Both laws protect personal data, but they are different laws. Being GDPR-ready helps, but it does not make you DPDP-ready.
| Topic | DPDP Act (India) | GDPR (EU) |
|---|---|---|
| Grounds | Consent or listed 'legitimate uses'. | Six lawful bases incl. contract and legitimate interests. |
| Sensitive data tier | No separate special category in the Act's text. | Special categories with stricter rules. |
| Scope | Digital personal data (and digitised). | Personal data in any form, incl. structured paper filing. |
| Children | Under 18; verifiable parental consent; bans on tracking/targeted ads, with exemptions. | Age of digital consent 13-16 depending on member state. |
| Transfers | Permitted except to restricted countries notified by Government. | Adequacy, SCCs and other safeguards. |
| Regulator | Data Protection Board of India. | Supervisory authorities per member state. |
| Rights | Information, correction/erasure, grievance redressal, nomination. | Wider set incl. portability and objection to automated decisions. |
Do not copy GDPR documents into an Indian programme. Map each activity to the Indian grounds, notice content, timelines and Board process.
Frequently asked questions
If I'm GDPR-compliant, am I DPDP-compliant?+
No. Many practices carry over, but the grounds, definitions, timelines, children's rules and regulator differ.
Relevant provisions
- Section 7Legitimate uses (alternative to consent)
- Section 9Rule 10 · pending verificationChildren's personal data
- Section 16Rule 15 · pending verificationCross-border transfer
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.