Read the two instruments, not a summary
Assess which assets from your existing GDPR programme can be reused; several DPDPA mechanics differ. This article compares the two instruments and cites the provision for each statement so you can check it against the text.
The DPDPA is the Digital Personal Data Protection Act, 2023. The GDPR is Regulation (EU) 2016/679.
Difference 1: Consent-first, with no general legitimate-interests basis
GDPR Article 6(1) lists six lawful bases for processing, including legitimate interests in Article 6(1)(f). The DPDPA permits processing on the basis of consent or certain legitimate uses (DPDPA sections 4–7); it does not provide a general legitimate-interest basis equivalent to GDPR Article 6(1)(f).
Every processing activity your GDPR ROPA justifies under legitimate interests needs to be re-examined for India: check whether the Act applies to it at all (sections 3 and 17), whether it fits a legitimate use (section 7) or needs consent (section 6), and what notice it requires (section 5). Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (DPDPA section 6(1)), and withdrawal must be as easy as giving consent (DPDPA section 6(4)).
Difference 2: Notice languages
GDPR Article 12 requires information to be provided in a concise, transparent, intelligible and easily accessible form. DPDPA section 5(3) requires the notice to be available in English or any language specified in the Eighth Schedule of the Constitution.
One implementation consideration: this may call for translation, a review workflow for legal accuracy in each language, and version control so you can show which notice version — in which language — a given consent was collected against.
Difference 3: Consent Managers
The DPDPA provides for registered Consent Managers: a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (DPDPA section 2(g)). Section 6(7) allows a Data Principal to give, manage, review or withdraw consent through a Consent Manager.
Difference 4: Breach notification with no risk threshold — and a second duty
GDPR Article 33 requires notification to the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of the breach, with reasons for any delay (Article 33(1)), unless the breach is unlikely to result in a risk to rights and freedoms. DPDPA section 8(6) requires notification of a personal data breach to the Data Protection Board and to affected Data Principals in the prescribed manner; the section states no equivalent risk threshold.
India adds a separate duty: direction (ii) of the CERT-In Directions dated 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, requires the covered entities to report the listed cyber incidents to CERT-In within six hours of noticing them. One personal-data breach can trigger both workstreams — DPDPA section 8(6) and direction (ii) — with different recipients and content. Your incident runbook needs both tracks.
Difference 5: The SDF tier
The GDPR sets controller obligations, with additional requirements for certain processing (for example, Article 35 DPIAs). The DPDPA creates an explicit designation: the Significant Data Fiduciary, designated under DPDPA section 10 based on factors the Act sets out. SDFs carry duties that other Data Fiduciaries do not:
- A Data Protection Officer based in India.
- Periodic Data Protection Impact Assessments.
- Independent audits.
A DPO based outside India does not satisfy the DPDPA's India-based requirement (DPDPA section 10).
Difference 6: Penalties in rupees, not percentages
GDPR Article 83 sets fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements. The DPDPA Schedule sets fixed rupee amounts by category, including up to ₹250 crore for failure to take reasonable security safeguards.
Read the DPDPA Schedule itself for the full set of categories and amounts; it is the authority.
Difference 7: Children's data
GDPR Article 8 sets conditions for a child's consent, including parental authorisation where the child is below the applicable age. DPDPA section 9 requires verifiable parental consent before processing a child's personal data and prohibits behavioural advertising directed at children.
For consumer apps, that is an engineering item: your ad stack, analytics SDKs and personalisation logic need a documented answer to how you know a user is not a child and what you switch off if they are.
What to assess for reuse from your GDPR programme
Assess whether these existing assets can be reused:
- Data mapping discipline. Assess whether your existing data-mapping method can be reused; the lawful-basis column needs rework against DPDPA sections 4–7.
- Request operations. Assess whether your request-handling process can support the DPDPA's own rights and grievance provisions (sections 11–14).
- DPIA experience. Assess whether your GDPR Article 35 DPIA experience can support the DPDPA Significant Data Fiduciary DPIA duty (section 10).
- Security controls. Assess whether your ISO/IEC 27001 or SOC 2 controls can support the DPDPA section 8(5) safeguards; the work is mapping and evidencing.
- Privacy awareness. Assess whether existing staff training can be reused; add India-specific obligations.
Side-by-side summary
| Dimension | GDPR | DPDPA |
|---|---|---|
| Lawful basis | Six bases, including legitimate interests (Article 6(1)) | Consent or defined legitimate uses; no general legitimate-interest basis (sections 4–7) |
| Notice languages | Intelligible and accessible (Article 12) | English or any Eighth Schedule language (section 5(3)) |
| Consent infrastructure | Not addressed in this comparison | Registered Consent Managers (sections 2(g), 6(7)) |
| Breach notification | Notification without undue delay and, where feasible, within 72 hours after becoming aware of the breach, with reasons for any delay (Article 33(1)); risk-based threshold | To the Board and Data Principals, no risk threshold in section 8(6); CERT-In duty under direction (ii) of the 28 April 2022 Directions runs in parallel |
| Enhanced-obligation tier | Additional requirements for certain processing (e.g. Article 35) | Significant Data Fiduciary: India-based DPO, DPIAs and independent audits (section 10) |
| Penalties | Up to €20m or 4% of global turnover (Article 83) | Rupee amounts by category in the DPDPA Schedule, including up to ₹250 crore for security-safeguard failure |
| Children's data | Parental consent conditions (Article 8) | Verifiable parental consent; no behavioural advertising to children (section 9) |
The sequencing for GDPR-mature companies
Re-base your lawful-basis register first. Then review consent flows against DPDPA section 6 and the notice against section 5. Review Consent Manager handling against sections 2(g) and 6(7), decide a defensible position for legacy data, and build the dual breach-notification tracks. Treat the India programme as its own operating programme, with local ownership and engineering capacity.
On tooling: DPDPA is one of the 30 standards Compliance Enablers runs as a guided programme, and the DPDPA framework record page on the new pattern is rolling out this month, on top of the privacy, incident, document, training and audit modules included in every plan.
Where to go from here
Start with the DPDPA framework guide for the platform's DPDPA programme overview, or book a demo and bring your GDPR ROPA.
This is general information, not legal advice.