DPDPA vs GDPR: Key Differences
A complete comparison of India's Digital Personal Data Protection Act 2023 and the European Union's General Data Protection Regulation.
Quick Answers
What is the main difference between DPDPA and GDPR?
The main difference is their approach to legal bases and data transfers. GDPR has 6 lawful bases (including legitimate interests) and uses an 'adequacy' model for data transfers. DPDPA has only 2 lawful bases (consent and specific legitimate uses) and uses a 'blacklist' model for transfers, allowing them by default unless restricted.
Which law has higher penalties: DPDPA or GDPR?
GDPR penalties scale with company size, reaching up to €20 million or 4% of global annual turnover. DPDPA penalties are fixed amounts, reaching up to ₹250 crore (approx $30 million). For large multinationals, GDPR fines are higher; for smaller businesses, DPDPA penalties can be equally severe.
Is a DPO required under both DPDPA and GDPR?
No. Under GDPR, a DPO is mandatory for public authorities and organizations doing large-scale monitoring or processing sensitive data. Under DPDPA, a DPO is mandatory only for entities notified as Significant Data Fiduciaries (SDFs) by the government.
Detailed Comparison
| Feature | DPDPA (India) | GDPR (EU) |
|---|---|---|
| Term for Individual | Data Principal | Data Subject |
| Term for Company | Data Fiduciary | Data Controller |
| Lawful Bases | 2 (Consent & Legitimate Uses) | 6 (including Legitimate Interests) |
| Cross-Border Transfer | Blacklist (Allowed unless restricted) | Whitelist (Adequacy required) |
| Max Penalty | ₹250 Crore (Fixed) | €20M or 4% of turnover |
| DPO Requirement | Only for SDFs | Broad requirement for public/high-risk |
Need help with multi-jurisdictional compliance?
Our experts can help you build a unified privacy program that covers both DPDPA and GDPR.
Talk to an Expert →