Compare requirements across 12 critical compliance areas
EU residents globally - extraterritorial reach
India residents globally - similar extraterritorial application
99 detailed articles with extensive requirements
44 sections - more concise and principle-based
6 lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests
Primarily consent-based with limited exceptions
8 comprehensive rights including portability and automated decision-making
5 data principal rights: access, correction, erasure, grievance redressal, nominate representative
Explicit, informed, freely given consent with specific requirements
Free, specific, informed, unconditional, and unambiguous consent - very strict
Each EU member state has supervisory authority
Central Data Protection Board of India
72 hours to authority, without undue delay to individuals
Must notify Data Protection Board - timeline to be specified
Up to €20M or 4% of global annual revenue
Up to ₹250 crores (~$30M USD)
No data localization requirements
Cross-border transfer restrictions - government approval required for certain countries
16 years (member states can lower to 13)
18 years - requires verifiable parental consent
Data controller and processor framework
Data fiduciary and data processor - similar but different terminology
Limited exemptions for household activities
Broader exemptions for government, research, and small businesses
Critical distinctions for compliance planning
DPDP Act is heavily consent-centric, while GDPR offers 6 lawful bases. Organizations under DPDP must obtain explicit consent for most processing activities.
DPDP Act includes data localization requirements with government approval needed for transfers to certain countries, unlike GDPR which focuses on adequacy decisions.
DPDP sets age of consent at 18 (vs GDPR's 16), requiring verifiable parental consent for all minors - a significant operational challenge.
GDPR has multiple supervisory authorities across EU member states, while DPDP has a centralized Data Protection Board of India.
In ReadyGDPR, both GDPR (36 controls) and DPDP (31 controls) are adoptable, each with its own control catalogue quoted from its own instrument.
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.