DPDP Act 2023 vs GDPR: A Practitioner's Comparison for DPOs Operating Across India and the EU

India's DPDP Act 2023 is not a copy of the GDPR. It shares a philosophy — individual rights, fiduciary accountability, purpose limitation — but differs materially in structure, rights, and obligations. For DPOs managing organisations that operate in both India and the EU, understanding these differences is essential to avoid transposing GDPR assumptions onto Indian compliance programmes.

This guide provides a structured comparison of the two frameworks at the level of detail a practitioner needs — not an academic survey.

Why This Comparison Matters

Three categories of organisations need this comparison most urgently:

• Indian companies with EU operations or EU customers: They face dual compliance — DPDP for Indian data subjects; GDPR for EU data subjects
• European companies operating in India: They cannot assume their GDPR programme satisfies DPDP — it does not
• GDPR-trained DPOs now leading Indian compliance: They carry assumptions about legitimate interest, data portability, and automated decision-making rights that do not exist in DPDP

Lawful Bases — Side by Side

This is the most critical difference. DPDP Act 2023 provides four lawful bases; GDPR provides six.

Critical implication: Many processing activities that GDPR organisations rely on legitimate interest for — fraud prevention analytics, direct marketing to existing customers, intra-group data transfers, employee monitoring — require either consent or a legal obligation basis under DPDP. Review every processing activity mapped to legitimate interest in your EU ROPA — each needs a DPDP-valid basis independently assessed.

Data Subject Rights

Implication for DPO workflow: DSAR processes designed for GDPR need adaptation for DPDP. You must not promise data portability as a legal right. You cannot rely on a "right to restrict" as a holding mechanism. But you must provide a grievance pathway that leads to the Data Protection Board — which GDPR organisations often do not operationalise.

DPO Appointment Requirements

Breach Notification Timelines

Practical implication: Under DPDP, there is no explicit 72-hour clock in the current Rules, but "as soon as possible" must be treated as urgent. Operate on a 24–48 hour internal target to give yourself time to prepare the Board notification before submitting.

Penalty Framework

Children's Data

Cross-Border Data Transfers

Key Things GDPR Practitioners Must Unlearn

• Legitimate interest does not exist in DPDP. Every processing activity relying on this must be re-evaluated for a valid DPDP basis — typically consent or legal obligation.
• There is no right to data portability under DPDP. Do not offer this as a statutory right in your Indian privacy notice.
• There is no explicit right to contest automated decisions under DPDP. AI/ML decision-making governance is a gap — address it contractually and through your own accountability framework, not by citing a DPDP right that does not exist.
• The 72-hour breach notification clock does not exist in DPDP Rules (yet). But "as soon as possible" means you should treat it as urgent — not treat the absence of a clock as permission to delay.
• The DPO for an SDF must be internal and India-based. A shared group DPO based in Europe does not satisfy DPDP Rules 2025.
• Contract performance is not an explicit standalone basis under DPDP. Carefully assess whether you need consent or legal obligation to cover processing that GDPR would map to Art. 6(1)(b).

Where DPDP Goes Further Than GDPR

• Children's data protection is stricter. The prohibition on tracking and targeted advertising to under-18s is broader than GDPR's approach.
• SDF obligations create a two-tier system with additional accountability. Annual Data Audits, mandatory DPIAs, KMP-level DPO requirements — GDPR has no equivalent SDF designation.
• Right to nominate (§14) is unique to DPDP — individuals can designate someone to exercise rights posthumously, a forward-thinking provision not in GDPR.
• Grievance redressal timelines are more operationally prescriptive in the DPDP Rules framework than GDPR's general right to complain to a supervisory authority.

Dual-Jurisdiction Checklist

For organisations operating under both DPDP and GDPR, validate these items:

• ☑ All processing activities mapped separately for DPDP (Indian data subjects) and GDPR (EU data subjects) in your ROPA
• ☑ Every instance of "legitimate interest" in your GDPR ROPA re-assessed for a valid DPDP basis
• ☑ Privacy notices for Indian customers do not reference data portability as a legal right
• ☑ DSAR process distinguishes between DPDP response obligations (access summary) and GDPR response obligations (comprehensive access)
• ☑ Breach response plan has separate notification tracks: GDPR (72 hours to supervisory authority) and DPDP (as soon as possible to Data Protection Board)
• ☑ DPO appointment structure: separate India-based KMP DPO for SDF status, plus GDPR-compliant DPO for EU operations
• ☑ Children's data consent mechanisms meet the stricter of the two frameworks (DPDP under-18 with verifiable parental consent)
• ☑ EU-to-India data transfers have SCCs or BCRs in place (GDPR requirement; India not yet adequate)
• ☑ India-to-EU data transfers assessed against DPDP negative list (not yet published) and contractual safeguards maintained
• ☑ Training programme updated to distinguish DPDP and GDPR for relevant staff