Core differences at a glance
| Compliance Area | Indian DPDP Act, 2023 | EU General Data Protection Regulation (GDPR) |
|---|---|---|
| Lawful Bases for Commercial Processing | Exclusively Consent or limited Certain Legitimate Uses (e.g. voluntary provision for specified purpose, medical emergencies, employment, legal compliance). No broad commercial "legitimate interest" basis. | Six flexible lawful bases: Consent, Contract Performance, Legal Obligation, Vital Interests, Public Task, and Legitimate Interests (Article 6(1)(f)). |
| Definition of a Child | An individual who has not completed 18 years of age. Stricter parental consent and age verification required. | Generally under 16 years (member states can lower to 13 years for information society services). |
| Personal Data Breach Notification | No-threshold rule: Data Fiduciary must notify DPBI and every affected individual for all personal data breaches under Rule 7 (72-hour detailed report). | Report to supervisory authority within 72 hours unless unlikely to result in risk; notify individuals only if breach presents a high risk to rights. |
| Maximum Financial Penalties | Up to ₹250 crore (approx. €27M) per failure to take reasonable security safeguards under Schedule. | Up to €20 million or 4% of global annual turnover, whichever is higher (Article 83). |