If you serve customers in both the EU and India, you don’t get to pick one privacy law and extend it to the other market. GDPR and the DPDPA share a consent-based philosophy, but they diverge on legal basis, breach-notification timing, DPO requirements and enforcement — differences that show up directly in how you design consent flows and incident response.
GDPR offers six lawful bases for processing; the DPDPA recognizes consent and a narrower set of “legitimate uses” — no broad legitimate-interest ground.
GDPR sets a strict 72-hour regulator deadline. The DPDPA Rules require notification “without delay,” with Significant Data Fiduciaries facing additional reporting duties.
GDPR fines reach 4% of global turnover or €20M. The DPDPA's penalties run up to ₹250 crore (roughly $30M) per instance for significant breaches — no revenue-linked cap.
GDPR has been enforced since 2018 and most organizations serving EU customers have a mature programme built around it. The DPDPA is newer — India's Digital Personal Data Protection Act 2023 was notified in November 2025, and its operative Rules are rolling out in phases through 2026 and 2027. Companies with customers, offices or data processing in both regions can't simply extend their GDPR programme to cover India: the two laws share a consent-based philosophy, but diverge in ways that change how you design consent flows, breach response and vendor contracts.
| Dimension | GDPR (EU) | DPDPA (India) |
|---|---|---|
| Legal basis for processing | Six lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests. | Consent, plus a defined, narrower list of “legitimate uses” (e.g. voluntary disclosure by the individual, medical emergencies, employment purposes) — no broad legitimate-interest ground. |
| Consent standard | Freely given, specific, informed, unambiguous; granular and as easy to withdraw as to give. | Free, specific, informed, unconditional and unambiguous, via clear affirmative action; must be managed through a registered Consent Manager framework for many use cases. |
| Breach notification | Notify the supervisory authority within 72 hours of becoming aware, where feasible; notify affected individuals without undue delay if high risk. | Notify the Data Protection Board and affected individuals “without delay”; no fixed-hour statutory clock in the Rules as published, but the practical expectation is immediate action. |
| DPO / compliance officer | Mandatory for public authorities and organizations with large-scale or regular systematic monitoring/sensitive-data processing. | Not universal — mandatory specifically for organizations designated a Significant Data Fiduciary (SDF), who must appoint an India-based DPO. |
| Cross-border transfers | Adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules — a defined transfer-mechanism toolkit. | Transfers permitted by default except to countries the Central Government restricts by notification — a blacklist approach rather than GDPR's adequacy-first model. |
| Penalties | Up to €20 million or 4% of global annual turnover, whichever is higher, for the most serious infringements. | Up to ₹250 crore (roughly $30M) per instance for significant breaches, set by the Data Protection Board rather than as a fixed percentage of turnover. |
| Individual rights | Access, rectification, erasure, restriction, portability, objection — a broad rights catalogue. | Access, correction, erasure, grievance redressal, and the right to nominate someone to exercise rights after death or incapacity — narrower than GDPR's set, with no explicit portability right. |
If you've already built a GDPR programme, a meaningful share of that work transfers directly: data mapping, DPIA-style impact assessments, breach response procedures and vendor due diligence are the same operational muscle under either law. What doesn't transfer automatically is the legal-basis logic — a GDPR programme that leans on legitimate interest for marketing or analytics has to be re-examined for India, where that basis doesn't exist in the same form. The DPDPA's narrower “legitimate uses” list means more processing activities need to route through consent than your EU programme may currently assume.
For companies building or extending a programme to cover both: start from your GDPR data map and consent inventory, since that groundwork is reusable. Then run every processing activity currently justified under “legitimate interest” through the DPDPA's narrower lawful-basis list and convert what doesn't fit into consent-based flows. Separately assess SDF exposure — if there's a realistic chance of designation, start the DPO and audit conversations early, since they take longer to stand up than the remaining compliance runway typically suggests.
No. A GDPR programme gives you reusable groundwork — data mapping, breach procedures, DPIA practice — but the DPDPA's legal-basis structure is narrower than GDPR's, and its consent-notice and Consent Manager requirements are more prescriptive. Processing activities justified under GDPR's ‘legitimate interest’ ground often need to be re-routed through consent under the DPDPA.
Not universally. GDPR mandates a DPO for public authorities and organizations doing large-scale or systematic monitoring or sensitive-data processing. The DPDPA's DPO requirement is narrower — it applies specifically to organizations the government designates as a Significant Data Fiduciary, who must appoint an India-based DPO.
They're structured differently rather than directly comparable. GDPR caps fines at the higher of €20 million or 4% of global annual turnover, tying penalties to company size. The DPDPA's penalties, up to ₹250 crore (roughly $30M) per instance for significant breaches, are set by the Data Protection Board without a fixed percentage-of-turnover formula.