The DPDP Act is narrower than the GDPR in some ways and stricter in others. It covers only digital personal data, has no special category of sensitive data, and has no 'legitimate interests' ground, only a fixed list of legitimate uses. It requires every breach to be reported, treats everyone under 18 as a child, and sets fixed penalties up to ₹250 crore instead of a percentage of turnover.
- Legitimate interests
- Not available under DPDP
- Child age
- 18 (GDPR: 16 by default)
- Breach reporting
- All breaches (GDPR: risk-based)
- Fines
- Fixed caps (GDPR: up to 4% of turnover)
| Topic | DPDP Act (India) | GDPR (EU) |
|---|---|---|
| Scope | Digital personal data, or offline data later digitised | Automated processing and structured filing systems, including paper |
| Lawful grounds | Consent or listed legitimate uses (Section 7) | Six grounds, including legitimate interests and contract |
| Sensitive data | No separate category | Special categories with stricter rules |
| Children | Under 18; verifiable parental consent | Under 16 by default (member states may set 13–16) |
| Notice | Short standalone notice, in English or Eighth Schedule languages | Detailed information under Articles 13–14 |
| Breach reporting | Every breach, to the Board and to individuals; details within 72 hours | To the authority within 72 hours if there is a risk; to individuals if high risk |
| Data portability | No | Yes |
| Right to nominate | Yes, someone to act after death or incapacity | No equivalent |
| DPO | Only for Significant Data Fiduciaries | For public bodies and large-scale or sensitive processing |
| Cross-border transfers | Allowed except to countries the government restricts | Only with adequacy, safeguards such as SCCs, or derogations |
| Penalties | Fixed caps per breach, up to ₹250 crore | Up to €20 million or 4% of global turnover |
| Compensation to individuals | Not provided | Yes, under Article 82 |
| Publicly available data | Excluded if made public by the individual | Still covered |
What GDPR-ready companies still need to change
- Replace 'legitimate interests' processing with consent or a Section 7 legitimate use.
- Lower the age-gate assumptions: under-18s are children.
- Report every breach, not only risky ones.
- Offer the notice in Indian languages on request and add a link to complain to the Data Protection Board.
- Add the right to nominate.
Frequently asked questions
If I comply with GDPR, am I compliant with the DPDP Act?
Not fully. GDPR programmes cover much of the groundwork (data mapping, security, processor contracts), but the DPDP Act differs on lawful grounds, children's age, breach reporting and notice language.
Does the DPDP Act have 'legitimate interest'?
No. Instead, Section 7 lists specific 'legitimate uses' such as employment, legal obligations, emergencies and data voluntarily provided for a specified purpose.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.