This is a simplified comparison for orientation only. Both laws have exceptions and details not shown here. GDPR references are to Regulation (EU) 2016/679.
Side by side
| Topic | DPDP Act and Rules | GDPR |
|---|---|---|
| Scope | Digital personal data, and non-digital data that is later digitised (section 3). | All personal data processed wholly or partly by automated means, or in a filing system (Art. 2). |
| Publicly available data | Does not apply to data made publicly available by the person or under a legal obligation (section 3). | No general exclusion for publicly available data. |
| Special categories | No separate category of sensitive personal data. | Special categories such as health and biometric data have extra rules (Art. 9). |
| Grounds for processing | Consent, or certain legitimate uses listed in section 7 (section 4). | Six lawful bases, including contract and legitimate interests (Art. 6). |
| Children | A child is under 18 (section 2). Verifiable parental consent; no tracking, behavioural monitoring or targeted ads (section 9). | Parental consent for information society services below 16, which Member States may lower to 13 (Art. 8). |
| Rights | Access to a summary, correction, completion, updating, erasure, grievance redressal and nomination (section 11 to section 14). | Also includes portability, objection, restriction and rights on automated decisions (Arts. 15 to 22). |
| Duties of individuals | Data Principals have duties; breach can attract a penalty of up to ten thousand rupees (section 15). | No equivalent duties on data subjects. |
| Breach notification | Every personal data breach to the Board and each affected person; detailed report to the Board within 72 hours (section 8, rule 7). | To the authority within 72 hours unless unlikely to result in a risk; to individuals when high risk (Arts. 33, 34). |
| Data Protection Officer | Required for Significant Data Fiduciaries; must be based in India (section 10). Others publish a contact person (rule 9). | Required for public authorities and for certain core activities (Art. 37). |
| Cross-border transfers | Allowed except to countries the Government restricts by notification, subject to rule 15 and stricter sector laws (section 16). | Allowed only with adequacy, appropriate safeguards or specific derogations (Chapter V). |
| Consent Managers | Registered intermediaries that help people manage consent (section 6, rule 4). | No equivalent role. |
| Regulator | Data Protection Board of India, appointed by the Central Government; appeals to TDSAT (section 18, section 29). | Independent supervisory authorities in each Member State, with the European Data Protection Board. |
| Maximum penalties | Up to two hundred and fifty crore rupees per breach type in the Schedule (section 33). | Up to 20 million euro or 4 per cent of worldwide annual turnover, whichever is higher (Art. 83). |
| Compensation to individuals | Penalties go to the Consolidated Fund of India (section 34); the Act does not provide for compensation to individuals. | Right to compensation for damage (Art. 82). |