Lesson 1.6: DPDPA vs GDPR and the old regime
Many people ask how this law compares with Europe’s GDPR. This lesson gives a clear side-by-side view. This DPDPA 2023 course page explains dpdpa vs gdpr and the in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about dpdpa vs gdpr and the
- Compare DPDPA with GDPR on key points
- Spot what is new for Indian businesses
- Understand what changed from the SPDI Rules
In a nutshell (dpdpa vs gdpr and the)
The DPDP Act is shorter and simpler than the GDPR. It is consent-first, has no separate sensitive data category, no general legitimate interest ground, and no data portability right. It adds a Consent Manager framework and a Board that works largely digitally.
DPDPA versus GDPR
| Topic | DPDPA 2023 | GDPR |
|---|---|---|
| Scope | Digital personal data | All personal data, any form |
| Lawful grounds | Consent and listed legitimate uses | Six grounds, including legitimate interest |
| Sensitive data | No separate category | Special categories with stricter rules |
| Data portability | Not provided | Provided |
| Breach notice | To the Board and each affected person | To the regulator and in high-risk cases the person |
| DPO | Only for Significant Data Fiduciaries | Required in defined cases |
| Penalties | Up to Rs 250 crore per breach category in the Schedule | Up to 4 percent of global turnover or EUR 20 million |
| Children | Under 18, verifiable parental consent | Age of consent 13 to 16 set by each state |
| Regulator | Data Protection Board of India | Independent authority in each state |
Old regime versus new law (dpdpa vs gdpr and the)
| Aspect | SPDI Rules 2011 | DPDP Act 2023 |
|---|---|---|
| Applies to | Body corporates and only sensitive data | Any person, all digital personal data |
| Consent | Written consent for sensitive data | Free, specific, informed, clear consent for all |
| Rights | Limited review and correction | Access, correction, erasure, grievance, nomination |
| Enforcement | Adjudicating officers | Board with defined penalties |
| Breach duty | Reporting to CERT-In only | Report to Board and notify persons |
Click the memory hooks
Activity (5 minutes) (dpdpa vs gdpr and the)
If you already follow GDPR or ISO 27001, list two controls you can reuse (for example the data inventory and breach register).
Check your understanding of dpdpa vs gdpr and the
Q1. Does the DPDP Act have a separate category of sensitive personal data?
Q2. Does the DPDP Act provide a right to data portability?
Q3. Who must appoint a Data Protection Officer?
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.