Skip to content
Code Colonies

Compliance · Explainer

DPDP Act and GDPR: what is similar and what is different

Many Indian companies already work to GDPR. How much of that effort carries over to the DPDP Act, and where you will need to do more.

Code Colonies Compliance Practice · · 2 min read

Key takeaways

  • Much of your GDPR groundwork still helps
  • Consent plays a larger role under the DPDP Act
  • Children's data rules are stricter in India

If your company already serves European clients, you have a head start on the DPDP Act, though not a finished job. The two laws share a lot of structure and differ in a few places that matter.

What carries over

  • A record of processing and a personal data inventory.
  • Clear notices and purpose limitation.
  • Processes for access, correction and erasure requests.
  • Security safeguards and breach response.
  • Vendor contracts with data processing terms.

Key differences

  • Lawful grounds. GDPR offers six lawful bases, including legitimate interests. The DPDP Act relies mainly on consent, plus a defined list of legitimate uses. A lot of processing you justified under legitimate interests in Europe will need consent in India.
  • Consent managers. The DPDP Act creates registered consent managers, a role GDPR does not have.
  • Children. The DPDP Act treats anyone under 18 as a child, requires verifiable parental consent and restricts tracking and targeted advertising aimed at children. GDPR lets member states set the age between 13 and 16.
  • Breach notification. The DPDP Act requires notice to the Data Protection Board and to the affected people for personal data breaches, without a GDPR style threshold for "likely risk". Both are told without delay, with a detailed report to the Board within 72 hours.
  • Penalties. Set by the Data Protection Board: up to INR 250 crore for failing to take reasonable security safeguards, up to INR 200 crore for failing to notify a breach or for breaching the duties on children's data, up to INR 150 crore for Significant Data Fiduciary duties, and up to INR 50 crore for most other breaches.
  • Rights. There is no right to data portability under the DPDP Act, unlike GDPR. The DPDP rights are access to information, correction and erasure, grievance redress and nomination.

Practical advice

Reuse your GDPR inventory and processes as the starting point. Then rework consent, children's data handling and breach notification for India, and check that your notices are available in the languages your Indian users read.

Explore DPDP Act servicesBook a call

Have a question about this guide? Write to us or ask Colony, our AI guide.

Keep reading

Playbook2 min read

The DPDP Act: a practical first 90 days

Consent Manager provisions start in November 2026 and most duties apply from May 2027, as currently notified. A realistic plan for your first three months of work.

Compliance
Explainer4 min read

DPDP Act penalties: the amounts, how the Board decides and how to reduce your exposure

The DPDP Act sets penalties of up to INR 250 crore per breach. The full schedule of penalties, how the Data Protection Board inquires and decides, the factors it weighs, appeals, and the steps that lower your risk.

Compliance
Explainer2 min read

The EU AI Act for Indian technology companies

If your software or its AI output reaches users in Europe, the EU AI Act may apply to you. A short guide to roles, risk levels and first steps.

Compliance

Start a conversation

Tell us what you are trying to build.

Share the problem in a short call. You leave with a clear view of the approach, the team and the cost.

Book a meetingSend us a message
Or get a ballpark proposal in two minutes

A specialist replies within one working day. The first conversation is free.

Chat with the Code Colonies team on WhatsApp