Home › Compare laws side by side › DPDP Act / DPDP Rules vs EU GDPR
DPDP Act / DPDP Rules vs EU GDPR
Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 (India) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | DPDP Act / DPDP Rules India 11/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | Enacted; phased in. Rules notified 13 Nov 2025 (G.S.R. 846(E)). Board rules in force 13 Nov 2025; consent-manager rules from 13 Nov 2026; most business obligations from 13 May 2027. Sources differ on which rules start on 13 Nov 2026. | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Processing of digital personal data in India, and processing outside India linked to offering goods or services to people in India. Personal/domestic use and data made public by the individual are excluded.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size threshold: every Data Fiduciary is covered. Government may designate Significant Data Fiduciaries (SDFs) based on data volume, sensitivity and risk; SDFs carry extra duties.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Data Protection Board of India (appeals to TDSAT); rules made by the Ministry of Electronics and IT (MeitY)✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | From 13 May 2027 (DPDP Rule 7): inform the Board without delay and file a detailed report within 72 hours of becoming aware (extendable by the Board); tell each affected person without delay in plain language. In force now: report specified cyber incidents to CERT-In within 6 hours (CERT-In Directions, 28 Apr 2022).✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | From 13 May 2027: people can ask for access, correction, completion, updating and erasure of their data (DPDP Act ss.11–12). Neither the Act nor the Rules set a fixed reply deadline for these requests; grievances must be resolved within a reasonable period not exceeding 90 days (Rule 14(3), Act s.13). | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | From 13 May 2027: all fiduciaries must publish contact details of a person who can answer data queries (a designated officer or DPO). Significant data fiduciaries must appoint an India-based DPO reporting to the board.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | No separate local representative rule. Foreign fiduciaries in scope must still publish a contact person; SDF DPOs must be based in India.✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Allowed by default unless the government restricts a country or conditions by order. Sector rules (e.g. RBI, SEBI) may require localisation. SDFs may face data-localisation directions and cannot send specified traffic data abroad.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | From 13 May 2027: consent must be free, specific, informed and unambiguous, after a clear notice, and can be withdrawn as easily as given. Verifiable parental consent is needed for under-18s; no tracking or targeted ads aimed at children.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Up to INR 250 crore per breach for failing to keep reasonable security safeguards; up to INR 200 crore for breach-notice or children's data failures; up to INR 150 crore for breaching SDF duties; up to INR 50 crore for other violations.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- DPDP Act / DPDP Rules
- Processing of digital personal data in India, and processing outside India linked to offering goods or services to people in India. Personal/domestic use and data made public by the individual are excluded.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under DPDP Act / DPDP Rules
- From 13 May 2027: give a clear, itemised privacy notice and get valid consent, or rely on a listed legitimate use
- From 13 May 2027: get verifiable parental consent before processing data of anyone under 18
- From 13 May 2027: put reasonable security safeguards in place and bind processors by contract
- From 13 May 2027: report breaches to the Board without delay, file a full report within 72 hours, and notify affected people (now: cyber incidents to CERT-In within 6 hours)
- From 13 May 2027: handle access, correction and erasure requests, and resolve grievances within 90 days
- From 13 May 2027: delete data once its purpose ends; large e-commerce, social and gaming platforms delete after 3 years of inactivity
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@