Multinational corporations operating in India frequently assume that their European Union General Data Protection Regulation (GDPR) compliance posture automatically satisfies the DPDP Act. While both laws share privacy principles, the DPDP Act features crucial distinct requirements regarding legal bases, Consent Managers, breach reporting windows, and minors.
1. Executive Comparison Table
| Dimension | India DPDP Act 2023 / Rules 2025 | EU GDPR |
|---|---|---|
| Grounds for Processing | Strict: Consent or limited Certain Legitimate Uses (Section 7). No broad "Legitimate Interest" ground. | 6 Lawful Grounds: Consent, Contract, Legal Obligation, Vital Interests, Public Task, Legitimate Interests. |
| Consent Architecture | Recognizes statutory Consent Managers (Schedule I) with 7-year audit trails. | No statutory intermediary; controllers manage consent directly. |
| Breach Reporting Window | Notify Board & users without delay; comprehensive report within 72 hours (Rule 7). | Notify supervisory authority within 72 hours; users only if high risk. |
| Definition of a Child | Strictly defined as anyone under 18 years of age (Section 2(f)). | Ages 13 to 16 depending on Member State law. |
| Children's Data Processing | Mandatory verifiable parental consent; absolute ban on tracking, profiling, or targeted ads. | Parental consent required for information society services; profiling restricted but not completely banned. |
| Maximum Financial Penalty | Absolute cap: Up to ₹250 Crore (~$30M USD) per breach. | Up to €20 Million or 4% of global annual turnover, whichever is higher. |
| Data Portability | Omitted from the DPDP Act to reduce compliance burden on domestic startups. | Explicitly granted under Article 20. |
| Right to be Forgotten | Addressed as Right to Erasure (Section 12) upon consent withdrawal or purpose fulfillment. | Detailed Right to Erasure / RTBF under Article 17. |
2. The "Legitimate Interest" Trap
The single greatest operational trap for GDPR-compliant companies is relying on "Legitimate Interests" (Article 6(1)(f) of GDPR) for marketing, analytics, or user telemetry. The DPDP Act does not recognize commercial legitimate interest. In India, user analytics and commercial data collection require explicit, unbundled affirmative consent under Section 6.
3. Cross-Border Data Transfers (Section 16)
Unlike GDPR's restrictive Adequacy Decisions, Standard Contractual Clauses (SCCs), and Binding Corporate Rules (BCRs), the DPDP Act adopts a "Blacklist" (Negative List) approach. Data may flow freely to foreign territories unless specifically restricted or blacklisted by the Central Government.