Compare

DPDP Act vs GDPR: What Changes If You Already Comply with the GDPR

The DPDP Act is India's law on digital personal data. The GDPR is the European Union's data protection regulation. They share ideas such as consent and breach notice, but they differ on legal grounds, children, individual rights, breach reporting and penalties.

CoversDigital data, s.3

Legal groundsConsent or s.7 uses

A child isUnder 18, s.2(f)

Duties apply from13 May 2027

Checked against the Act, the Rules and the GDPR text on 2 November 2026. Not legal advice.

In short

No. The DPDP Act differs from the GDPR on legal grounds, children, individual rights, breach reporting and penalties.

Legal grounds: the GDPR lists six. The DPDP Act allows consent or the listed "certain legitimate uses" in s.7. We found no clause that matches "legitimate interests".
Children: under the DPDP Act a child is anyone under 18, and a parent or guardian must give verifiable consent first (s.2(f), s.9(1)). The GDPR default age is 16, and Member States may lower it, but not below 13.
Rights: sections 11 to 14 cover access, correction and erasure, grievance redressal and nomination. We found no portability, restriction or objection right there.
Breach: s.8(6) covers any personal data breach and sets no risk threshold. The 72 hours in Rule 7 is for the detailed report to the Board.
Penalties: fixed rupee ceilings, up to Rs 250 crore. The GDPR ceiling is up to EUR 20 million or 4% of worldwide turnover, whichever is higher.

Scope

The DPDP Act covers digital data (s.3(a)). The GDPR covers automated processing and some filing-system records (Art. 2(1)).

Legal grounds

Consent or the nine listed uses in the DPDP Act. The GDPR has six grounds, including legitimate interests.

Children

Under 18, with parental consent first (s.9(1)). The GDPR default age is 16 (Art. 8(1)).

Rights

Sections 11 to 14 have no portability, restriction or objection heading. They add grievance redressal and nomination.

Breach notice

In India: notice to affected people and to the Board, plus a detailed report within 72 hours (Rule 7).

Penalties

Fixed ceilings up to Rs 250 crore. The GDPR ceiling is up to EUR 20 million or 4% of worldwide turnover.

The six differences covered on this page.

Where Things Stand on 2 November 2026

Status check

In force now: the definitions, the Data Protection Board provisions and a few other sections (from 13 November 2025). The Board was established by notification G.S.R. 844(E) on that date. 13 November 2026: Rule 4, with s.6(9) on Consent Manager registration and s.27(1)(d). 13 May 2027: Sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37 and 44(2) of the Act, which include the legal grounds, the children's rules, the rights, the breach duty and the penalties, and Rules 3, 5 to 16, 22 and 23.

Both dates are counted from the Gazette publication date of 13 November 2025, under notification G.S.R. 843(E) for the Act and Rule 1 of G.S.R. 846(E) for the Rules. Some sources count from 14 November 2025, which would shift the later dates by a day. Check the Gazette.

Dates counted from the Gazette publication date of 13 November 2025.

DPDP Act vs GDPR at a Glance

Main points of difference
Topic	GDPR	DPDP Act and Rules
Data covered	Personal data processed wholly or partly by automated means, and some records kept in a filing system (Art. 2(1)).	Digital personal data, including data collected on paper and digitised later (s.3(a)).
Reach outside the territory	Processing of data of people who are in the Union, in certain cases (Art. 3(2)).	Processing outside India in connection with offering goods or services to people in India (s.3(b)).
Legal grounds	Six grounds, including legitimate interests (Art. 6(1)(a) to (f)).	Consent, or the listed certain legitimate uses (s.4(1), s.7). No legitimate interests clause found.
Consent	Freely given, specific, informed and unambiguous, by a statement or clear affirmative action (Art. 4(11)).	Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6(1)).
Sensitive data	Art. 9 covers processing of special categories of data.	No provision matching Art. 9 found in the sections cited here.
Children	Default age 16 for online services based on consent. Member States may lower it, not below 13 (Art. 8(1)).	A child is under 18 (s.2(f)). Verifiable consent of a parent or guardian is needed before processing a child's data (s.9(1)).
Individual rights	Access, rectification, erasure, restriction, portability, objection, automated decisions (Arts. 15 to 22).	Access, correction and erasure, grievance redressal, nomination (ss.11 to 14), and duties of the individual (s.15).
Breach notice	To the authority without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33(1)). To individuals where the risk is high (Art. 34(1)).	To the Board and each affected person (s.8(6)). Detailed report to the Board within 72 hours (Rule 7(2)(b)).
DPO and impact assessment	Set by risk and type of processing (Arts. 35, 37).	Significant Data Fiduciaries notified under s.10(1).
Transfers abroad	Transfers to third countries go through adequacy decisions, standard clauses or binding corporate rules (Chapter V).	The Central Government may restrict transfers to countries it notifies (s.16(1)).
Top penalty	Up to EUR 20 million or 4% of worldwide turnover, whichever is higher (Art. 83(5)).	Up to Rs 250 crore for security safeguards (Schedule).

Same Idea or Different?

SimilarPartlyDiffers

How close the two laws are, point by point
Point	Verdict	Why
Consent as a legal ground	Similar	Both allow consent (Art. 6(1)(a), s.4(1)).
Consent standard	Partly	The DPDP Act adds the word unconditional (s.6(1)).
Proof of consent	Similar	The GDPR controller must demonstrate it (Art. 7(1)). The DPDP business must prove it (s.6(10)).
Withdrawal	Similar	Both ask that withdrawing be about as easy as giving consent (Art. 7(3), s.6(4)).
Legitimate interests	Differs	A GDPR ground (Art. 6(1)(f)). We found no matching clause in the DPDP Act.
Age of a child	Differs	GDPR default 16, lowest 13. DPDP Act under 18.
Individual rights	Differs	No portability, restriction or objection heading in ss.11 to 14.
Breach notice	Partly	72 hours appears in both, but for different steps.
Maximum penalties	Differs	GDPR: a fixed euro amount or a share of turnover, whichever is higher. DPDP Act: fixed rupee ceilings.
Paper records	Differs	The DPDP Act covers digital data, and paper data only once digitised (s.3(a)).

Verdicts are our reading of the cited provisions, not a statement in either law.

Is GDPR Compliance Enough for the DPDP Act?

No. The two laws overlap on ideas such as purpose, consent, security and breach response, but they differ on legal grounds, the age for children, the list of individual rights and the penalty ceilings. The sections below set out each difference.

Section 8(1)

The business remains responsible "irrespective of any agreement to the contrary", even when a vendor does the processing.

Legal Grounds: Six in the GDPR, Consent or Listed Uses in the DPDP Act

GDPR: six grounds

ConsentContractLegal obligationVital interestsPublic taskLegitimate interests

Art. 6(1)(a) to (f)

DPDP Act: two routes

Consent (s.6)Certain legitimate uses, nine listed (s.7)

Section 4(1)

The GDPR lets an organisation rely on any one of six grounds: consent, contract, legal obligation, vital interests, a public task, or legitimate interests (Art. 6(1)).

The DPDP Act allows personal data to be processed for a lawful purpose only on the basis of consent or for certain legitimate uses (s.4(1)). Section 7 lists them:

data the person gave voluntarily for a specified purpose, unless the person has objected;
benefits, services, licences and similar items from the State;
State functions under law, and sovereignty or security;
a legal duty to disclose information to the State;
a court judgment, decree or order;
a medical emergency;
treatment or health services during an epidemic or public health threat;
safety and help during a disaster or a breakdown of public order;
employment purposes, and protecting the employer from loss or liability.

We found no clause in the Act that lets a business process data because it has its own legitimate interest. Section 7 lists nine uses, (a) to (i).

Practice

If your GDPR records rely on legitimate interests for something like marketing or analytics, ask what the DPDP basis would be. Without one of the listed uses, the Act points to consent. This is our reading, not a rule stated in the Act.

Children: Under 18, With Parental Consent First

Under the GDPR, the default age for online services that rely on consent is 16, and Member States may set a lower age, but not below 13 (Art. 8(1)).

The DPDP Act treats anyone under 18 as a child (s.2(f)). Before processing any personal data of a child, the business must obtain the verifiable consent of the parent or lawful guardian (s.9(1)). This is not limited to online services. The Act also bars processing likely to harm a child's well-being, and bars tracking, behavioural monitoring and targeted advertising directed at children (s.9(2) and (3)).

Section 2(f)

A child is someone who "has not completed the age of eighteen years".

The DPDP Act age line sits two years above the GDPR default.

The Rules give limited exemptions for essential purposes such as healthcare, education and real-time safety, according to the government's release of 14 November 2025. Read the Rules before relying on one.

Example

A learning app lets a 16-year-old sign up on her own. Under the GDPR rule for online services, a 16-year-old can consent for herself. Under the DPDP Act she is a child, so verifiable parental consent comes first, unless a Rules exemption applies to the app.

The standards are close but not the same. The GDPR asks for consent that is freely given, specific, informed and unambiguous (Art. 4(11)). The DPDP Act adds the word unconditional and limits consent to the data needed for the stated purpose (s.6(1)).

Proof: the GDPR says the controller must be able to demonstrate consent (Art. 7(1)). The DPDP Act says the business is obliged to prove that notice was given and consent was obtained (s.6(10)).
Withdrawal: both laws ask that withdrawing be about as easy as giving consent (Art. 7(3), s.6(4)).
Consent Managers: a person may give, manage, review or withdraw consent through a Consent Manager (s.6(7)). The provision on Consent Manager registration (s.6(9)) comes into force on 13 November 2026. See our Consent Manager guide.

Individual Rights: Where the Lists Differ

FoundNot found

GDPR rights and DPDP rights side by side
Right	GDPR	DPDP Act
Access	Found Art. 15	Found Section 11
Correction	Found Art. 16, rectification	Found Section 12, correction and erasure
Erasure	Found Art. 17	Found Section 12
Restriction of processing	Found Art. 18	Not found No matching heading in ss.11 to 14
Data portability	Found Art. 20	Not found No matching heading in ss.11 to 14
Objection	Found Art. 21	Not found No matching heading in ss.11 to 14. See s.6(4) on withdrawal of consent.
Automated decisions	Found Art. 22	Not found No matching heading in ss.11 to 14
Grievance redressal	Not found No matching heading among Arts. 15 to 18 and 20 to 22	Found Section 13
Nomination	Not found No matching heading among Arts. 15 to 18 and 20 to 22	Found Section 14
Duties of the individual	Not found No matching heading among Arts. 15 to 18 and 20 to 22	Found Section 15

The government's release says Data Fiduciaries must respond to access, correction, updating and erasure requests within a maximum of 90 days.

Breach Notification: Notice First, Then a Detailed Report

The GDPR asks for notice to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware (Art. 33(1)). Individuals are told when the breach is likely to result in a high risk (Art. 34(1)).

The DPDP Act works differently. Section 8(6) requires intimation of a personal data breach to the Board and to each affected person, and it sets no risk threshold. Rule 7 splits the duty into steps:

Tell each affected person, on becoming aware, with the nature of the breach and what to do (Rule 7(1)).
Tell the Board without delay with a description of the breach, including its nature, extent, timing, location and likely impact (Rule 7(2)(a)).
Within 72 hours, or a longer period the Board allows on a written request, send the detailed information the Rule lists (Rule 7(2)(b)).

Rule 7(2)(b)

The detailed report is due "within seventy-two hours of becoming aware of the breach".

In the GDPR the 72 hours is the outer limit, where feasible, for notice to the authority. In the DPDP Rules it is the time for the detailed report to the Board. Each step follows the business becoming aware.

These duties start on 13 May 2027. See our guide on the DPDP breach notification rule.

Vendors and Processors

The DPDP Act keeps the business accountable. Section 8(1) makes the Data Fiduciary responsible for compliance irrespective of any agreement to the contrary, and that covers processing done on its behalf by a Data Processor. Section 8(2) allows a Data Processor to be engaged only under a valid contract.

Practice

Review vendor contracts with this in mind. A clause that pushes the blame onto the vendor does not move the responsibility under the Act. This is our reading, based on the words of s.8(1).

DPO, DPIA and Audit

Under the GDPR, a data protection impact assessment is needed for certain high-risk processing (Art. 35), and a data protection officer is needed in the cases listed in Art. 37.

Under the DPDP Act these duties fall on Significant Data Fiduciaries, which the Central Government may notify (s.10(1)). A Significant Data Fiduciary must appoint a Data Protection Officer (s.10(2)) and carries further duties under s.10 and the Rules. Check the Gazette for any notification before relying on this point.

Cross-Border Transfers

The GDPR provides for transfers of personal data to third countries through mechanisms such as an adequacy decision, standard data protection clauses or binding corporate rules (Chapter V).

Under the DPDP Act, the Central Government may restrict transfers to countries or territories it notifies (s.16(1)). See our guide on cross-border data transfer.

Penalties: Fixed Rupee Ceilings vs a Share of Turnover

Maximum penalties in the Schedule to s.33(1)
Breach	Penalty may extend to
Reasonable security safeguards (s.8(5))	Rs 250 crore
Notice of a personal data breach (s.8(6))	Rs 200 crore
Additional obligations for children (s.9)	Rs 200 crore
Significant Data Fiduciary obligations (s.10)	Rs 150 crore
Duties of the Data Principal (s.15)	Rs 10,000
Any other provision of the Act or the Rules	Rs 50 crore

Maximum penalties in rupees crore, from the Schedule to s.33(1). These are ceilings. The s.15 duties of the Data Principal carry up to Rs 10,000 and are not shown to scale.

The Schedule also covers a breach of a voluntary undertaking accepted by the Board. The Board imposes a penalty after an inquiry (s.33(1)). The GDPR has two tiers: up to EUR 10 million or 2% of total worldwide annual turnover, and up to EUR 20 million or 4%, in each case whichever is higher (Art. 83(4) and (5)). The DPDP amounts are fixed figures with no link to turnover.

Six Checks If You Run a GDPR Programme

Practice: these are our reading of the sections cited, not requirements stated in the Act.

1Map each use of data to consent or a listed useReplace any reliance on legitimate interests (s.4, s.7).
2Reset the age line to 18Verifiable parental consent first, and no tracking or targeted advertising aimed at children (s.9).
3Review consent wording and recordsUnconditional, limited to the stated purpose, and provable (s.6(1), s.6(10)).
4Rebuild the breach playbook around Rule 7Notice to people and the Board, plus the detailed report within 72 hours (s.8(6), Rule 7).
5Read vendor contracts againResponsibility stays with you, and a valid contract is required (s.8(1), s.8(2)).
6Adjust the rights deskKeep access, correction and erasure. Add grievance redressal and nomination (ss.11 to 14).

Common Myths, Corrected

What the texts say
Claim you may hear	What the texts say
The DPDP Act has legitimate interests as a ground.	Section 4(1) allows consent or certain legitimate uses. Section 7 lists nine uses. We found no general interest test.
The DPDP Act gives a right to data portability.	Sections 11 to 14 are headed access, correction and erasure, grievance redressal and nomination. We found no portability right there.
A child is under 16 or 13 in India.	A child is under 18 (s.2(f)).
DPDP fines are a share of turnover.	The Schedule sets fixed rupee ceilings, the highest being Rs 250 crore.
The DPDP Act covers paper records.	It covers digital data, and paper data only once digitised (s.3(a)).
The 72 hours is the only breach deadline.	Each affected person must be told on becoming aware, and the Board without delay. The 72 hours is for the detailed report (Rule 7).
The DPDP Act is fully in force.	The main duties and penalties start on 13 May 2027. Rule 4 starts on 13 November 2026.

DPDP Act vs GDPR: Frequently Asked Questions

Is the DPDP Act the same as the GDPR?

No. They share ideas such as consent, security and breach notice, but they differ on legal grounds, the age of a child, individual rights, breach reporting and penalties.

Does the DPDP Act have a legitimate interests ground?

We found none. Section 4(1) allows consent or the certain legitimate uses listed in s.7.

What counts as a child under the DPDP Act and the GDPR?

The DPDP Act treats anyone under 18 as a child (s.2(f)). The GDPR default age for consent to online services is 16, and Member States may lower it, but not below 13 (Art. 8(1)).

Does the DPDP Act give a right to data portability?

We found no such right among sections 11 to 14, which cover access, correction and erasure, grievance redressal and nomination. The GDPR has one in Art. 20.

If I comply with the GDPR, am I compliant with the DPDP Act?

No. A GDPR programme helps, but the DPDP Act has its own legal grounds, age rule, rights, breach steps and penalties that need separate checks.

How do DPDP penalties compare with GDPR fines?

The DPDP Schedule sets fixed ceilings, up to Rs 250 crore. The GDPR ceilings are up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Does the DPDP Act cover paper records?

Only data collected in digital form, or collected in non-digital form and digitised later (s.3(a)).

When do the DPDP duties start?

The main duties and penalties start on 13 May 2027. The Consent Manager provisions (s.6(9) and Rule 4) come into force on 13 November 2026.

Related sections of the Act

S.3 Application S.4 Grounds S.6 Consent S.7 Legitimate uses S.8 Obligations S.9 Children S.33 Penalties

Valid consent under Section 6 DPDP Act vs ISO 27001 DPDP compliance timeline Data Fiduciary vs Data Processor

Sources

Show sources

The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), Sections 2, 3, 4, 6, 7, 8, 9, 10, 11 to 16, 33 and the Schedule: MeitY copy (PDF) and India Code.
Commencement notification G.S.R. 843(E), 13 November 2025: MeitY (PDF).
Establishment of the Data Protection Board, G.S.R. 844(E), 13 November 2025: MeitY (PDF).
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025, Rules 1 and 7: MeitY (PDF).
Press Information Bureau, "Government notifies DPDP Rules to empower citizens and protect privacy", 14 November 2025: PIB.
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 2, 3, 4, 6 to 9, 15 to 22, 33 to 35, 37, 83 and Chapter V: EUR-Lex.

All comparisons Take the readiness assessment

This page explains the law and is not legal advice. Where a point depends on facts, take advice from a qualified lawyer. Items marked as practice are our reading and suggestions, not requirements of the Act, the Rules or the GDPR.

The DPDP Act, explained

Find your sector

Not sure where to start?

Where do you stand?

DPDP Act vs GDPR: What Changes If You Already Comply with the GDPR

Scope

Legal grounds

Children

Rights

Breach notice

Penalties

Where Things Stand on 2 November 2026

DPDP Act vs GDPR at a Glance

Same Idea or Different?

Is GDPR Compliance Enough for the DPDP Act?

Legal Grounds: Six in the GDPR, Consent or Listed Uses in the DPDP Act

GDPR: six grounds

DPDP Act: two routes

Children: Under 18, With Parental Consent First

Individual Rights: Where the Lists Differ

Breach Notification: Notice First, Then a Detailed Report

Vendors and Processors

DPO, DPIA and Audit

Cross-Border Transfers

Penalties: Fixed Rupee Ceilings vs a Share of Turnover

Six Checks If You Run a GDPR Programme

Common Myths, Corrected

DPDP Act vs GDPR: Frequently Asked Questions

Related terms

Related sections of the Act

Related pages

Sources

Talk to a DPDP consultant

Scope

Legal grounds

Children

Rights

Breach notice

Penalties

Where Things Stand on 2 November 2026

DPDP Act vs GDPR at a Glance

Same Idea or Different?

Is GDPR Compliance Enough for the DPDP Act?

Legal Grounds: Six in the GDPR, Consent or Listed Uses in the DPDP Act

GDPR: six grounds

DPDP Act: two routes

Children: Under 18, With Parental Consent First

Consent and Proof

Individual Rights: Where the Lists Differ

Breach Notification: Notice First, Then a Detailed Report

Vendors and Processors

DPO, DPIA and Audit

Cross-Border Transfers

Penalties: Fixed Rupee Ceilings vs a Share of Turnover

Six Checks If You Run a GDPR Programme

Common Myths, Corrected

DPDP Act vs GDPR: Frequently Asked Questions

Related terms, sections and pages

Related terms

Related sections of the Act

Related pages

Sources

The DPDP Action Brief