GDPR vs DPDP Act: key differences for teams under both

The short version

Both laws give people rights over their personal data and put duties on the organisations that use it. The General Data Protection Regulation has applied across the EU since 25 May 2018. India's Digital Personal Data Protection Act was passed in 2023, and the DPDP Rules, 2025 were notified in November 2025. The Rules apply in phases, with most remaining obligations applying around May 2027.

Scope: all personal data against digital personal data

GDPR applies to personal data processed by automated means and to paper records that form part of a filing system. The DPDP Act applies to personal data collected in digital form, or collected offline and digitised later. Both reach outside their borders: GDPR when you offer goods or services to people in the EU or monitor their behaviour, the DPDP Act when processing outside India is connected with offering goods or services to people in India.

Lawful grounds: consent carries more weight in India

This is the difference that changes the most work. GDPR gives six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The DPDP Act allows processing with consent, given after a clear notice, or for certain legitimate uses that the Act lists, such as a purpose for which the person voluntarily provided their data, employment, legal obligations and medical emergencies. There is no general legitimate interests ground, so processing that relies on it under GDPR needs a new footing in India.

Consent under both laws must be free, specific, informed and unambiguous, and as easy to withdraw as to give. The DPDP Act adds Consent Managers: registered entities through which a person can give, manage, review and withdraw consent.

Rights of individuals

GDPR sets out eight rights, including access, rectification, erasure, restriction, portability and objection. The DPDP Act gives rights to access information about processing, to correction and erasure, to grievance redressal, and to nominate another person to exercise those rights in the event of death or incapacity. It has no right to data portability and no general right to object.

Breach reporting and children's data

GDPR asks controllers to notify the supervisory authority within 72 hours unless the breach is unlikely to result in a risk to people, and to tell individuals when the risk is high. The DPDP Act has no risk threshold: every personal data breach is reported to the Data Protection Board and to each affected Data Principal.

The DPDP Act treats anyone under 18 as a child. Processing a child's data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and advertising targeted at children are not allowed. GDPR sets the age for consent to online services at 16, which member states may lower to 13.

Extra duties for Significant Data Fiduciaries

The Indian government can notify a Data Fiduciary as significant, based on factors such as the volume and sensitivity of the data it handles. A Significant Data Fiduciary must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. GDPR has no matching category; it requires a DPO and impact assessments by type of processing.

We already comply with GDPR. What is left for the DPDP Act?

This article is general information, not legal advice. Check the Act, the Rules and current government notifications before relying on any point.