The DPDP Act and the EU’s GDPR both protect personal data, but the DPDP Act is narrower and simpler: it covers digital personal data, has no “special categories”, uses fixed rupee penalty caps instead of a percentage of turnover, sets 18 as the age of a child, and does not include a right to data portability.
- Both require notice, consent or another lawful ground, and breach notification.
- DPDP penalty caps are fixed amounts in rupees; GDPR fines scale with turnover.
- Compliance with one does not automatically mean compliance with the other.
The differences at a glance
| Topic | DPDP Act, 2023 | GDPR |
|---|---|---|
| Scope | Digital personal data, including non-digital data that is digitised | Personal data in electronic form and in structured filing systems |
| Special categories | No separate category, though sensitivity matters for Significant Data Fiduciaries | Special categories such as health and biometric data have stricter rules |
| Grounds for processing | Consent, or listed “legitimate uses” | Six legal bases, including legitimate interests and contract |
| Roles | Data Fiduciary, Data Processor, Data Principal | Controller, processor, data subject |
| Children | Under 18; verifiable parental consent with exemptions | Age of digital consent set between 13 and 16 by each member state |
| Individual rights | Access, correction and erasure, grievance, nomination | Also portability, restriction and objection |
| Penalties | Fixed caps, up to ₹250 crore | Up to €20 million or 4% of worldwide turnover, whichever is higher |
| Breach notification | Board and affected individuals; detailed report within 72 hours | Authority within 72 hours; individuals where high risk |
| Regulator | Data Protection Board of India | National data protection authorities |
What this means for an Indian business
- If you already comply with the GDPR, you have a head start, but you cannot assume you are covered.
- DPDP’s focus on notice, consent and security will feel familiar, but Indian-specific details apply, such as notices in Eighth Schedule languages.
- If you serve customers in both India and the EU, plan for both laws.
Where DPDP is simpler, and where it is not
The Act is shorter and lacks some GDPR concepts. But the rupee penalty caps are high in absolute terms, the age threshold for children is higher, and many practical rules are in the Rules, which are still being phased in. Simpler does not mean lighter, so check the official text.
The Act and Rules come into force in phases. Under the 13 November 2025 notifications, the provisions that set up the Data Protection Board took effect on publication, consent-manager registration (Rule 4) follows after one year (around 13 November 2026), and most substantive duties for businesses are scheduled for eighteen months after publication, which is 13 May 2027. In January 2026 MeitY discussed shortening the 18-month period for some obligations. In the sources we checked on 3 November 2026 we found no notification doing so, but dates can change, so confirm against the Gazette before relying on one.
Frequently asked questions
Is the DPDP Act based on the GDPR?
It is influenced by global privacy laws, but it has its own structure and terms. Do not assume GDPR practices fit without checking the DPDP text.
Does DPDP have a right to data portability?
Not as a separate right in the Act. Individuals have the rights listed in sections 11 to 14.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- EUR-Lex: General Data Protection Regulation (EU) 2016/679
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.