DPDPA vs CCPA: Key Differences
A complete comparison of India's Digital Personal Data Protection Act 2023 and California's Consumer Privacy Act (CCPA/CPRA).
Quick Answers
What is the main difference between DPDPA and CCPA?
The main difference is the opt-out vs opt-in approach. CCPA gives consumers the right to opt-out of the 'sale' or 'sharing' of their personal data. DPDPA is based primarily on explicit, opt-in consent before processing begins.
Which law has higher penalties: DPDPA or CCPA?
CCPA fines are up to $2,500 per violation or $7,500 for intentional violations, which can add up to millions in data breaches. DPDPA imposes fixed maximum penalties per incident, reaching up to ₹250 crore (approx $30 million).
Does CCPA require data localisation?
No, CCPA does not require data localisation. However, specific federal sectoral laws in the US (like HIPAA for healthcare) have strict residency requirements. DPDPA also does not mandate general localisation but allows the government to restrict transfers.
Detailed Comparison
| Feature | DPDPA (India) | CCPA (California) |
|---|---|---|
| Legal Basis | Opt-in (Consent) | Opt-out (Right to stop sale) |
| Term for Individual | Data Principal | Consumer |
| Data Localisation | Allowed by default, restricted list | No general mandate |
| Max Penalty | ₹250 Crore | $7,500 per violation |
| Sensitive Data | Additional safeguards for children | Right to limit use of sensitive data |
Operating in both India and the US?
Our experts can help you build a unified compliance framework that satisfies both DPDPA and CCPA.
Talk to an Expert →