Compare requirements across 12 critical areas
California residents only - no extraterritorial reach
India residents globally - extraterritorial application
Opt-out model - process first, allow opt-out
Consent-based - must obtain consent before processing
Implied consent with opt-out for data sales
Explicit, free, specific, informed, unconditional consent required
4 core rights: know, delete, opt-out of sale, non-discrimination
5 data principal rights: access, correction, erasure, grievance, nominate representative
13 years with parental consent required
18 years - strict verifiable parental consent
$7,500 per intentional violation, $2,500 unintentional
Up to ₹250 crores (~$30M USD)
Yes - consumers can sue directly for breaches
No - complaints through Data Protection Board only
'Do Not Sell My Personal Information' link required
Generally prohibited without specific consent
No specific timeline - reasonable timeframe
Must notify Data Protection Board - timeline TBD
No data localization requirements
Cross-border transfer restrictions - government approval required
$25M revenue OR 100K+ consumers OR 50%+ revenue from data sales
Applies to all data fiduciaries processing Indian resident data
45 days (extendable by 45 days)
Timeline to be specified by regulations
Understanding the core philosophical differences
CCPA uses an opt-out model (collect first, allow opt-out), while DPDP requires explicit consent before processing - a fundamental operational difference.
CCPA allows private lawsuits for data breaches, giving consumers direct legal recourse. DPDP channels all complaints through the centralized Data Protection Board.
DPDP has extraterritorial reach (like GDPR), applying to Indian residents globally. CCPA only applies to California residents within the US.
In ReadyGDPR, both CCPA/CPRA (22 controls) and DPDP (31 controls) are adoptable, each with its own control catalogue quoted from its own instrument.
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.