DPDP vs GDPR — Key Differences for Indian SaaS Serving Global Customers

Scope — what each law covers

DPDP Act 2023 covers digital personal data of data principals within India, processed by data fiduciaries in India OR offering goods/services to data principals in India (extra-territorial). Paper records explicitly excluded. GDPR covers personal data of EU data subjects regardless of where processing happens (full extra-territorial reach), including paper records that are part of a filing system. For an Indian SaaS serving EU customers, GDPR applies even if your processing is entirely on Indian infrastructure.

Terminology mapping

Different words for similar concepts — translate carefully when reading either statute:

• DPDP 'data fiduciary' ≈ GDPR 'controller'
• DPDP 'data principal' ≈ GDPR 'data subject'
• DPDP 'data processor' ≈ GDPR 'processor'
• DPDP 'consent manager' has no direct GDPR equivalent (Indian-specific innovation)
• DPDP Schedule I ≈ GDPR Article 32 (security of processing)
• DPDP Data Protection Board ≈ GDPR Supervisory Authority

Data principal / subject rights — overlap and gaps

Overlap: both grant right to access, correction, erasure, and grievance redressal. GDPR adds: right to data portability (machine-readable export of your data), right to object to processing, right to restrict processing, right not to be subject to solely automated decision-making (including profiling). DPDP currently has fewer rights but the Data Protection Board can expand via rules. If you serve both regions, build for the GDPR superset — DPDP compliance is satisfied as a subset.

Consent — flatter vs tiered

DPDP has a flatter consent model — explicit consent for all personal data processing, no special-category tier. GDPR has a tiered model: regular personal data needs lawful basis (consent is one of six); special categories (health, biometric, race, religion, sexual orientation, political opinion, etc.) need explicit consent and have stricter rules. For GDPR, build a separate special-category consent flow. For DPDP only, single consent flow suffices.

Breach notification — clock comparison

GDPR Article 33: notify the supervisory authority within 72 hours of awareness. Article 34: notify data subjects directly if breach poses high risk. DPDP draft rules: notify Data Protection Board 'without undue delay' (interpreted as 72 hours). Notify data principals if significant harm likely. The clocks align. Build one breach response runbook that hits both notifications.

Cross-border data transfer

DPDP allows cross-border transfers except to countries blacklisted by the Central Government (no public blacklist as of writing). GDPR Chapter V is much stricter: transfers outside the EU require an adequacy decision (countries pre-approved as 'adequate'), Standard Contractual Clauses (SCC), Binding Corporate Rules (BCR), or derogations. India does not have an EU adequacy decision (as of writing). Indian SaaS serving EU customers typically rely on the EU SCC for processing EU data on Indian infrastructure.

Penalties — caps and calibration

DPDP Act 2023: up to ₹250 crore per Schedule penalty. The Data Protection Board calibrates the band based on aggravating factors (concealment, significant harm, repeated violation) and mitigating factors (prompt notification, control evidence, principal-benefit measures). GDPR Article 83: up to €20 million or 4% of global annual turnover, whichever is higher — for the most serious violations. Lower tier: €10 million / 2% of global turnover. Member State supervisory authorities have similar discretion in calibration.

What Indian SaaS serving EU customers should build

On top of a DPDP-compliant programme, add the following GDPR-specific items:

• Special-category consent flow with explicit consent capture for health / biometric / race / religion / political data
• Data portability export feature — machine-readable download of all personal data for a subject on request
• DPIA template + workflow for high-risk processing (large-scale processing of special categories, large-scale public monitoring, automated decision-making with significant effect)
• EU representative appointment (per GDPR Article 27) — typically a contracted EU-based law firm
• Standard Contractual Clauses (SCC) signed with each EU controller transferring data to your Indian infrastructure
• Privacy notice published in the language(s) of the EU member states you serve