If your organisation already runs a GDPR programme, most of it carries over to India's DPDP Act: the data map, security controls, processor contracts and rights process. What changes is specific. India has no "legitimate interests" or "necessary for a contract" ground (s. 4, 7), everyone under 18 is a child whose data needs verifiable parental consent and may not be used for tracking or targeted ads (s. 2(f), 9), and every breach of any size goes to the Data Protection Board and to each affected person (s. 8(6), Rule 7). Transfers abroad are allowed unless the government restricts a country (s. 16). Most DPDP duties start on 13 May 2027.
Like the Act (s. 2(y)), we say "she" and "her" for every person. GDPR articles are cited as "Art."; DPDP sections as "s."; DPDP Rules as "Rule".
Jump to what you need:
- DPOs and privacy counsel: The comparison table, Legitimate interests re-homed, Where the comparison is unclear.
- Programme owners with a GDPR stack: Reuse, adapt or build new, Effort, A dated plan.
- CISOs: Breach, Transfers.
- Indian IT, BPO and captive centres, and NGOs with European funders: Processing EU data from India, NGOs and EU donors.
The two laws side by side
| Topic | GDPR (Regulation (EU) 2016/679) | DPDP Act, 2023 and Rules, 2025 | What changes for you |
|---|---|---|---|
| Material scope | Automated processing, and manual records in a filing system (Art. 2(1)) | Digital personal data only, including paper records digitised later (s. 3(a)) | Paper files that stay on paper are out of DPDP scope |
| Territorial reach | Establishment in the EU; or offering goods or services to, or monitoring the behaviour of, people in the EU (Art. 3) | Processing in India; and processing abroad connected with offering goods or services to people in India (s. 3(a), 3(b)) | No "monitoring" hook; no local representative (cf. Art. 27) |
| Public data | Fully covered; Art. 9(2)(e) lifts the special-category bar for data "manifestly made public", a partial analogue | Data she made public herself, or that a law required to be published, is outside the Act (s. 3(c)(ii)) | A carve-out from the whole Act |
| Grounds | Six lawful bases, including contract and legitimate interests (Art. 6(1)) | Consent or a listed legitimate use (s. 4, 6, 7) | Re-map every contract and legitimate-interests purpose |
| Consent | Freely given, specific, informed, unambiguous; withdrawable as easily as given (Art. 4(11), 7) | Free, specific, informed, unconditional, unambiguous, clear affirmative action; limited to necessary data; withdrawal as easy (s. 6(1), 6(4)) | Similar test; plus Consent Managers (s. 6(7)–(9)) |
| Notice | For all processing, with a long content list (Art. 13, 14) | Tied to consent requests, with a shorter, itemised content list (s. 5, Rule 3) | Different trigger and content; English or an Eighth Schedule language (s. 5(3)) |
| Children | Under 16 for information society services on consent; states may lower to 13 (Art. 8(1)) | Under 18, for all processing; verifiable parental consent; no tracking, behavioural monitoring or targeted ads (s. 2(f), 9, Rule 10) | Build new age and parent flows |
| Sensitive data | Special categories and criminal-offence data, with extra conditions (Art. 9, 10) | No category; type of data affects penalty and SDF designation (s. 33(2)(b), 10(1)(a)) | Keep your tiering as risk practice |
| Rights | Access, rectification, erasure, restriction, portability, objection, and not to be subject to solely automated decisions (Art. 15–22) | Access, correction and erasure (for consent and s. 7(a) data), grievance, nomination (s. 11–14) | No portability, objection or restriction; add nomination |
| Response time | One month, extendable by two (Art. 12(3)) | Grievances within a published period of up to 90 days (Rule 14(3)); no period fixed for other requests | Publish and meet your own period |
| Records | Accountability; records of processing (Art. 5(2), 30) | Technical and organisational measures (s. 8(4)); no records article; burden of proving notice and consent (s. 6(10)) | Keep the record anyway, as evidence |
| DPO | Mandatory for public bodies, large-scale monitoring, or large-scale special-category or criminal-offence data (Art. 37(1)); member states may require more (Art. 37(4)) | Only for Significant Data Fiduciaries; India-based, responsible to the board (s. 10(2)(a)) | Others publish a contact person (s. 8(9)) |
| DPIA | Where processing is likely to result in a high risk (Art. 35) | Only for SDFs, every twelve months (s. 10(2)(c), Rule 13(1)) | Keep the method; it is voluntary for most |
| Joint control | Joint controllers need an arrangement, its essence made available, and rights exercisable against each (Art. 26) | "Alone or in conjunction with other persons" (s. 2(i)); no arrangement prescribed | Our view: each joint fiduciary carries every duty |
| Processors | Directly regulated and fineable (Art. 28, 82, 83) | Duties sit on the fiduciary; processor engaged under a valid contract (s. 8(1), 8(2)) | Your contracts carry the weight |
| Breach | To the authority within 72 hours where feasible, unless unlikely to result in risk; to people if high risk (Art. 33, 34) | Every breach, to the Board without delay plus a detailed report within 72 hours; to each affected person without delay (Rule 7) | No threshold; everyone is told |
| Transfers | Adequacy, appropriate safeguards or derogations (Art. 44–49) | Allowed unless the destination is restricted by notification (s. 16(1), Rule 15); stricter sector laws survive (s. 16(2)) | No SCCs needed for DPDP |
| Retention | Storage limitation (Art. 5(1)(e)) | Erase when purpose ends or consent is withdrawn (s. 8(7)); one-year minimum for data and logs (Rule 8(3)); fixed periods for large platforms (Third Schedule) | A floor as well as a ceiling |
| Penalties | Up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)) | Fixed caps per breach, up to ₹250 crore (Schedule); only for a "significant" breach after an inquiry and hearing (s. 33(1)) | No turnover link |
| Enforcement | National supervisory authorities, one-stop shop, EDPB (Art. 51, 56, 68); direct complaints (Art. 77) | One Board, a digital office (s. 18, 28); she must use your grievance route first (s. 13(3)); appeals to TDSAT (s. 29) | Your grievance desk is the front door |
| Compensation | Right to compensation from controller or processor (Art. 82) | None: penalties go to the Consolidated Fund of India (s. 34); civil courts barred (s. 39); IT Act s. 43A until 13 May 2027 | Different litigation exposure |
| Duties on individuals | None | Duties not to impersonate, suppress information or file frivolous complaints; penalty up to ₹10,000 (s. 15, Schedule) | New |
The DPDP side in full is in the DPDP Act and Rules guide; whether the Act reaches you is in Does the DPDP Act apply to you?.
No legitimate interests and no contract ground
Under the GDPR, most commercial processing rests on contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)). Neither exists in India. Section 4 allows processing on consent or for "certain legitimate uses", and the list in section 7 is closed. The nearest equivalents:
| GDPR basis | Closest DPDP basis | How close |
|---|---|---|
| Contract, Art. 6(1)(b) | Voluntary provision for a specified purpose, s. 7(a) | Narrower: the purpose she gave the data for, unless she objects. The Act's illustration, a pharmacy customer giving her number for a receipt, shows how narrow |
| Legal obligation, Art. 6(1)(c) | Disclosure required by law to the State, s. 7(d); court orders, s. 7(e); retention required by law, s. 8(7), 12(3) | Partial: no general "legal obligation" ground for collection |
| Vital interests, Art. 6(1)(d) | Medical emergency, epidemic, disaster, s. 7(f)–(h) | Close, but tied to emergencies |
| Public task, Art. 6(1)(e) | State functions and benefits, s. 7(b), 7(c) | Only for the State and its instrumentalities |
| Legitimate interests, Art. 6(1)(f) | None. Employers have s. 7(i); offence prevention has s. 17(1)(c) | Gap |
Employment is the one area where India is simpler. The GDPR has no employment basis; employers use contract, legal obligation or legitimate interests, and member states may add specific rules (Art. 88). Our view: s. 7(i), which covers employment purposes and protecting the employer from loss or liability, is simpler to apply.
Collection a law requires, such as KYC, is less tidy. The Act's illustration to s. 5(1) is a bank customer who opts into a live, video-based KYC process, with the bank's notice preceding the request: it treats KYC as processed on consent with a notice. The Act then lets you keep data a law requires (s. 8(7)) and continue after a withdrawal where a law requires it (s. 6(6)).
Common legitimate-interests uses, re-homed
Our assessment of where the usual GDPR legitimate-interests processing lands:
| Use under GDPR Art. 6(1)(f) | DPDP basis we would use | Note |
|---|---|---|
| B2B marketing to prospects | Consent; s. 7(a) only for what she asked for, such as a demo | No soft opt-in. That is an ePrivacy concept (Directive 2002/58/EC, Art. 13(2)) with no Indian counterpart |
| CCTV on premises | Employees: s. 7(i). Visitors: open question | No implied consent; give notice at the point of capture |
| Fraud prevention | s. 7(a), stated in the notice, for data she gave to use the service; s. 17(1)(c) for genuine detection of offences | Security and processor duties remain under 17(1) |
| Product analytics and A/B tests | Consent, or s. 7(a) where integral to the service she asked for | Third-party analytics SDKs rarely pass the 7(a) test |
| IT and network security logging | s. 7(a) for users' own activity on the service; s. 7(i) for staff | Rule 6(1)(c) requires the logs; the Act does not say which ground covers them |
| Intra-group administrative transfers (Recital 48) | Processor contract (s. 8(2)) for shared services; s. 7(i) for employee administration; consent for customer cross-use | No group exemption |
Retire your legitimate-interests assessments for India. Replace each with a one-line record of the s. 7 clause relied on, or a consent.
Consent, notice and anonymisation: what differs
The consent tests are close. DPDP's "unconditional" goes further than the GDPR, where making a service conditional on unnecessary consent is something to which "utmost account" must be given in judging whether consent is free (Art. 7(4)): on our reading of s. 6(1), conditional consent fails outright in India. The DPDP burden of proof covers the notice as well as the consent (s. 6(10)); the GDPR asks the controller to be able to demonstrate consent (Art. 7(1)).
Notice differs more. A GDPR privacy policy will not pass as a DPDP notice. The DPDP notice comes with or before each consent request, stands on its own (Rule 3(a)), itemises the data, and gives the specified purpose, the goods or services it enables, and the means to withdraw, exercise rights and complain to the Board (Rule 3(b)–(c)). The minimum list does not include retention periods or recipients, but Rule 3(b) asks for a "fair account" of what she needs to give informed consent, so include them where they matter. It must be available in English or any Eighth Schedule language (s. 5(3)). Copyable examples are in How to write a DPDP notice.
Anonymisation. The GDPR does not apply to anonymous information, and judges identifiability by the means "reasonably likely to be used" (Recital 26); pseudonymised data stays personal. The DPDP Act defines personal data as data about an individual "identifiable by or in relation to such data" (s. 2(t)) and says nothing about anonymisation or pseudonymisation; Rule 6(1)(a) mentions masking and tokens only as security measures. Our view: apply the Recital 26 test and record your re-identification testing, because the Act gives you nothing else to point to. For model training, see DPDP and AI.
Consent Managers have no GDPR counterpart. From 13 November 2026, Board-registered companies can let people give, review and withdraw consent across fiduciaries (s. 6(7)–(9), Rule 4); see Consent Managers under DPDP.
Children: 18, and a ban on tracking
The GDPR's Article 8 applies only where consent is the basis for information society services offered directly to a child. The DPDP Act applies to all processing of a child's data by any fiduciary (s. 9). Before processing, you need a parent's verifiable consent, with due diligence that the person consenting is an adult (identifiable where a law requires it), using reliable identity and age details you hold, details she provides, or a token such as DigiLocker's (Rule 10). Tracking, behavioural monitoring and targeted advertising directed at children are banned (s. 9(3)), outside the narrow Fourth Schedule exemptions (Rule 12).
For a GDPR-ready consumer service this is new build: age assurance up to 18, parent verification, and profiling and ad SDKs switched off for every child account, including 16- and 17-year-olds who could consent for themselves in much of Europe. Methods are in Verifiable parental consent.
Scope: public data, and no monitoring hook
Public data. The DPDP Act does not apply to data she made public herself, or that a law required someone to publish (s. 3(c)(ii)). The GDPR has no such exclusion. Do not import it into your EU processing, and read it narrowly in India.
Foreign adtech. The GDPR reaches a company outside the EU that monitors the behaviour of people in the EU (Art. 3(2)(b)), which catches trackers and data brokers. The DPDP Act's extra-territorial reach is limited to processing "in connection with any activity related to offering of goods or services" to people in India (s. 3(b)). Our view: a foreign ad network profiling Indian users for advertisers may fall outside s. 3(b) if it offers them nothing, though ads that promote goods to Indian users are arguably an activity related to offering them; either way the Indian website or app that embeds its tags is a fiduciary for the collection and needs consent for it. Audit your tags on that footing.
Joint control. Where the GDPR requires joint controllers to agree their responsibilities (Art. 26), the DPDP Act simply makes each one a fiduciary (s. 2(i)). Keep your Art. 26 arrangements; for India they decide who sends notices and handles requests, while, in our view, each party remains answerable for all of it.
Rights: fewer, and grievance first
The rights gap is in the table: no restriction, portability or objection right, and no right not to be subject to solely automated decisions. India adds grievance redressal (s. 13) and nomination (s. 14). Rights to access and erasure apply only to data processed on consent or under s. 7(a) (s. 11(1), 12(1)). The nearest thing to portability is a Consent Manager's duty to give a person her consent record in machine-readable form (First Schedule, Part B, item 4(b)).
Two details change your access and complaint process:
- Recipients by name. Article 15(1)(c) mentions "recipients or categories of recipient", though since Österreichische Post (C-154/21, 12 January 2023) a person can usually insist on identities. India requires the identities of every fiduciary and processor in every case (s. 11(1)(b)).
- Grievance first. A person must exhaust your grievance mechanism before going to the Board (s. 13(3)). Publish the means of making requests, the identifier you need (Rule 14(1)) and a grievance period of no more than 90 days (Rule 14(3)).
The Rules set no period for answering access, correction or erasure requests. We recommend 30 days, matching the GDPR month so one process serves both, and never longer than your published grievance period.
Breach: every breach, every person
| GDPR | DPDP | |
|---|---|---|
| Threshold | Notify the authority unless the breach is "unlikely to result in a risk" (Art. 33(1)) | None: any breach (s. 2(u), 8(6)) |
| Regulator | Without undue delay and, where feasible, within 72 hours (Art. 33(1)) | Without delay, a first intimation; within 72 hours, a detailed report, or later if the Board allows on written request (Rule 7(2)) |
| Individuals | Where likely to result in a high risk, with exceptions such as encryption (Art. 34) | Each affected person, without delay, through her account or a registered channel (Rule 7(1)) |
| Processors | Must notify the controller without undue delay (Art. 33(2)) | No processor duty in the Act; set it by contract |
The CERT-In Directions add a six-hour report for specified incidents, if they apply to you (CERT-In). Keep your GDPR risk assessment to shape what you tell people, but drop it as the test for whether to tell them. Templates and the combined clock are in DPDP breach response.
The EU may move further away. The Commission's Digital Omnibus proposal, COM(2025) 837 of 19 November 2025, would among other changes limit authority notification to high-risk breaches. As of 25 October 2026 it is before the European Parliament's ITRE and LIBE committees and has not been adopted (Legislative Observatory, 2025/0360(COD)).
Transfers: a blacklist instead of adequacy
The GDPR prohibits transfers outside the EEA unless a mechanism applies (Art. 44–49). The DPDP Act reverses the default: from 13 May 2027 data may go anywhere unless the government restricts the destination (s. 16(1)), and as of 25 October 2026 we have found no restriction notified. What remains:
- requirements the government may set on making data available to a foreign State (Rule 15);
- data an SDF is told to keep in India, with its traffic data (Rule 13(4));
- stricter sector rules, which survive (s. 16(2)), such as RBI's requirement that payment system data be stored only in India;
- until 13 May 2027, SPDI Rule 7 for sensitive personal data.
No transfer impact assessments or SCCs are needed for DPDP purposes. Keep a transfer register instead, so you can act within days if a country is restricted.
Penalties, enforcement and compensation
GDPR fines scale with turnover (Art. 83(4)–(5)). DPDP penalties are fixed caps per breach: up to ₹250 crore for security failures, ₹200 crore for breach-notice failures or the children's duties, ₹150 crore for SDF duties, the original breach's cap for breaking a voluntary undertaking, and ₹50 crore for anything else (Schedule). The government can raise them to at most twice the original amounts (s. 42). The Board can impose them only after an inquiry finds a breach "significant", and after a hearing (s. 33(1)). Both laws weigh gravity, duration, the data involved and mitigation (Art. 83(2); s. 33(2)). More in DPDP penalties.
The machinery differs more than the money. The Board can accept a voluntary undertaking that bars further proceedings on its contents (s. 32), send complaints to mediation (s. 31), and after penalties in two or more instances advise the government to block a service (s. 37). There is no compensation route: penalties go to the Consolidated Fund of India (s. 34) and civil courts cannot hear matters within the Board's remit (s. 39). Until 13 May 2027, IT Act s. 43A still lets people claim compensation from a body corporate negligent with sensitive personal data. As of 25 October 2026 we have found no Chairperson or Members of the Board appointed (LiveLaw).
Indian companies processing EU data
Where a person based in India processes personal data of people outside India under a contract with a person outside India, most of the DPDP Act does not apply: Chapter II (except s. 8(1) and 8(5)), Chapter III and section 16 are lifted (s. 17(1)(d)). Security safeguards and responsibility for processors remain. This is the clause that matters for Indian IT services, BPO and global capability centres.
What follows for such a firm:
- Your GDPR duties come by contract. The client's Art. 28 terms and the SCCs it signs with you (India has no adequacy decision) set your obligations, including breach notice to the client (Art. 33(2)) and sub-processor approval.
- DPDP keeps two duties. Section 17(1)(d) keeps the security and processor-responsibility duties (s. 8(1), 8(5)), but they bind the fiduciary. Whether an Indian processor carries them directly is unsettled. Our view: meet Rule 6 anyway, because your client's contract and any Board inquiry will expect it.
- Everything else is fully covered. Your own employees, Indian clients' data, and any EU client's data about people in India sit under the whole Act.
- Keep the streams separable. Tag data by client and by where the people are, so you can show which regime applies to each record.
International NGOs and EU donors
An Indian NGO funded by a European foundation is the fiduciary for its beneficiaries' data in India. Sending case stories, photos or beneficiary lists to the donor is a disclosure needing its own basis, usually separate consent given after she has seen how it will be used. From 13 May 2027, the transfer is allowed under s. 16; until then the SPDI Rules govern sensitive data held by body corporates, which may not include a trust or society. The donor's own handling of that data in the EU falls under the GDPR. Going the other way, a European parent or donor sending its staff or donor data to the Indian office needs a GDPR transfer tool such as SCCs. Our view: an Indian NGO soliciting individual donations from people in the EU may be "offering goods or services" to them under Art. 3(2)(a), so treat its EU donor data as within the GDPR. See DPDP for NGOs.
Reuse, adapt or build new: control by control
Our assessment of how a mature GDPR control set maps to DPDP.
| GDPR control | Verdict | What to do for DPDP |
|---|---|---|
| Record of processing (Art. 30) | Reuse | Add the DPDP basis, the fiduciary entity, digitised paper and WhatsApp data, and retention under Rule 8(3) |
| Lawful basis register | Adapt | Re-map every contract and legitimate-interests purpose to consent or a s. 7 clause |
| Legitimate interests assessments | Retire for India | Replace with the s. 7 clause and reasoning |
| Privacy notices | Adapt | Standalone Rule 3 notice at each consent request; Board complaint route; Scheduled languages |
| Consent capture | Adapt | Unbundled purposes; withdrawal that reaches processors (s. 6(6)); records that prove notice and consent |
| Cookie consent | Adapt | Keep reject-equal-to-accept; no legitimate-interests analytics |
| Subject access process | Adapt | Limit to consent and 7(a) data; name recipients; drop portability; add nomination |
| Grievance handling | Build new | Published period up to 90 days (Rule 14(3)); the front door before the Board |
| Children and age assurance | Build new | Under-18 parent verification (Rule 10); no tracking or targeted ads (s. 9(3)) |
| Notice to existing users | Build new | Section 5(2) notice campaign for data held on earlier consent (our guide) |
| DPIA method | Reuse | Mandatory only for SDFs; keep it for high-risk processing |
| DPO | Adapt | India-based and board-responsible if you are an SDF; otherwise a published contact |
| Breach playbook | Adapt | Remove the risk threshold; notify every person; two-stage Board report; CERT-In six hours |
| Processor contracts (Art. 28) | Reuse | Add Rule 6 security list, breach notice in hours, erasure (s. 8(7)(b)) and withdrawal (s. 6(6)); see Data fiduciary or processor? |
| SCCs and transfer impact assessments | Not needed for DPDP | Keep for EU data; add a transfer register for s. 16 and sector rules |
| Retention schedule | Adapt | One-year floor for data and logs (Rule 8(3)); Third Schedule periods and 48-hour warning if you are a large platform |
| Security programme (ISO/IEC 27001, 27701) | Reuse | Map to Rule 6; keep one year of logs; ISO/IEC 27701:2025 is now a standalone certifiable standard, and 2019-edition certificates are in transition |
| Special-category controls | Reuse | Keep as risk tiering |
| Automated decision safeguards (Art. 22) | Reuse | Keep human review; add accuracy evidence (s. 8(3)) |
| EU representative (Art. 27) | Not needed | Publish an India contact (s. 8(9)) |
How much of a GDPR programme carries over: our estimate
These are our planning estimates, not figures from any source. Our timeline guide estimates 57 to 118 person-weeks for a large organisation with roughly 20 to 60 systems holding personal data, starting from nothing. A team extending a mature GDPR programme, with a current Art. 30 record, working processor contracts and a rehearsed breach playbook, should need roughly 25 to 55 person-weeks for the same estate. Most of that goes on re-mapping bases, rewriting notices into Scheduled languages, the children's flow, the grievance desk and the section 5(2) campaign.
Where the comparison is unclear
These are our positions until the Board or the courts decide otherwise.
Does s. 7(a) cover what GDPR teams call "contract" processing? For processing integral to the service she asked for, yes; for anything beyond it, no. Why: s. 7(a) covers the specified purpose for which she gave the data, and the Act's illustration is narrow. Would change if: the Board reads 7(a) broadly in an early case. Confidence: medium.
Is there a basis for collection that a law requires? Rely on consent with a notice, as the s. 5(1) illustration does for KYC, or on 7(a), and on s. 8(7) and 6(6) to keep the data. Why: s. 7(d) covers disclosure to the State, not collection in general. Would change if: the Board accepts "required by law" collection as a legitimate use, or rules add one. Confidence: low.
Does the DPDP access right reach inferences and profiles? Yes, where they are part of the data processed on consent or 7(a). Why: data includes opinions (s. 2(h)), and the summary covers the "personal data which is being processed" (s. 11(1)(a)). Would change if: the Board reads "summary" as covering only data she provided. Confidence: medium.
Will the Board look to GDPR guidance? Partly, on shared concepts such as free consent. Why: the drafting borrows from the GDPR in places, but the Act differs deliberately on grounds, children and transfers. Would change if: early orders cite European authority, or pointedly avoid it. Confidence: low.
A dated plan for a team that already runs GDPR
| By | Step | Owner |
|---|---|---|
| Fri 20 Nov 2026 | Mark every purpose in the Art. 30 record that rests on contract or legitimate interests; decide consent or a s. 7 clause for each, with reasons | DPO with legal |
| Fri 18 Dec 2026 | Tag audit: list every third-party tag and SDK on Indian sites and apps, and decide which need consent | Product and marketing |
| Fri 29 Jan 2027 | Rule 3 notices drafted in English and the Scheduled languages your users read, with the Board complaint route | Legal with product |
| Fri 26 Feb 2027 | Children's flow live in test: age assurance to 18, Rule 10 parent verification, profiling off for child accounts | Product and engineering |
| Fri 12 Mar 2027 | Rights process updated: recipients by name, nomination, 30-day target; grievance period published | Privacy operations |
| Fri 2 Apr 2027 | Breach playbook changed to notify every breach and every person; processor contracts carry DPDP terms | CISO and procurement |
| Week of Mon 12 Apr 2027 | Breach drill against Rule 7 and CERT-In timings | CISO, legal, communications |
| Wed 12 May 2027 | Retention floor applied; section 5(2) notice campaign loaded for existing users | DPO |
For the full dated programme, see DPDP compliance deadline: 13 May 2027.
How we wrote this guide. We worked from the text of the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), and Regulation (EU) 2016/679 (GDPR). The EU adequacy list, the Digital Omnibus procedure and the Board's staffing come from the linked sources, last checked 25 October 2026. Effort figures are our estimates. Statements marked "our view" or "our assessment" are our judgement, not the law. This guide explains the law; it is not legal advice.
Questions people ask
Is India adequate for GDPR transfers?
No. As of 25 October 2026 India is not on the European Commission's list of countries with an adequacy decision. Personal data sent from the EU to India, including to an Indian group company or vendor, needs another transfer tool under Chapter V of the GDPR, usually the Commission's standard contractual clauses (Art. 46(2)(c)) or binding corporate rules (Art. 47). The DPDP Act does not change that, because adequacy is decided by the EU.
We are a foreign company with Indian customers and no Indian entity. Do we need a representative in India?
The DPDP Act has no equivalent of the GDPR's Article 27 representative. You are covered if your processing is connected with offering goods or services to people in India (s. 3(b)), and you must still publish a contact who can answer questions about your processing (s. 8(9), Rule 9) and run a grievance mechanism (s. 8(10)). The Board's ultimate lever against a fiduciary penalised in two or more instances is a recommendation to block public access to its service in India (s. 37).
Do we need a cookie banner for India?
India has no equivalent of the EU's ePrivacy Directive, which drives most cookie banners in Europe. The DPDP Act applies to cookies and similar identifiers only where they are personal data. In our view, advertising cookies then need consent; analytics cookies need consent unless the analytics are integral to the service she asked for (s. 7(a)); strictly necessary cookies that deliver that service can rest on s. 7(a). A banner that offers accept and reject on equal terms and itemises the data and purposes is the safest design.
Does either law protect data about people who have died?
The GDPR does not apply to deceased persons, according to its Recital 27, though member states may make their own rules. The DPDP Act is silent on the data of the dead as such, but it gives every person the right to nominate someone to exercise her rights after her death or incapacity (s. 14), and the Rules let her do so under the fiduciary's terms of service (Rule 14(4)). Build a nomination route into your rights process; it has no GDPR counterpart.