DPDP Act vs GDPR: 10 differences Indian businesses should know
Updated 20 October 2026 · 5 min read
If you have seen GDPR cookie banners or EU privacy policies, India's DPDP Act will feel familiar. But copying a GDPR setup leaves gaps. These are the differences that matter most for a small business.
| Topic | GDPR (EU) | DPDP Act (India) |
|---|---|---|
| Data covered | Digital and paper records | Digital personal data, including offline data later digitised |
| Legal bases | Six, including legitimate interests | Consent, or a short list of legitimate uses (section 7) |
| Sensitive data | Special categories with extra rules | No special categories; all personal data treated alike |
| Children | Under 16 (13 to 16 by country) | Under 18, with verifiable parental consent; no tracking or targeted ads |
| Notice | Long list of required information | Itemised data and purposes, withdrawal, rights and Board complaint (Rule 3) |
| Data Protection Officer | Required for many organisations | Only for Significant Data Fiduciaries |
| Breach reporting | To the authority within 72 hours if risky | Every breach, to the Board and each affected person; detailed report within 72 hours |
| Penalties | Up to 4% of global turnover or €20 million | Fixed maximums per breach, up to ₹250 crore |
| Transfers abroad | Adequacy decisions and safeguards | Allowed except to countries the Government restricts |
| Consent Managers | No equivalent | Registered platforms to give and manage consent |
What this means in practice
- No legitimate interests: analytics and marketing tags generally need consent in India. See cookie consent in India.
- 18 is the age: if children may use your service, plan for parental consent.
- Your notice needs Indian details: an itemised list, your grievance contact and the Data Protection Board. See what a DPDP notice must contain.
- Report every breach: there is no risk threshold before you tell people.
Starting from a GDPR setup? Run through the DPDP checklist to find the gaps.
Questions
Is the DPDP Act the same as GDPR?
No. They share ideas such as notice, consent and rights, but the DPDP Act is shorter, has no legitimate interests basis, treats all personal data alike, sets fixed maximum penalties in rupees and defines a child as anyone under 18.
If I follow GDPR, am I covered under the DPDP Act?
Partly. GDPR work helps, but you still need an itemised DPDP notice under Rule 3, a grievance process with Indian timelines, breach reports to the Data Protection Board and parental consent for everyone under 18.
Does the DPDP Act have legitimate interest like GDPR?
No. Instead of legitimate interests, section 7 lists specific legitimate uses, such as data a person gives voluntarily for a specified purpose, employment, and medical emergencies. Everything else needs consent.