Introduction

Data privacy regulation has gone global and companies working across borders are increasingly finding themselves subject to more than one framework at once. The General Data Protection Regulation, or GDPR, has been the driving force behind data protection law since taking effect in 2018, providing a baseline that has shaped laws in dozens of nations.

The most recent major piece of that puzzle is India's Digital Personal Data Protection Act, 2023, and for companies with operations or customers in India, it's not an intellectual exercise, but a real imperative to grasp how the two frameworks connect to each other.

Where Each Regulation Comes From and Who It Covers

GDPR is a European Union regulation that came into force in May 2018. Its geographic reach extends well beyond Europe. Any organisation anywhere in the world that processes personal data of EU residents is subject to GDPR, regardless of where the organisation itself is based. A SaaS company based in Bengaluru with European customers is just as obligated by GDPR as a company that has its headquarters in Berlin.

India's primary data protection law is the DPDP Act, 2023, which regulates the collection, processing and storage of personal data of Indian individuals by organisations. For Indian businesses, DPDP is the primary compliance obligation. For global businesses with Indian users or operations, it is an additional layer sitting alongside whatever other frameworks already apply.

(Interested in reading more about DPDP Act in detail, check our blog here)

Consent — Similar in Principle, Different in Detail

Both frameworks place consent at the centre of how personal data can be processed, but they approach it differently in their specifics.

GDPR

It sets a high and detailed bar for valid consent. It must be freely given, specific, informed, and unambiguous. Bundled consent, where agreement to one thing implies agreement to several others, does not qualify either.

GDPR also recognises several legal bases for processing beyond consent, including legitimate interests, contractual necessity, and legal obligation, which gives organisations more flexibility in how they justify their data processing activities.

DPDP Act

The DPDP Act takes a simpler, more streamlined perspective on consent. This means getting clear and informed consent before processing personal data. This involves drawing attention to the information notice that accompanies the request for consent, what data is being gathered, for what purpose and what are the rights of the subject.

User Rights — Broad Under GDPR, Focused Under DPDP

GDPR

It grants data subjects an extensive set of rights, the right to access their data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object to processing in certain circumstances. Managing these rights at scale requires dedicated workflows and, for larger organisations, significant operational infrastructure.

DPDP Act

The DPDP Act takes a more focused approach. It offers rights of access, rectification and deletion that reach to the essence of what people most often need, but without the larger scope of the GDPR's framework. This makes the operational needs to handle data subject requests somewhat more feasible under DPDP, although the obligation to react appropriately and within stated times is the same under both.

Penalties — Different Structures, Serious in Both Cases

GDPR

Penalties are calculated as a percentage of global annual turnover, with fines reaching up to €20 million or four percent of global annual revenue, whichever is higher.

DPDP Act

It prescribes penalties of up to ₹250 crore per instance of non-compliance. The structure is different from GDPR, fixed maximum rather than turnover-based — but the exposure is meaningful, particularly for organisations operating at scale in India.

Compliance Complexity — Where They Genuinely Differ

GDPR

It is widely acknowledged as one of the most comprehensive and demanding data protection frameworks in existence. The documentation requirements, the breadth of obligations, the detailed rules around data transfers outside the EU, and the volume of guidance that has accumulated over years of enforcement make full GDPR compliance a significant operational undertaking for any organisation.

DPDP Act

The DPDP Act was designed with a degree of pragmatism that GDPR does not always reflect. The framework is more streamlined, the obligations are more clearly defined in practical terms, and the overall compliance burden is structured to be more accessible for organisations that do not have large dedicated compliance functions. For Indian startups and SMEs encountering data protection regulation for the first time, DPDP is a more manageable starting point than GDPR would be.

Which Framework Applies — and When Both Do

The geography of a business's operations and user base determines which framework applies.

• Organisations processing personal data of EU residents need to comply with GDPR.
• Organisations processing personal data of Indian residents need to comply with DPDP.
• Organisations doing both need to comply with both, which is an increasingly common situation for Indian businesses with international ambitions and global businesses with Indian operations.

Where both apply, the practical approach is to build compliance infrastructure that satisfies the more demanding requirements of GDPR and verify that DPDP obligations are met within that structure.

Conclusion

GDPR and DPDP represent two different points on the spectrum of data protection regulation, one comprehensive and globally influential, the other practical and India-specific. For businesses navigating both, the frameworks are more complementary than conflicting.

Building a data governance foundation that takes both seriously, proper consent management, functioning user rights workflows, documented processing activities, and continuous compliance monitoring, serves both obligations simultaneously and positions the business well for a regulatory environment that is only going to become more demanding over time.