (determines purpose and means) and Data Processor (processes on the fiduciary's behalf), engaged only under a valid contract.s. 2(i), 2(k), 8(2) |
| The person | Data subject: an identified or identifiable natural person.Art. 4(1) | Data Principal; for a child, includes the parents or lawful guardian; for a person with disability, includes the lawful guardian acting on her behalf.s. 2(j) |
| When processing is allowed | Six lawful bases, consent one of them. Legitimate interests is a general ground, not open to public authorities performing their tasks.Art. 6(1) | Consent, or one of the listed certain legitimate uses (voluntarily provided data, State functions, legal obligations, medical emergencies, employment and a few more). No general legitimate interests ground.s. 4(1), 6, 7 |
| Consent | Freely given, specific, informed and unambiguous, by a statement or clear affirmative action. The controller must be able to demonstrate it. Withdrawal must be as easy as giving.Art. 4(11), 7 | Free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the data necessary for the purpose. Withdrawal as easy as giving. Burden of proof on the fiduciary. Consent Managers registered with the Board act as a single point for giving and withdrawing consent.s. 6; Rule 4 |
| Sensitive data | Special categories (racial or ethnic origin, political opinions, religion, trade union membership, genetic and biometric data, health, sex life) are prohibited unless one of the listed conditions applies.Art. 9 | No separate category. All digital personal data is treated alike; the extra duties attach to children's data and to Significant Data Fiduciaries, not to data types.s. 2(t), 9, 10 |
| Children | For online services offered directly to a child, the child's own consent is valid from 16; member states may lower this to 13. Reasonable efforts to verify parental consent below that age.Art. 8 | A child is anyone under 18. Verifiable parental consent before any processing; no tracking, behavioural monitoring or targeted advertising directed at children. Exemptions by class of fiduciary and purpose are in the Rules.s. 2(f), 9; Rules 10, 12 |
| Breach notification | To the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk. To data subjects without undue delay only when the risk is high.Art. 33, 34 | To the Board and to each affected Data Principal, with no risk threshold. First intimation without delay; detailed report to the Board within 72 hours of becoming aware, or a longer period the Board allows on a written request.s. 8(6); Rule 7 |
| Rights and response time | Access, rectification, erasure, restriction, portability and objection. The controller replies within one month, extendable by two further months for complex requests.Art. 12(3), 15 to 22 | Access to a summary of processing and sharing, correction and erasure, grievance redressal and nomination. No portability or objection right. Grievances are answered within the period the fiduciary publishes, which may not exceed 90 days.s. 11 to 14; Rule 14(3) |
| Cross-border transfer | Only to countries with an adequacy decision, under appropriate safeguards such as standard contractual clauses or binding corporate rules, or under a narrow derogation.Art. 44 to 49 | Allowed to any country the Central Government has not restricted by notification. The Rules add that the Government may set requirements for making personal data available to a foreign State.s. 16; Rule 15 |
| Officer | A data protection officer is mandatory for public bodies, for large-scale regular and systematic monitoring, and for large-scale special-category processing.Art. 37(1) | A Data Protection Officer only for Significant Data Fiduciaries, based in India and answerable to the board of directors. Every fiduciary must publish a contact who can answer questions about processing.s. 8(9), 10(2)(a); Rule 9 |
| Regulator | One or more independent supervisory authorities in each member state, coordinated by the European Data Protection Board.Art. 51, 68 | The Data Protection Board of India, established by notification on 13 Nov 2025, functioning as a digital office. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days.s. 2(a), 18, 28, 29 |
| Maximum penalty | Up to EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher, for the core duties; a lower tier of EUR 10 million or 2 percent for the rest.Art. 83(4), 83(5) | Up to Rs 250 crore for failing to take reasonable security safeguards; Rs 200 crore for failing to notify a breach or for breaching the children's duties; Rs 150 crore for Significant Data Fiduciary duties; Rs 50 crore for any other breach.s. 33; Schedule |
The differences that matter
No legitimate interests
GDPR lets a controller rely on legitimate interests for a wide range of processing, from fraud prevention to analytics. DPDP has no such ground: it is consent under s. 6 or one of the specific uses in s. 7. Marketing analytics that runs on legitimate interests in Europe needs consent in India, and a notice under s. 5 before the consent.
Every breach, every person
GDPR lets you skip the authority when a breach is unlikely to result in a risk, and skip individuals unless the risk is high. DPDP has no threshold. Under s. 8(6) and Rule 7 the Board and every affected Data Principal are told, every time, and the detailed report to the Board is due within 72 hours of becoming aware.
Children are under 18
GDPR's digital age of consent is 13 to 16 depending on the member state, and applies only to online services offered directly to a child. DPDP treats everyone under 18 as a child for all processing, requires verifiable parental consent under Rule 10, and bans tracking, behavioural monitoring and targeted advertising aimed at them.
Transfers run on a blacklist
GDPR permits transfers only to adequate countries or under safeguards. DPDP permits them anywhere the Central Government has not restricted by notification under s. 16, so an Indian company has less paperwork but less certainty: a future notification can close a destination, and Rule 13(4) lets the Government keep specified data of Significant Data Fiduciaries inside India.
Questions
We are GDPR compliant. Are we DPDP compliant?
Mostly, not entirely. Your notices, consent records, security controls and rights processes carry over. What does not: legitimate-interests processing, your breach threshold, your age of consent, and the Indian specifics such as Consent Managers, the 90-day grievance window in Rule 14(3) and, for Significant Data Fiduciaries, a Data Protection Officer based in India and an annual audit under Rule 13.
Does DPDP have sensitive personal data categories?
No. Unlike GDPR Art. 9, the Act treats all digital personal data the same, with extra rules only for children (s. 9) and for Significant Data Fiduciaries (s. 10). Sectoral regulators such as RBI and SEBI add their own data rules on top, and s. 16(2) preserves any stricter transfer restriction in another Indian law.
When does DPDP apply in full?
The Act received assent on 11 Aug 2023. The Rules were notified on 13 Nov 2025 as G.S.R. 846(E). Rules 1, 2 and 17 to 21 (the Board) took effect that day; Rule 4 (Consent Managers) applies from 13 Nov 2026; the rest, including notice, breach intimation, children and Significant Data Fiduciary duties, apply from 13 May 2027, eighteen months after publication.
Which applies to an Indian SaaS company with EU customers?
Both. GDPR for the EU residents' data you process, under Art. 3(2). DPDP for personal data processed in India and for people in India you sell to, under s. 3. Note s. 17(1)(d): personal data of people outside India, processed in India under a contract with a person outside India, is outside most of the Act's duties.
Read next
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators