DPDP vs GDPR — key differences every Indian company needs to know
Many Indian companies with global operations are already GDPR-compliant. Here is what GDPR compliance does and does not cover for DPDP.
How do GDPR and DPDP compare on lawful bases?
GDPR offers six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. The legitimate interests basis under GDPR is broad and has been used extensively for marketing, analytics, and commercial data uses. DPDP offers consent plus specific legitimate uses — State functions, legal obligations, employment, vital interests — with no general legitimate interests equivalent. This means GDPR-compliant processing that relies on legitimate interests needs to find a different basis under DPDP — usually consent. Audit your GDPR legitimate interests assessments and identify what needs consent under DPDP.
How do GDPR and DPDP compare on data subject and data principal rights?
GDPR rights: access, rectification, erasure, restriction of processing, data portability, right to object, rights related to automated decision-making. DPDP rights: access, correction and erasure, grievance redressal, nomination, consent withdrawal. DPDP does not include data portability, the right to restrict processing, a general right to object, or explicit automated decision-making rights. GDPR-compliant rights mechanisms are broader than DPDP requires — if you are handling GDPR requests, you are likely already meeting DPDP rights requirements (and more).
How do GDPR and DPDP compare on DPO requirements?
GDPR: DPO required when processing is on a large scale, involves systematic monitoring, or involves special category data — applies regardless of company size or SDF designation. DPDP: DPO required only for Significant Data Fiduciaries (an SDF list to be published by government). Many companies required to have a DPO under GDPR are not SDFs under DPDP — and vice versa, some Indian companies that will be designated SDFs may not have EU operations requiring a GDPR DPO. The DPO requirements are independent and must be assessed separately.
How do GDPR and DPDP compare on penalties?
GDPR penalties: up to €20 million or 4% of global annual turnover, whichever is higher — for the most serious violations. DPDP penalties: up to ₹250 crore per violation (approximately €27 million) — fixed ceiling, not turnover-based. For a small Indian company, DPDP's ceiling is proportionately very large. For a large global company, GDPR's turnover-based penalty can be vastly higher. The enforcement mechanism also differs: GDPR enforcement is by EU member state Data Protection Authorities; DPDP enforcement is by the Data Protection Board of India.
How do GDPR and DPDP compare on breach notification?
GDPR: notify the supervisory authority within 72 hours if there is a risk to individuals; notify individuals if there is a high risk to them. DPDP: notify the Data Protection Board within the prescribed period (working assumption: 72 hours based on Rules drafts); notify affected data principals as directed by the Board. Both require breach notification, and both have a 72-hour working assumption — but under DPDP the Board decides when to notify individuals (it may direct the Fiduciary to notify). Under GDPR, the Fiduciary decides whether to notify individuals. Build breach response plans that cover both regimes simultaneously.
What does GDPR compliance mean for DPDP readiness?
A GDPR-compliant programme provides: a good privacy notice structure (adapt for DPDP-specific content); a functioning consent management system (needs review for DPDP's specific validity requirements); a working data subject rights mechanism (covers DPDP rights plus more); a breach response plan (adapt timelines and notification paths for DPDP); vendor DPAs with EU processors (supplement with DPDP-specific clauses); and a data processing inventory (also needed for DPDP). GDPR compliance reduces the DPDP compliance build — but you need a DPDP-specific gap analysis to identify what needs updating.
Frequently asked questions
If we already have GDPR Standard Contractual Clauses for transfers, are we compliant with DPDP cross-border transfer rules?
GDPR SCCs govern transfers from the EU under GDPR — they do not automatically satisfy DPDP's cross-border transfer requirements. DPDP will use an approved country list (not yet published). Until the list is published, the existing SPDI Rules framework applies. Once the list is published, transfers to approved countries are permitted without additional mechanisms. GDPR SCCs are a useful template for the security and purpose limitation provisions of data transfer agreements, but they are a different legal mechanism from DPDP's country list approach.
Does GDPR adequacy status affect DPDP for India?
India does not currently have GDPR adequacy status from the EU — meaning EU-to-India transfers require SCCs or BCRs under GDPR. The DPDP Act's passage may eventually lead India to seek GDPR adequacy, which would simplify EU-India data transfers for Indian companies. This is a long-term diplomatic and legislative process. For now, Indian companies receiving EU personal data still need GDPR-compliant transfer mechanisms; the DPDP Act's existence does not automatically change this.
Which law should take priority if GDPR and DPDP conflict?
When processing data subject to both GDPR (EU personal data processed in India) and DPDP (Indian personal data), apply the more stringent requirement for each obligation. For consent validity: GDPR's requirements and DPDP's requirements are broadly similar — meet both. For lawful bases: DPDP's are narrower — if consent is needed under DPDP, use consent regardless of whether a GDPR legitimate interest would have sufficed. For rights: honour all rights under both laws. This dual compliance approach is operationally more complex but avoids gaps under either regime.
Close your GDPR-to-DPDP compliance gap
Niti Bharat's DPDP Gap Analysis for GDPR-compliant companies maps your existing programme against DPDP requirements — identifying the specific changes needed for Indian compliance without rebuilding your entire privacy programme.
Start DPDP Gap Analysis