Scope and Applicability
The GDPR, enacted in 2018, applies to all organizations processing personal data of EU residents, regardless of where the organization is located. This extraterritorial reach has made GDPR the de facto global standard for data protection, influencing privacy legislation worldwide including India Digital Personal Data Protection Act (DPDPA) of 2023.
The DPDPA applies to the processing of digital personal data within India, as well as processing outside India if it relates to offering goods or services to individuals in India. While the scope is similar to GDPR, the DPDPA takes a more principles-based approach with fewer prescriptive requirements, giving organizations more flexibility in implementation.
A key distinction is that the DPDPA applies exclusively to digital personal data, whereas GDPR covers both digital and non-digital (paper-based) personal data processing. This narrower scope reflects the Indian legislature focus on addressing the rapid digitalization of the Indian economy.
Consent and Data Principal Rights
Both frameworks emphasize informed consent as the primary legal basis for processing personal data, but they differ in their approach to consent mechanisms. GDPR provides six legal bases for processing, including legitimate interest and contractual necessity, while the DPDPA relies primarily on consent and certain deemed consent scenarios.
The DPDPA introduces the concept of "deemed consent" for situations where data processing is reasonably expected, such as voluntary data provision or processing for state functions. This is somewhat analogous to GDPR legitimate interest basis but is more narrowly defined.
Data principal rights under both frameworks include the right to access, correction, and erasure of personal data. However, the DPDPA includes a unique provision requiring data principals (individuals) to fulfill certain duties, such as not filing false complaints and providing accurate information, a concept absent from GDPR.
Penalties and Enforcement
GDPR penalties can reach up to 4% of global annual turnover or EUR 20 million, whichever is higher, making it one of the most stringently enforced privacy regulations globally. The DPDPA takes a different approach with specific penalty amounts for different types of violations, with the maximum penalty set at INR 250 crores (approximately EUR 27 million).
The enforcement mechanisms also differ significantly. GDPR is enforced by independent Data Protection Authorities in each EU member state, while the DPDPA establishes a Data Protection Board of India as the central enforcement body. The DPDPA Board will operate as a digital office, with proceedings conducted primarily online.
Organizations operating across both jurisdictions must navigate the interplay between these frameworks, particularly regarding cross-border data transfers. While GDPR relies on adequacy decisions and Standard Contractual Clauses, the DPDPA empowers the Indian government to restrict data transfers to specific countries through notification.
Practical Steps for Dual Compliance
Organizations subject to both GDPR and DPDPA should adopt a unified privacy management framework that addresses the requirements of both regulations. Starting with GDPR compliance as the baseline is often the most efficient approach, as GDPR requirements generally encompass most DPDPA requirements.
Key areas requiring specific attention for DPDPA compliance include updating consent mechanisms to align with deemed consent provisions, establishing procedures for children data protection (the DPDPA sets the age threshold at 18, compared to GDPR 16), and implementing mechanisms to comply with data localization requirements that may be notified by the Indian government.