DPDP Act vs GDPR: 5 Key Differences for MNCs Operating in India

Two Frameworks. Different Architectures.

The DPDP Act 2023 and the EU’s General Data Protection Regulation (GDPR) both protect personal data, and a GDPR programme gives an Indian rollout a head start. It does not carry over intact. The Indian law is narrower in some places (fewer rights, no special categories), stricter in others (children up to 18, breach notice with no risk threshold), and has features the GDPR lacks entirely: duties on the individual, registered Consent Managers, and a language option across 22 scheduled languages.

Timing differs too. The GDPR has applied since 25 May 2018. The DPDP Act’s obligations on Data Fiduciaries take effect on 13 May 2027, and the Consent Manager provisions on 13 November 2026.

Scope and Applicability

Dimension	GDPR	DPDP Act
Territorial reach	Processing in the context of an EU establishment, and offering goods or services to, or monitoring, people in the EU (Article 3)	Processing in India, and processing abroad connected with offering goods or services to people in India (Section 3(a), (b))
Data format	Automated processing and manual filing systems (Article 2(1))	Digital personal data, including data collected on paper and digitised later (Section 3(a))
Excluded	Purely personal or household activity	Personal or domestic purposes, and data the Data Principal herself made public or that another person is legally obliged to publish (Section 3(c))
Size threshold	None	None in the Act; Section 17(3) lets the Central Government exempt notified classes, including startups, from Sections 5, 8(3), 8(7), 10 and 11
Special categories	Yes (health, biometrics and others, Article 9)	None; the Act has a single class of personal data

Two consequences for an Indian rollout. Paper records stay outside the Act only until someone scans them. And the absence of special categories does not lighten the load: children’s data and Significant Data Fiduciary status carry the extra obligations instead.

Lawful Bases for Processing

The GDPR offers six lawful bases in Article 6: consent, contract, legal obligation, vital interests, public task and legitimate interests. Multinationals run most routine processing on contract and legitimate interests.

The DPDP Act offers two. Section 4 permits processing on consent under Section 6, or on one of the nine “certain legitimate uses” in Section 7. The list is closed:

• Data the Data Principal provided voluntarily for a specified purpose, without objecting (Section 7(a))
• State subsidies, benefits, services, certificates and licences, and State functions under law (Section 7(b), (c))
• Disclosure required by law, and compliance with a judgment or order (Section 7(d), (e))
• Medical emergencies, epidemics, and disasters or breakdowns of public order (Section 7(f), (g), (h))
• Employment purposes (Section 7(i))

There is no contract basis and no legitimate interests basis. Processing that a GDPR programme justifies on either needs a consent, or a fit under Section 7(a) or 7(i), in India.

Consent and Children

Requirement	GDPR	DPDP Act
Standard	Freely given, specific, informed, unambiguous (Article 4(11))	Free, specific, informed, unconditional and unambiguous, by a clear affirmative action (Section 6(1))
Over-collection	Data minimisation principle (Article 5(1)(c))	Consent covers only data necessary for the specified purpose, and any part that infringes the law is invalid (Section 6(1), (2))
Withdrawal	As easy as giving (Article 7(3))	Ease comparable to giving (Section 6(4)); processing stops within a reasonable time (Section 6(6))
Language	Not prescribed	Notice and request readable in English or any Eighth Schedule language, at the Data Principal’s option (Sections 5(3), 6(3))
Intermediaries	None	Data Principals may act through a registered Consent Manager (Sections 6(7), 6(9)); registration mandatory from 13 November 2026
Children	Parental consent below 13 to 16, set by each member state (Article 8)	Verifiable parental consent below 18 (Section 9(1)); no tracking, behavioural monitoring or targeted advertising directed at children (Section 9(3))

The children’s rule is the largest operational change for consumer businesses. A platform that treats 16 and 17 year olds as adults in Europe needs verifiable parental consent for them in India, and, unless a Section 9(4) exemption covers it, loses targeted advertising to them altogether.

Rights, and Duties

Right	GDPR	DPDP Act
Access	Yes (Article 15)	Summary of data and processing (Section 11)
Correction and erasure	Yes (Articles 16, 17)	Yes (Section 12)
Portability, restriction, objection	Yes (Articles 18, 20, 21)	No
Automated decisions	Yes (Article 22)	No
Nomination on death or incapacity	No	Yes (Section 14)
Grievance	Complaint to a supervisory authority	To the Data Fiduciary first, then the Board (Section 13(3))
Duties on the individual	None	Yes: no impersonation, no suppressed information, no false or frivolous complaints, penalty up to ₹10,000 (Sections 15, 33)

The Indian rights list is shorter. The duties column has no European counterpart.

Retention

The GDPR sets a storage limitation principle and no minimum period. The DPDP Act adds two Indian rules. From 13 May 2027, Rule 8(3) of the DPDP Rules 2025 requires personal data, traffic data and processing logs to be kept for at least one year from the date of processing. And Rule 8 with the Third Schedule requires large e-commerce, online gaming and social media platforms to erase data three years after the user last engaged, with 48 hours’ notice first. A European schedule that deletes processing logs at 90 days would fall below the Rule 8(3) floor once it applies on 13 May 2027.

Penalties and Enforcement

Dimension	GDPR	DPDP Act
Ceiling	€10 million or 2%, or €20 million or 4%, of worldwide turnover, whichever is higher (Article 83)	A fixed ceiling for each obligation breached: ₹250 crore for security safeguards, ₹200 crore for breach notification or children’s data, ₹150 crore for Significant Data Fiduciary duties, ₹50 crore for most other breaches, ₹10,000 for Data Principal duties (Schedule)
Scales with size	Yes	No
Enforcer	National supervisory authorities, under the GDPR since 25 May 2018	The Data Protection Board of India, after an inquiry (Section 33); no Chairperson or Members notified as of 13 October 2026

For detailed coverage, see DPDP penalties and enforcement.

Cross-Border Transfers

The GDPR restricts transfers by default and opens them through adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules or derogations (Chapter V).

The DPDP Act permits transfers by default and lets the Central Government restrict named countries by notification (Section 16(1)). No country has been restricted as of October 2026. Two Indian qualifications apply. Section 16(2) keeps any stricter sectoral law in force, so a sector rule on where data must stay still binds. And Rule 15 subjects transfers to any requirement the Central Government sets on making data available to a foreign State. The cross-border transfer framework covers both.

Data Protection Officer

Aspect	GDPR	DPDP Act
Who must appoint	Public bodies and controllers whose core activities involve large-scale monitoring or special categories (Article 37)	Significant Data Fiduciaries only (Section 10(2)(a))
Location	No residence rule	Based in India
Reports to	Highest management, independent (Article 38)	The Board of Directors or similar governing body; point of contact for the grievance redressal mechanism
Everyone else	No DPO duty; contact details go in the Article 13 notice	Publish the business contact of a person who can answer questions about processing (Section 8(9))

Breach Notification

The GDPR requires notice to the supervisory authority within 72 hours where feasible, unless the breach is unlikely to result in a risk, and to individuals only where the risk is high (Articles 33, 34). Section 8(6) of the DPDP Act has no threshold: every personal data breach goes to the Board and to each affected Data Principal. Rule 7 sets an intimation without delay and a detailed report to the Board within 72 hours. A European triage step that screens out low-risk breaches has no equivalent in India.

What This Means for Global Companies

1. Map every GDPR legitimate-interests and contract processing to consent or Section 7. Nothing carries across by default.
2. Raise the children’s threshold to 18 and turn off targeted advertising and behavioural monitoring for under-18 users in India.
3. Rebuild breach triage so every incident reaches the Board and the affected individuals.
4. Set a one-year floor on processing logs in the Indian retention schedule.
5. Offer notices in English and the scheduled languages your users read, with the rest on request.
6. Run an India-specific baseline. The free DPDP Gap Assessment scores the Indian obligations directly.

Sources: DPDP Act 2023, Sections 3 to 17, 33 and the Schedule; DPDP Rules 2025, Rules 7, 8, 15 and the Third Schedule; Regulation (EU) 2016/679 (GDPR), Articles 2 to 9, 15 to 22, 33, 34, 37, 38, 83 and Chapter V.