Grounds for processing
The GDPR offers six lawful bases, including legitimate interests. The DPDP Act allows processing on consent or for certain legitimate uses listed in section 7, such as employment purposes, medical emergencies, legal obligations and data a person voluntarily provides for a specified purpose. There is no general legitimate interests ground.
A team that relies on legitimate interests in Europe for fraud analytics or direct marketing will need to find a DPDP ground for the same processing in India, which often means consent.
Sensitive data and children
The DPDP Act has no separate category of sensitive or special category data. All personal data is treated alike, although the Board considers the type and nature of data when setting a penalty.
A child is anyone under 18, and you need verifiable consent of a parent or lawful guardian. The GDPR lets member states set the age for consent to online services between 13 and 16. The DPDP Act also bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the Rules.
Rights and breaches
The DPDP Act gives rights to information, correction, completion, updating and erasure, grievance redressal and nomination. It has no right to data portability. Consent can be withdrawn at any time, as under the GDPR.
Breach notification is wider. Every personal data breach must be reported to the Board and to each affected person, with no risk threshold, and a detailed report is due to the Board within 72 hours of becoming aware.
Enforcement and penalties
The Data Protection Board of India inquires into breaches and complaints and imposes penalties. Its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal. Penalties are fixed maximum amounts for each type of breach in the Schedule, up to 250 crore rupees, and are not linked to turnover.
What you can reuse from GDPR work
Your record of processing activities is a good base for the DPDP inventory. Processor contracts, breach runbooks and DPIA templates can be adapted. Notices and consent flows usually need the most change, because the grounds differ and the Rules set what a notice must contain and the languages it is offered in.
How TrustOS helps
TrustOS lets you import an existing register, map each activity to a DPDP ground, and flag where a GDPR legitimate interests basis has no direct equivalent. Notices, consent records, rights requests and breach clocks then run on the DPDP timings.
TrustOS does not decide which ground applies to an activity or whether your GDPR position holds in India. Those calls stay with your counsel, and TrustOS does not replace legal advice.
DPDP Act and Rules compared with the GDPR, in summary
| Topic | DPDP Act and Rules | GDPR |
|---|---|---|
| Data covered | Digital personal data, including paper records once digitised | Personal data processed by automated means or held in a filing system |
| Grounds for processing | Consent, or certain legitimate uses listed in section 7 | Six lawful bases, including legitimate interests |
| Sensitive data | No separate category | Special categories with extra conditions |
| Children | Under 18, with verifiable consent of a parent or lawful guardian | Age for consent to online services set by member states between 13 and 16 |
| Data portability | No portability right in the Act | Right to data portability |
| Breach notification | Every breach, to the Board and affected people, with a detailed report within 72 hours | To the authority within 72 hours unless unlikely to result in risk, and to people when the risk is high |
| Regulator | Data Protection Board of India, with appeals to the Appellate Tribunal | A supervisory authority in each member state |
| Penalties | Fixed maximum amounts per type of breach, up to 250 crore rupees | Up to 20 million euros or 4% of worldwide annual turnover, whichever is higher |
| Transfers abroad | Allowed unless restricted to a notified country, with stricter Indian laws still applying | Allowed with an adequacy decision or appropriate safeguards |
Official sources
- MeitY: Data protection framework (the Act, the Rules and notifications)
- India Code: Digital Personal Data Protection Act, 2023
This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.