GDPR vs DPDP
The two laws share most ideas but differ in places that change the design. This page puts them side by side and gives one design that satisfies both. As of October 2026; details and sources are on GDPR and India DPDP Act.
How it works
The safe default for a product used in both places: consent for anything that is not strictly necessary, default off, itemised, easy to withdraw. That meets DPDP's consent-first model and GDPR's consent standard at the same time.
Side by side
| Topic | GDPR | DPDP Act and Rules | One design for both |
|---|---|---|---|
| Scope | Personal data, any form, if EU establishment or targeting/monitoring EU people | Digital personal data processed in India, or linked to offering goods or services to people in India | Treat all personal data the same |
| Roles | Controller, processor | Data Fiduciary, Data Processor | Record "controller/fiduciary" once per activity |
| Grounds | Six lawful bases, including legitimate interests | Consent or a short list of legitimate uses. No legitimate interests | Consent unless strictly necessary or legally required |
| Consent standard | Freely given, specific, informed, unambiguous, affirmative | Free, specific, informed, unconditional, unambiguous, affirmative, limited to necessary data | Unticked, unbundled, one purpose per choice |
| Withdrawal | As easy as giving | As easy as giving | One switch; signed link for no-account cases |
| Notice | Art. 13/14 content | Itemised notice; English or an Eighth Schedule language | Itemised notice; translate where you have users |
| Special category data | Extra protection, Art. 9 conditions | No separate category | Explicit consent for religion, health, sexuality, biometrics |
| Children | Under 16 for online consent (13-16 by country) | Under 18; verifiable parental consent; no tracking or targeted ads | Strictest age per market; no tracking or targeted ads under 18 |
| Rights | Access, rectification, erasure, restriction, portability, objection, automated decisions | Access (summary), correction and erasure, grievance, nominate | Build all GDPR rights plus grievance and nominee |
| Response time | One month, plus two with reasons | Grievance period published, max 90 days | 30 days for everything |
| Breach to regulator | 72 hours if risk | Every breach: without delay, detailed report in 72 hours | Notify every breach to the Board; assess risk for the EU |
| Breach to people | If high risk | Every affected person, without delay | Template ready; decide per law |
| Records | RoPA (Art. 30) | No RoPA by name; SDFs do DPIAs and audits | Keep a RoPA anyway |
| DPIA | For high-risk processing | Yearly for SDFs | DPIA for any high-risk activity |
| DPO | When required by scale or type | SDFs: DPO based in India; others publish a contact | Name a DPO and a published contact |
| Transfers | Adequacy, SCCs, derogations | Allowed unless the government restricts a country | Record a transfer basis per flow; watch both lists |
| Log retention | Storage limitation applies | At least one year of logs for security | One year for security logs, then delete |
| Consent managers | None | Registered intermediaries | Keep the consent API generic enough to accept one |
| Regulator | National supervisory authority; EDPB | Data Protection Board of India | |
| Max fine | EUR 20m or 4% of turnover | INR 250 crore per breach type | |
| In force | Since 25 May 2018 | Most duties from about 13 May 2027 | Build now |
Where they pull in different directions
| Tension | Resolution |
|---|---|
| GDPR allows legitimate interests for crash reporting or fraud; DPDP does not | Use a DPDP legitimate use if one fits, otherwise ask. Crash reporting is often disclosed and switchable |
| DPDP child is under 18; a global floor of 13 is common | India accounts for under-18s need verifiable parental consent, or a documented risk decision |
| DPDP notifies every breach; GDPR only risky ones | Report every breach in India; keep the GDPR risk assessment |
| GDPR portability; DPDP has no portability | Build export once; it serves GDPR access and portability and DPDP access |
Rules
Rule
Store both bases on every processing activity: gdpr_lawful_basis and dpdp_basis. Two
registers drift apart; one row with two columns does not.
Rule
When in doubt, apply the stricter rule globally. Region-specific behaviour adds a failure mode (wrong region detection) for a small gain.
Mistakes we made
- Country detection was a language setting. Users were placed in a region from device locale. An EU resident with an English-India locale was recorded in the wrong home region, which is inaccurate personal data. Keep region-specific privacy behaviour to a minimum, and build a way to correct the region.
- Unknown countries fell through silently. A country code with no mapping went to the default region with no log. Log every fall-through, and default to the strictest region, not the nearest.
Checklist
- Every activity has both bases recorded.
- Consent is the default for anything not strictly necessary.
- Age floors use the strictest rule per market.
- Breach runbook covers both regulators.
- One 30-day DSR target.