India’s Data Protection Law (DPDP Act 2023) Explained for International Readers

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first comprehensive data protection statute, and it is frequently compared to the EU’s GDPR, correctly in some respects, but with real structural differences worth knowing before assuming GDPR compliance automatically satisfies Indian law.

Scope: broader territorial reach than GDPR in one sense, narrower in another

The Act applies to processing of digital personal data within India, and also to processing outside India if it relates to offering goods or services to individuals in India, similar in spirit to GDPR’s extraterritorial reach. However, unlike GDPR, the DPDP Act currently covers only digital personal data, not the parallel protections GDPR extends to data processed by non-automated means, a narrower scope foreign compliance teams sometimes miss.

Consent and “legitimate uses”

Processing generally requires the data principal’s (data subject’s) consent, given through a clear notice. But the Act also carves out defined “legitimate uses” that do not require consent, such as for specified purposes like medical emergencies, employment, or compliance with other Indian law, a broader consent-free category than GDPR’s narrower “legitimate interest” basis, which still requires a balancing test.

A Data Protection Board, not an independent regulator on the European model

Enforcement sits with the Data Protection Board of India, which handles breach determinations and penalties, but its members are appointed by the central government, a structural difference from the more independent data protection authorities found in EU member states, something researchers comparing regulatory independence frequently flag.

Significant Data Fiduciaries and cross-border transfer

Entities processing large volumes of sensitive data can be designated “Significant Data Fiduciaries” with extra obligations (data protection officer, data audits). Cross-border data transfer is allowed by default except to countries the central government specifically restricts by notification, the reverse default from GDPR’s “adequacy” model, which restricts transfer by default unless a safeguard applies.

Lexfolio’s AI Law and Governance course covers the DPDP Act’s practical compliance requirements in more depth for readers who need working knowledge rather than a comparative overview.