DPDP vs GDPR
DPDP Act vs GDPR: Key Differences for Indian Businesses
By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules
Short answer
India’s DPDP Act is narrower and simpler than the GDPR: it covers only digital personal data, relies mainly on consent plus a short list of “legitimate uses” instead of six lawful bases, has no special categories of sensitive data, treats everyone under 18 as a child, requires every breach to be reported, and caps penalties at fixed amounts up to ₹250 crore rather than a percentage of turnover.
- Scope
- DPDP: digital personal data only. GDPR: all personal data
- Child age
- DPDP: under 18. GDPR: under 16 (member states may lower to 13)
- Breach reporting
- DPDP: every breach, 72-hour report. GDPR: 72 hours unless unlikely to pose a risk
- Max penalty
- DPDP: ₹250 crore. GDPR: €20 million or 4% of global turnover
DPDP vs GDPR at a glance
| Topic | DPDP Act, 2023 (India) | GDPR (EU) |
|---|---|---|
| Data covered | Digital personal data, including paper data later digitised | All personal data, digital or manual filing systems |
| Lawful grounds | Consent, or specified “legitimate uses” (Section 7) | Six lawful bases, including legitimate interests (Art. 6) |
| Sensitive data | No separate special category | Special categories with stricter rules (Art. 9) |
| Children | Under 18; verifiable parental consent (Section 9, Rule 10) | Under 16 for online services, can be lowered to 13 (Art. 8) |
| Breach notification | Every breach; affected people and Board without delay, detailed report in 72 hours | Authority within 72 hours unless unlikely to result in a risk (Art. 33) |
| Cross-border transfers | Allowed except to countries the government restricts (Section 16) | Only with adequacy, safeguards or derogations (Chapter V) |
| Data portability | Not provided | Right to data portability (Art. 20) |
| Data Protection Officer | Only Significant Data Fiduciaries (Section 10) | Public bodies and large-scale core processing (Art. 37) |
| Publicly available data | Excluded if made public by the person or under law (Section 3(c)(ii)) | Still personal data under GDPR |
| Maximum penalty | Fixed caps up to ₹250 crore (Schedule) | €20 million or 4% of worldwide annual turnover (Art. 83) |
If you are already GDPR-compliant, what changes for India?
A GDPR programme gives you most of the building blocks: data inventories, notices, consent records, security controls and a breach process. The gaps usually are:
- Legitimate interests does not exist under DPDP, so processing that relied on it needs consent or a Section 7 legitimate use
- Every breach must be reported, not only risky ones, and affected people must be told
- Anyone under 18 is a child, so age gating and parental consent flows need rework
- Notices must follow Rule 3, including how to complain to the Data Protection Board
- Grievance redressal must be published and answered within 90 days at most (Rule 14)
Need this done in your own systems?
Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.
See our DPDP compliance servicesFrequently asked questions
Is the DPDP Act the same as GDPR?+
No. Both protect personal data, but the DPDP Act covers only digital personal data, has fewer lawful grounds, no special categories of sensitive data, a child age of 18, mandatory reporting of every breach and fixed penalty caps up to ₹250 crore.
Does GDPR compliance mean DPDP compliance?+
Not automatically. GDPR work covers much of the groundwork, but DPDP differs on lawful grounds, children, breach reporting, notices and grievance handling, so a gap assessment is still needed.
Which is stricter, DPDP or GDPR?+
GDPR is broader and has percentage-of-turnover fines, but DPDP is stricter in places: it requires reporting of every personal data breach and treats everyone under 18 as a child.
Does the DPDP Act apply to foreign companies?+
Yes. Section 3(b) applies the Act to processing outside India when it is connected to offering goods or services to people in India.
Related DPDP guides
Sources
- Digital Personal Data Protection Act, 2023
- Digital Personal Data Protection Rules, 2025
- General Data Protection Regulation (EU) 2016/679
This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.