GDPR vs DPDP Act: Guide for Foreign Businesses Serving India

ByJurisAxios

Foreign businesses serving Indian users now answer to two regimes: the EU General Data Protection Regulation and India’s Digital Personal Data Protection Act, 2023 (DPDP Act), operationalised through the DPDP Rules, 2025. This GDPR vs DPDP Act comparison explains where the laws diverge and what dual compliance needs as of October 2026.

Where the DPDP Act stands in 2026

MeitY notified the DPDP Rules, 2025 on 13 November 2025 with phased commencement: Rules 1, 2 and 17–21, including the Data Protection Board, took effect at once; Rule 4 (Consent Managers) commences on 13 November 2026; and the substantive Rules 3, 5–16 and 22–23 commence on 13 May 2027. In January 2026 MeitY proposed compressing the final deadline to November 2026 and advancing the cross-border provisions (Rules 13(4) and 15). No amending notification had issued at the time of writing, so May 2027 remains operative, but plan for the earlier date.

Extraterritorial scope: s.3 DPDP vs Art. 3 GDPR

Both laws reach businesses with no local establishment. GDPR Art. 3(2) covers non-EU controllers that offer goods or services to, or monitor the behaviour of, data subjects in the Union. The DPDP hook has no separate monitoring limb.

…processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India.

Section 3(b), Digital Personal Data Protection Act, 2023

Legal bases: consent vs six GDPR grounds

GDPR Art. 6(1) offers six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Section 4 DPDP permits processing only with consent or for a legitimate use listed in s.7. There is no open-ended legitimate-interests ground and no stand-alone contract ground. Consent under s.6 must be free, specific, informed, unconditional and unambiguous, preceded by an itemised s.5 notice, and as easy to withdraw as to give.

Cross-border transfers: negative list vs SCCs

GDPR Chapter V (Arts 44–49) bars transfers outside the EEA without an adequacy decision, safeguards such as Standard Contractual Clauses, or a derogation. India has no adequacy decision, so EU-to-India flows rely on SCCs.

The DPDP Act inverts the model. Section 16 lets the Central Government restrict transfers to notified countries, and Rule 15 adds that transfers must meet any Government requirements on making data available to a foreign State. Everything else is permitted, and no restricted list had been notified by September 2026; Rule 13(4) may additionally localise specified data of Significant Data Fiduciaries.

On adequacy: negotiations for an EU–India trade agreement concluded in January 2026, and the Commission proposed the text to the Council in September 2026. That is not an adequacy decision under Art. 45 GDPR; commentators cite the Board’s limited independence and the wide s.17(2) exemption for State agencies as obstacles.

Data principal rights compared

Access, correction and erasure exist in both regimes (GDPR Arts 15–17; DPDP ss.11–12). DPDP s.13 requires exhausting the fiduciary’s grievance mechanism before approaching the Board, whereas GDPR Art. 77 allows direct complaint to a regulator. Missing from DPDP are portability, objection, restriction and automated-decision rights (GDPR Arts 18–22).

Children, breaches, officers and penalties

Children (18 vs 16/13): s.2(f) DPDP defines a child as anyone under eighteen. Section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising directed at children. GDPR Art. 8 sets the consent age at 16, lets Member States go as low as 13, and has no advertising ban.

Breach notification: GDPR Art. 33 requires notice to the regulator within 72 hours unless the breach is unlikely to result in risk; Art. 34 reaches individuals only for high-risk breaches. Section 8(6) DPDP and Rule 7 are stricter: every breach must be intimated to the Board and each affected Data Principal without delay, with particulars to the Board within 72 hours.

SDF vs DPO: GDPR Art. 37 requires a Data Protection Officer where core activities involve large-scale monitoring or special-category data. Under s.10 DPDP the Government designates SDFs on volume, sensitivity and risk to sovereignty or electoral democracy. An SDF must appoint an India-based DPO, engage an independent auditor, and conduct annual DPIAs, audits and algorithmic due diligence (Rule 13).

Penalties: GDPR Art. 83 fines reach €20 million or 4% of worldwide turnover. The DPDP Schedule sets fixed caps: ₹250 crore for failing security safeguards, ₹200 crore for breach-notification and children’s-data failures, ₹150 crore for SDF obligations and ₹50 crore otherwise. The Act gives no private right to compensation.

Dual-compliance checklist

  1. Map Indian-user processing connected with offering goods or services and treat it as in scope.
  2. Where Europe relies on legitimate interests or contract, build s.6 consent or a s.7 legitimate use for Indian users, and rebuild notices for DPDP s.5.
  3. Adopt an 18-year child threshold for India with verifiable parental consent, and switch off behavioural advertising to minors.
  4. Run one breach playbook that notifies all affected Indian users and the Board; keep SCCs for EU data entering India and monitor s.16 notifications.
  5. Assess SDF exposure now and line up an India-based DPO and auditor if needed; diarise 13 November 2026 and 13 May 2027.

See our corporate advisory practice for related work. For advice on your own matter, you may contact the firm.

Frequently asked questions

Does the DPDP Act apply to a company with no office in India?

Yes, if it processes digital personal data in connection with offering goods or services to Data Principals in India (s.3(b)). Unlike GDPR Art. 27, no local representative is needed, but an SDF must appoint an India-based DPO.

Can we rely on legitimate interests under the DPDP Act?

No. The Act recognises only consent (s.6) and the legitimate uses listed in s.7, such as voluntarily provided data, employment and legal obligations. A GDPR Art. 6(1)(f) assessment has no DPDP equivalent.

Do we need SCCs to move Indian data abroad?

Not under the DPDP Act: transfers are permitted unless the Central Government restricts a destination under s.16 and Rule 15, and none had been notified by September 2026. EU data entering India still needs SCCs, as India has no adequacy decision.

When do the DPDP obligations actually bite?

Consent Manager provisions (Rule 4) start on 13 November 2026 and the core obligations (Rules 3, 5–16, 22–23) on 13 May 2027, unless the Government notifies the shorter timeline proposed in January 2026.

Sources

This article is general information on the law as at 1 October 2026 and is not legal advice. Timelines change; verify the current position before acting.

Similar Posts