67%
of India's 21 requirements are already met by European Union (GDPR). Here is what DPDP Act adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
DPDP Act adds3 Consent is the default basis; processing without consent only for listed 'legitimate uses' (s.7). No general legitimate interests ground.
ss.4(1), 7 · source ↗
RetentionGovernanceBig gap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
DPDP Act adds3 Erase when purpose ends or consent is withdrawn; large e-commerce, gaming and social platforms must erase after three years of inactivity with 48 hours' notice.
s.8(7); Rule 8; Third Schedule · source ↗
LocalizationTransfersBig gap
GDPR– Not addressed
DPDP Act adds2 Significant Data Fiduciaries must keep government-specified personal data in India; sectoral regulators may impose more.
Rule 13(4); s.16(2) · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
DPDP Act adds3 Child means under 18; verifiable parental consent required; no tracking, behavioral monitoring or targeted advertising directed at children.
ss.2(f), 9; Rule 10 · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
DPDP Act adds2 DPO must be based in India and answer to the board; no qualification or certification prescribed.
s.10(2)(a) · source ↗
Tell the regulatorBreachesGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
DPDP Act adds3 Intimate the Board without delay, then a detailed report within 72 hours of becoming aware.
s.8(6); Rule 7(2) · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
DPDP Act adds3 Inform each affected data principal of every breach without delay, regardless of risk level.
s.8(6); Rule 7(1) · source ↗
Already covered by GDPR: Reach abroad, Consent, Sensitive data, Rights, Request deadline, Marketing, DPO required, Registration, DPIA, Records, Transfers abroad, Maximum fine, Criminal liability, Private action.
A gap means DPDP Act is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
