---
title: "DPDP Act vs GDPR: Key Differences Compared | dpdpr.in"
description: "DPDP Act vs GDPR side by side: scope, lawful grounds, consent, rights, breach reporting, penalties and cross-border transfers."
url: "https://dpdpr.in/guides/dpdp-vs-gdpr/"
canonical: "https://dpdpr.in/guides/dpdp-vs-gdpr/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# DPDP Act vs GDPR

This is a simplified comparison for orientation only. Both laws have exceptions and details not shown here. GDPR references are to [Regulation (EU) 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj).

## Side by side

| Topic | DPDP Act and Rules | GDPR |
|---|---|---|
| Scope | Digital personal data, and non-digital data that is later digitised ([section 3](https://dpdpr.in/act/section-3/)). | All personal data processed wholly or partly by automated means, or in a filing system (Art. 2). |
| Publicly available data | Does not apply to data made publicly available by the person or under a legal obligation ([section 3](https://dpdpr.in/act/section-3/)). | No general exclusion for publicly available data. |
| Special categories | No separate category of sensitive personal data. | Special categories such as health and biometric data have extra rules (Art. 9). |
| Grounds for processing | Consent, or certain legitimate uses listed in [section 7](https://dpdpr.in/act/section-7/) ([section 4](https://dpdpr.in/act/section-4/)). | Six lawful bases, including contract and legitimate interests (Art. 6). |
| Children | A child is under 18 ([section 2](https://dpdpr.in/act/section-2/)). Verifiable parental consent; no tracking, behavioural monitoring or targeted ads ([section 9](https://dpdpr.in/act/section-9/)). | Parental consent for information society services below 16, which Member States may lower to 13 (Art. 8). |
| Rights | Access to a summary, correction, completion, updating, erasure, grievance redressal and nomination ([section 11](https://dpdpr.in/act/section-11/) to [section 14](https://dpdpr.in/act/section-14/)). | Also includes portability, objection, restriction and rights on automated decisions (Arts. 15 to 22). |
| Duties of individuals | Data Principals have duties; breach can attract a penalty of up to ten thousand rupees ([section 15](https://dpdpr.in/act/section-15/)). | No equivalent duties on data subjects. |
| Breach notification | Every personal data breach to the Board and each affected person; detailed report to the Board within 72 hours ([section 8](https://dpdpr.in/act/section-8/), [rule 7](https://dpdpr.in/rules/rule-7/)). | To the authority within 72 hours unless unlikely to result in a risk; to individuals when high risk (Arts. 33, 34). |
| Data Protection Officer | Required for Significant Data Fiduciaries; must be based in India ([section 10](https://dpdpr.in/act/section-10/)). Others publish a contact person ([rule 9](https://dpdpr.in/rules/rule-9/)). | Required for public authorities and for certain core activities (Art. 37). |
| Cross-border transfers | Allowed except to countries the Government restricts by notification, subject to [rule 15](https://dpdpr.in/rules/rule-15/) and stricter sector laws ([section 16](https://dpdpr.in/act/section-16/)). | Allowed only with adequacy, appropriate safeguards or specific derogations (Chapter V). |
| Consent Managers | Registered intermediaries that help people manage consent ([section 6](https://dpdpr.in/act/section-6/), [rule 4](https://dpdpr.in/rules/rule-4/)). | No equivalent role. |
| Regulator | Data Protection Board of India, appointed by the Central Government; appeals to TDSAT ([section 18](https://dpdpr.in/act/section-18/), [section 29](https://dpdpr.in/act/section-29/)). | Independent supervisory authorities in each Member State, with the European Data Protection Board. |
| Maximum penalties | Up to two hundred and fifty crore rupees per breach type in the Schedule ([section 33](https://dpdpr.in/act/section-33/)). | Up to 20 million euro or 4 per cent of worldwide annual turnover, whichever is higher (Art. 83). |
| Compensation to individuals | Penalties go to the Consolidated Fund of India ([section 34](https://dpdpr.in/act/section-34/)); the Act does not provide for compensation to individuals. | Right to compensation for damage (Art. 82). |