Comparison
DPDPA vs GDPR: the differences that matter in practice
If you already comply with the GDPR, you have a head start on the DPDPA, but not a finish. The two share ideas and differ in places that change what you build. This is a side-by-side for teams working across both.
Executive summary
Both laws protect personal data and give people rights. The DPDPA is shorter, more consent-centred and simpler in structure.
- Fewer legal bases. Consent plus a list of “legitimate uses”, not the GDPR's six bases including legitimate interests.
- One category of data. No special category for health, biometrics or beliefs; the penalties and safeguards scale by risk instead.
- Breach reporting is broader. Every personal data breach is reported to the Board and to affected people.
- Penalties are fixed rupee ceilings and not a percentage of global turnover.
01The comparison
| Topic | DPDPA (India) | GDPR (EU/UK-style) |
|---|---|---|
| Legal bases | Consent, or a defined list of “legitimate uses” (for example voluntarily provided data, medical emergency, employment, State functions). | Six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. |
| Sensitive data | No special category. | Special categories (health, biometrics, beliefs and others) with stricter conditions. |
| Who is regulated | Data Fiduciary (controller); Processors act on contract. Significant Data Fiduciaries carry extra duties. | Controllers and processors, each with direct duties. |
| Individual rights | Access to a summary, correction and erasure, grievance redressal, nomination. | Access, rectification, erasure, restriction, portability, objection, rights on automated decisions. |
| Breach reporting | Notify the Board and each affected person; detailed report to the Board within 72 hours under the Rules. | Notify the supervisory authority within 72 hours unless unlikely to cause risk; notify individuals when high risk. |
| Children | Under 18; verifiable parental consent; no tracking or targeted advertising. | Age of digital consent between 13 and 16 by Member State; parental consent below it. |
| Data protection officer | Only Significant Data Fiduciaries, based in India. | Required in defined cases, including large-scale processing. |
| Cross-border transfers | Allowed except to countries the Government restricts. | Restricted unless an adequacy decision or safeguards such as standard clauses apply. |
| Penalties | Fixed ceilings by type of failure, up to ₹250 crore. | Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements. |
| Regulator | Data Protection Board of India (digital office). | National supervisory authorities, coordinated by the European Data Protection Board. |
Source: Sources: DPDPA 2023 and Rules 2025; Regulation (EU) 2016/679. This is a summary, not legal advice.
02What it means in practice
- If you comply with the GDPR, reuse your records of processing, notices and vendor terms, then close the gaps: consent standards, the children rules at 18, and the all-breaches reporting.
- Do not assume “legitimate interests” will rescue you. There is no equivalent. If your processing does not fit a listed legitimate use, you need consent.
- Plan for fixed-sum exposure. A rupee ceiling can be lower than a turnover-based fine for a very large company, but it is large for most organisations and applies per type of failure.
- One programme, two lenses. Maintain a single data inventory and map each activity to both laws.
How to read it. Enforcement ramped up over years, not months, and concentrated on a few regulators and a few very large cases. Breach notifications also rose 22% to an average of 443 a day. Expect the Indian Board's early actions to be about notices and corrective orders before large penalties.
Source: DLA Piper GDPR Fines and Data Breach Survey, January 2026. Largest single fine: €1.2 billion (2023); largest in 2025: €530 million.
The GDPR numbers are a reminder that regulators ramp up. Seven years in, European authorities impose about €1.2 billion in fines a year and receive 443 breach notifications a day. Build the habits now.
Six questions on consent, rights, breach readiness and vendors. No sign-up needed to see the result.
?Frequently asked questions
Is the DPDPA stricter than GDPR?
Does GDPR compliance mean DPDPA compliance?
Does the DPDPA have a right to data portability?
Does the DPDPA have a 'legitimate interests' basis?
§Sources
- Digital Personal Data Protection Rules, 2025 notified (Press Information Bureau)
- DPDPA Rules 2025: key highlights (SCC Online)
- DLA Piper GDPR Fines and Data Breach Survey, January 2026
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
Figures are quoted from the sources above and were checked on 6 November 2026. Laws and rules change; confirm the current text before relying on any of it. This is general information, not legal advice. Illustrative exhibits are marked as such.
Keep reading
DPDPA compliance in India: what you have to do, and by when
India's data protection law is no longer a draft.
14 min read →AnalysisDPDPA penalties explained: what is at stake and how the Board decides
The headline figure is ₹250 crore.
7 min read →Playbook · PDFThe DPDPA Readiness Playbook
From "where is our data?" to "here is our evidence" in 90 days. A working document for the people who will do the job.
Free download · 8 pages →