A Comparative Analysis Of India’s Digital Personal Data Protection Act
Introduction
India ushered in a new era of digital governance with the passage of the Digital Personal Data Protection Act (DPDPA) in 2023, followed by its detailed implementation rules in 2025. This landmark legislation establishes the country’s first comprehensive framework for protecting the personal data of its over a billion citizens. The DPDPA sets out the rights of individuals, known as Data Principals, and the obligations of organisations, called Data Fiduciaries, that process this data. To truly understand the significance and character of India’s new law, it is essential to place it alongside the established data protection regimes of other major global powers, namely the European Union’s General Data Protection Regulation (GDPR), the United States’ California Consumer Privacy Act (CCPA), and China’s Personal Information Protection Law (PIPL). This comparison reveals that India has crafted a distinct path that reflects its unique socio-economic priorities.
Core Philosophy
The fundamental goal of a data protection law shapes all its provisions. The European Union’s GDPR is founded on the principle that privacy is a fundamental human right. This philosophy results in a robust, individual-centric law that places ultimate control in the hands of the data subject. In contrast, the United States, with its lack of a single federal law, takes a market-driven approach focused on consumer protection and preventing harm, as seen in California’s CCPA, which operates on an “opt-out” model for the sale of data. China’s PIPL, while strict, is primarily a tool for state control and national security, emphasising data sovereignty and government access.
India’s DPDPA carves out a middle path, championing a pragmatic and balanced philosophy. It aims to protect individual privacy while explicitly fostering the growth of the digital economy and enabling data-driven governance. This is evident in its language, which is simpler than the GDPR, and in its creation of broad exemptions for the State, allowing it to process data for delivering services, subsidies, and licenses without necessarily requiring consent. This makes India’s approach less rigid than the EU’s and more centralised and state-friendly than the US’s fragmented model.
Scope and Lawful Bases for Processing Data
In terms of scope, both the DPDPA and the GDPR apply extraterritoriality, meaning they can govern entities outside their borders if they process data of their residents. However, the DPDPA’s scope is limited to digital personal data or digitised non-digital data, whereas the GDPR covers all forms of personal data.
A critical area of difference lies in the lawful bases for processing data. The GDPR provides a limited set of justifications, including explicit consent, contractual necessity, and a narrow “legitimate interests” clause that requires a balancing test. India’s DPDPA also mandates “verifiable consent” as a primary basis, with the 2025 Rules providing specific guidance for obtaining it from children and individuals with disabilities. However, it introduces a significant exception through the concept of “legitimate uses.” This provision allows processing without consent for purposes like voluntary data sharing by an individual and, most notably, for the State to provide benefits, services, licenses, and subsidies. This gives the Indian government far greater latitude than the GDPR allows to European governments.
Rights of the Individual
The rights granted to individuals are the heart of any privacy law. The GDPR provides a powerful suite of rights, including access, correction, erasure (the “right to be forgotten”), data portability, and the right to object to automated decision-making. The CCPA focuses on the right to know, delete, and optout of the sale of personal information.
The Indian DPDPA grants Data Principals several core rights: the right to access a summary of their data, the right to correct inaccuracies, the right to erasure, and the right to an effective grievance redressal mechanism. However, it notably omits two rights considered fundamental in the EU: the right to data portability, which allows users to move their data between services, and the right to object to automated processing, which provides a safeguard against decisions made solely by algorithms without human intervention. This results in a more limited, though still significant, set of individual controls compared to the GDPR.
Obligations on Organisations
The DPDPA places clear duties on Data Fiduciaries. All entities must provide clear notice, implement reasonable security safeguards to prevent data breaches, and intimate both the Data Protection Board and affected individuals in case of a breach. A defining feature of the Indian law is its creation of a special category called Significant Data Fiduciaries (SDFs). The government can classify entities as SDFs based on the volume and sensitivity of data they process. These SDFs have additional obligations, such as appointing a Data Protection Officer (DPO), conducting periodic Data Protection Impact Assessments (DPIAs) and audits, and adhering to stricter data localisation mandates for certain types of data.
This differs from the GDPR, where obligations like DPIAs and DPO appointments are triggered by the nature of the processing activity itself and apply to a much wider range of organisations, not just a state-notified subset. The CCPA’s obligations are primarily centred on transparency and responding to consumer requests, without generalised requirements for DPIAs or DPOs.
Cross-Border Data Transfers
The rules for transferring personal data across national borders are key differentiators. The EU employs an “adequacy” model, where data can flow freely to countries the European Commission deems to have privacy standards equivalent to its own. For other countries, complex mechanisms like Standard Contractual Clauses are required.
China adopts the strictest approach with a “localisation” model. The PIPL mandates that important data must be stored within China, and any cross-border transfer requires passing a government security assessment. India’s DPDPA introduces a “whitelisting” approach. It empowers the Central Government to notify countries to which data transfers are permitted. This gives the government significant control and flexibility but creates uncertainty until the list is published. Furthermore, as mentioned, SDFs can be subject to specific restrictions on transferring certain sensitive data outside India.
Enforcement and Penalties
The enforcement mechanisms also vary. The GDPR is enforced by independent Data Protection Authorities in each EU member state, which can levy massive fines of up to 4% of global annual turnover. China’s law is enforced by the powerful Cyberspace Administration of China (CAC).
India establishes the Data Protection Board of India (DPBI) as the independent adjudicatory body. The 2025 Rules emphasise that the DPBI will function as a “digital office,” leveraging technology for its proceedings. The DPDPA prescribes a tiered penalty structure with fines that can go as high as ₹250 crores (approximately $30 million) per violation, signalling a serious intent to enforce compliance.
Conclusion
In conclusion, India’s Digital Personal Data Protection Act represents a significant step forward, establishing a much-needed legal framework for the digital age. It is not a copy of the EU’s fundamental rights-based. Instead, the DPDPA is a uniquely Indian construct—a pragmatic, sovereignty-focused framework that seeks to balance individual privacy with economic growth and state interests. Its simplified language, focus on Significant Data Fiduciaries, whitelisting approach to data transfers, and broad exemptions for the government mark it as a distinct middle path. The ultimate success of this law will depend on the effectiveness of the Data Protection Board of India and the clarity brought by subsequent government notifications, which will shape the real-world impact of this foundational legislation.
- - NAMAN SINGHAL - Student, 2nd Year
- National Law University
- Himachal Pradesh, Shimla,(H.P.)