Back to Module
10 of 18|History of Data Protection
reading 20 min•GDPR Journey
Lessons for India
What India learned from the GDPR and how it adapted it for the DPDPA.
🎯 Learning Objectives
- ▸ Compare GDPR and DPDPA design philosophies
- ▸ Understand why DPDPA is shorter
- ▸ Identify key differences in enforcement and scope
Simplification
The GDPR is famously complex, with 99 articles and thousands of pages of guidance. Indian policymakers wanted a law that small businesses could actually understand. The DPDPA has only 44 sections and is much easier to read.
Key Differences
- • Lawful Basis: GDPR has 6 bases (including Legitimate Interests). DPDPA has only 2 (Consent and Legitimate Uses).
- • Data Transfer: GDPR requires "adequacy." DPDPA uses a blacklist (allowed unless restricted).
- • Penalties: GDPR is turnover-based. DPDPA is fixed amount.
- • DPO: GDPR requires a DPO for many companies. DPDPA only requires it for SDFs (Significant Data Fiduciaries).
📖 Glossary
- Adequacy Decision
- A GDPR mechanism where the EU officially recognizes a non-EU country as having adequate data protection laws.
🔑 Key Takeaways
- India opted for a shorter, principle-based law.
- DPDPA uses a "blacklist" approach for data transfers, unlike GDPR's "adequacy" approach.
- DPDPA does not have a "legitimate interests" basis like GDPR.
📚 Further Reading
- DPDPA vs GDPR — Legal Galaxy (2024)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...