GDPR
The European Union’s General Data Protection Regulation, in force since May 2018.
The GDPR is the European Union's data protection law, in force since May 2018. India's DPDP Act borrows some ideas from it but is narrower and built differently.
Meaning of GDPR
GDPR is often used for comparison. It has six lawful bases (including contract and legitimate interest), special categories of data, data portability, a right to object and rules on automated decisions. The DPDP Act is narrower: it applies to digital personal data, relies on consent and listed legitimate uses, and has no special categories, portability or legitimate-interest ground.
The General Data Protection Regulation (EU 2016/679) has applied across the European Union and European Economic Area since 25 May 2018. It covers personal data in any form, not only digital data, and it reaches organisations outside Europe that offer goods or services to people in the EU or monitor their behaviour. Indian IT services firms, SaaS vendors and e-commerce exporters therefore often hold GDPR obligations in addition to Indian ones, and the two must be managed side by side.
The structure is familiar to anyone who has read the DPDP Act, but several features differ. GDPR Article 6 gives six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The DPDP Act relies on consent and the specific legitimate uses in Section 7, and has no general legitimate-interest ground. GDPR Article 9 creates special categories of data such as health and biometric data; the DPDP Act has no such categories. GDPR gives rights to portability (Article 20), to object (Article 21) and against solely automated decisions (Article 22); the DPDP Act offers access, correction and erasure, grievance redressal and nomination, and does not provide those three.
On enforcement the two also diverge. GDPR is enforced by independent supervisory authorities in each member state, with fines up to €20 million or 4 percent of worldwide annual turnover, and it gives individuals a right to compensation. The DPDP Act is enforced by the Data Protection Board of India, with penalties set out in the Schedule to the Act, such as up to ₹250 crore for failure to maintain reasonable security safeguards and up to ₹200 crore for failure to notify a breach. Appeals go to the Appellate Tribunal. On breach notification, GDPR Article 33 requires notice to the authority within 72 hours, while the DPDP Rules require a detailed report to the Board within 72 hours after informing the Board without delay (Rule 7), and the Act additionally requires intimation to each affected Data Principal.
The vocabulary maps cleanly. Controller corresponds to Data Fiduciary, processor to Data Processor, data subject to Data Principal and supervisory authority to the Board. The DPDP Act also adds ideas without direct GDPR equivalents, such as the Consent Manager, the Significant Data Fiduciary regime, and the State-focused exemptions in Section 17. A GDPR-compliant organisation therefore has a head start in India but cannot simply reuse its documents.
Examples of GDPR
A company that complies with GDPR still has to adapt its consent and notice for India's Act.
A SaaS company with customers in Germany and India keeps one security programme but two consent flows. The German flow follows GDPR Article 6 and the India flow follows Section 6 of the DPDP Act, with different notices for each.
A multinational with an Indian subsidiary copies its European privacy notice onto its Indian website. A review finds that the notice does not mention the Board complaint route or withdrawal rights in the manner Rule 3 expects, so the subsidiary rewrites it.
An outsourcing firm processes European customer data for a client. It signs a GDPR processing agreement for that work and, for its Indian customers, uses DPDP processor clauses that make clear the client remains accountable under Section 8(1).
Why GDPR matters
A common mistake among multinationals is to treat GDPR as a global standard and assume it covers India. It does not. A consent banner that satisfies a European regulator may not give the itemised notice that Rule 3 requires, and a legitimate-interest assessment that supports analytics in Europe cannot be used as a ground in India. Conversely, an Indian business that sells to European customers must still meet GDPR even if its Indian programme is perfect.
GDPR also shapes expectations. Indian customers, global partners and procurement teams often measure Indian companies against GDPR practices, and vendor questionnaires use GDPR terms. Understanding the differences helps you answer them accurately and avoid over-claiming compliance.
How it works in practice
- 1Build a one-page comparison for your own business showing, for each processing activity, which GDPR basis and which DPDP basis applies. Where you used legitimate interest in Europe, decide whether Indian consent or a Section 7 use is available.
- 2Maintain a single master record of processing, with fields for both regimes. It can hold the EU legal basis, the DPDP ground, retention period and the safeguard in place.
- 3Design notices in layers: a global core that explains purposes and rights, with an India page that names the Data Principal rights, the grievance route and the Board complaint route required by the Act and Rules.
- 4Align breach response so that one incident process notifies the EU authority within 72 hours where GDPR applies, and the Board and affected Data Principals under Section 8(6) and Rule 7 where the DPDP Act applies.
- 5Review international transfers separately. GDPR uses adequacy decisions and standard contractual clauses, while Section 16 of the DPDP Act permits transfers except to countries notified by the Central Government, subject to stricter sector rules.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming GDPR compliance equals DPDP compliance. Grounds, rights, notice and enforcement differ. Treat GDPR work as a head start only.
Carrying legitimate interest into India. The DPDP Act has no general ground of that kind. Use consent or a listed Section 7 use.
Promising rights the Act does not give. Telling Indian users they have portability or a right to object as a legal matter can create confusion. State your voluntary commitments clearly as such.
Forgetting scope differences. GDPR covers paper records; the DPDP Act covers digital personal data and digitised data.
Compliance tips
Maintain a glossary of GDPR terms with their DPDP equivalents for sales, legal and engineering teams.
Answer vendor questionnaires with specifics. Say which regime a control satisfies, rather than claiming "GDPR-compliant" for India.
Put a regime tag on each data set so you can respond to regulators in either jurisdiction quickly.
Track the Rules and Board guidance. Indian practice is still evolving and may diverge further from European norms.
Common questions about GDPR
Is the DPDP Act the same as GDPR?
No. Both protect personal data and share concepts like consent and breach notification, but the DPDP Act covers digital data, has no legitimate-interest ground or special categories, omits portability and the right to object, and is enforced by the Data Protection Board.
Does GDPR apply to Indian companies?
It can, if an Indian company offers goods or services to people in the EU or monitors their behaviour there. In that case GDPR applies in addition to Indian law. Take legal advice on your specific activities.
Does the DPDP Act have a legitimate interest ground like GDPR?
No. The Act has consent and a defined list of legitimate uses in Section 7, such as voluntary provision of data, legal obligations, medical emergencies and employment. A business interest alone is not a lawful ground.
Are GDPR fines higher than DPDP penalties?
They are structured differently. GDPR fines go up to €20 million or 4 percent of worldwide turnover. The DPDP Schedule sets rupee ceilings, up to ₹250 crore for security safeguard failures. Actual outcomes depend on each regulator's findings.