DPDP Act vs GDPR: what SaaS companies selling in India and the EU must know
LowerPlane serves startups in the United States, Singapore, India and worldwide. India's DPDP Act is consent-first, Consent-Manager-centric, and commences in phases through May 2027. The EU's GDPR is extraterritorial, offers six lawful bases, and has been fully enforced since 2018. SaaS teams can satisfy about 70% of DPDP from an existing GDPR programme; the irreducible additions are Consent Manager integration, verifiable parental consent and India-specific breach reporting.
India's Digital Personal Data Protection Act 2023, switched on by the Rules 2025, is the second major Asia-Pacific privacy regime most Western SaaS companies will have to meet alongside the EU's General Data Protection Regulation. The two laws are converging in direction but still different in detail. This piece walks through scope, consent model, rights, breach workflow, penalties, children's data and vendor management, and finishes with a control-overlap table you can use to extend an existing GDPR programme to DPDP without rebuilding.
Side-by-side comparison
| Factor | DPDP Act (India) | GDPR (EU) |
|---|---|---|
| Jurisdiction | India + any entity offering goods or services to data principals in India | EU/EEA + any establishment in the EU + Article 3(2) extraterritorial reach |
| Effective dates | Phase 1 live 13 Nov 2025; Consent Managers ~13 Nov 2026; substantive duties ~13 May 2027 | Fully applicable since 25 May 2018 |
| Lawful bases | Consent + narrowly defined “certain legitimate uses” | Six bases: consent, contract, legal obligation, vital interests, public task, legitimate interests |
| Core actors | Data Fiduciary, Data Processor, Consent Manager, Significant Data Fiduciary (SDF) | Controller, Processor, Supervisory Authority |
| Rights | Access, correction, erasure, grievance redressal, nomination | Access, rectification, erasure, restriction, portability, objection, Article 22 rights on automated decisions |
| Breach notification | Board “without delay” + principals; detailed report within 72 hours | Supervisory authority within 72 hours; data subjects if high risk |
| Cross-border transfers | Permitted unless central government restricts transfer to a notified country | Adequacy decisions, SCCs, BCRs, derogations — strict |
| Children's data | Verifiable parental consent for under-18s | Age of digital consent 13–16 depending on Member State |
| Regulator | Data Protection Board of India | National supervisory authority (EDPB coordinates) |
| Maximum penalty | INR 250 crore (~USD 30M) per instance for failure to prevent breach | €20M or 4% of worldwide turnover for most serious breaches |
Scope: who each law applies to
GDPR applies to processing of personal data in the context of the activities of an establishment in the EU, and (via Article 3(2)) to controllers and processors outside the EU where they offer goods or services to, or monitor the behaviour of, people in the EU. DPDP applies to processing of digital personal data within India and (Section 3) to processing outside India in connection with offering goods or services to data principals in India.
The practical consequence for a US SaaS: GDPR is triggered by a user signing up from Paris; DPDP is triggered by a user signing up from Pune. Both are extraterritorial and both bite SaaS companies with no in-country establishment.
Lawful bases: six vs two
GDPR gives you six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Legitimate interests is the workhorse basis most SaaS teams rely on for product analytics and security operations. DPDP collapses the landscape: consent is the default; narrowly defined “certain legitimate uses” under Section 7 cover specific categories (voluntary provision for a stated purpose, employment, medical emergencies, public interest responses, breakdowns in public order).
The upshot: processing you justify under GDPR's legitimate interests may need consent under DPDP. Map every GDPR Article 6(1)(f) processing in your ROPA back to a DPDP basis before Phase 3 lights up.
Consent Managers: the India-only architecture
DPDP introduces an architecture GDPR does not have: the Consent Manager. Rule 4 of the DPDP Rules 2025 (live from about 13 November 2026) establishes a registered, data-fiduciary-neutral, interoperable platform through which data principals grant, review, modify and withdraw consent across all the Data Fiduciaries they interact with. Think of it as the privacy equivalent of UPI or DigiLocker.
For a SaaS, this is new build: your product has to receive, honour and revoke consent signals from registered Consent Managers via APIs. There is no analogue in GDPR and no shortcut; see the DPDP Rules timeline for the Consent Manager phase in context.
Rights: convergent with gaps
Both laws grant access, correction and erasure. GDPR adds restriction of processing, portability (Article 20) and the Article 22 right not to be subject to a solely automated decision with legal or similarly significant effect. DPDP adds nomination — the right for a data principal to nominate another person to exercise their rights in the event of death or incapacity.
If you have a GDPR DSR portal, you can extend it to DPDP by adding nomination intake and India-locale handling. The 30-day response time GDPR expects maps cleanly onto what the DPDP Rules will enforce.
Breach workflow: 72 hours on both, but different reports
Both laws have a 72-hour horizon. GDPR requires notification to the lead supervisory authority within 72 hours of becoming aware of a personal data breach, and notification to data subjects when the breach is likely to result in a high risk. DPDP requires notification to the Data Protection Board “without delay” and to affected data principals, with a detailed report within 72 hours covering nature, cause, consequences and remediation.
The build item: an India-specific template for the Board report that captures the extra detail DPDP expects, and a workflow that fires both notifications in parallel when a breach touches EU and Indian principals. See the DPDP framework page for the full workflow.
Cross-border transfers
GDPR's transfer regime is one of the strictest in the world: adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules and narrow derogations. DPDP flips the default: transfers are permitted unless the central government, by notification, restricts transfer of personal data to a specified country or territory.
For a US SaaS with Indian users, this means transfers out of India are permissive today, with a watch-list to monitor. For a US SaaS with EU users, the Schrems-driven transfer discipline you already run continues.
Children's data
DPDP is one of the strictest children's-data regimes in the world: anyone under 18 is a child, and verifiable parental consent is required to process their personal data, with exceptions for health, education and child welfare. GDPR's baseline is 16, with Member States free to go as low as 13, and relies on “reasonable efforts” to verify parental consent for information society services offered directly to children.
If your product can be used by anyone under 18 in India, the Phase 3 Rules will force a verifiable parental consent flow you probably do not have in your EU implementation.
Control overlap: how much GDPR gets you
| Control area | GDPR evidence that transfers | DPDP-specific addition |
|---|---|---|
| Record of processing | Article 30 ROPA | Add India-specific processing columns |
| Notice at collection | GDPR Articles 13 and 14 notice copy | Rule 3 formatting + grievance link |
| Consent capture | Granular consent UI and audit trail | Consent Manager API integration |
| Rights handling | DSR portal with 30-day SLA | Add nomination intake |
| Breach notification | 72-hour supervisory authority workflow | Board report template + detailed report format |
| Security safeguards | Article 32 technical and organisational measures | No material change — map to Rule 6 |
| Vendor management | Article 28 DPAs | Reframe as Data Processor contract |
| Children's data | 13–16 age gate + reasonable-efforts verification | Verifiable parental consent for under-18s |
| DPO | DPO where thresholds met | India-resident DPO if designated SDF |
Which law to prioritise
If you're a US SaaS with EU customers today and Indian customers tomorrow, prioritise GDPR — it's already enforceable and most audit frameworks (SOC 2 Privacy, ISO 27701) map to it. Then layer DPDP using the overlap table above on a six-month runway to May 2027.
If you're an Indian SaaS with Indian customers today and expanding to Europe, GDPR is a step change rather than an addition — the lawful-basis mapping, DPO duties, cross-border transfer discipline and higher accountability expectations will take 3–6 months to stand up.
Frequently asked questions
Which is stricter: DPDP or GDPR?
The two laws are strict in different places. GDPR is broader on lawful bases (six including legitimate interests), stricter on transfer rules out of the EEA, and much more mature on regulator guidance. DPDP has a tighter consent regime (consent is the default lawful basis, with a narrower "certain legitimate uses" category), introduces a unique Consent Manager architecture, and leans heavily on sectoral rules through the Rules 2025. Penalty maxima are comparable in effect.
If we are already GDPR compliant, how much extra work is DPDP?
For most SaaS companies, about 25–35% additional work. You already have ROPA, DPA templates, breach workflow, DSR plumbing, and most of the security safeguards. The irreducible DPDP-only build is Consent Manager API integration, verifiable parental consent for under-18s, India-resident DPO if designated as a Significant Data Fiduciary, and India-specific Board notification wording. See the three-phase timeline in our DPDP Rules timeline post.
Does GDPR cover Indian data principals?
Only if the Indian individual is in the EU when processed, or if your establishment in the EU is processing their data, or if you otherwise fall under Article 3's extraterritorial reach. GDPR is territory-based: processing of personal data of people in India by a non-EU controller does not trigger GDPR by itself.
What is a Consent Manager and does GDPR have one?
A Consent Manager under India's DPDP Act is a central, interoperable, data-fiduciary-neutral platform through which data principals grant, review, modify and withdraw consent across Data Fiduciaries. GDPR has no equivalent concept — consent is managed bilaterally between each controller and the data subject. The Consent Manager regime is a DPDP-only build item.
How do breach notifications compare?
GDPR requires notification to the supervisory authority within 72 hours (where feasible) and to affected data subjects if there is a high risk. DPDP requires notification to the Data Protection Board "without delay" and to each affected data principal, with a detailed report following within 72 hours. The 72-hour clock exists in both, but the triggers and content differ.
What are the fines side by side?
GDPR maxima: €20 million or 4% of worldwide annual turnover for the most serious breaches. DPDP maxima: INR 250 crore (about USD 30 million) for failure to prevent a personal data breach, INR 200 crore for failure to notify, INR 50 crore for children's data violations. DPDP applies per instance of failure; GDPR applies per breach.