A Comparative Analysis Of GDPR And DPDP Act

Author: LawSphereX

Category: General Law

Published: 2026-08-23T16:53:14.254668+00:00

Updated: 2026-08-30T07:08:23.021Z

A

COMPARATIVE

ANALYSIS

OF GDPR AND DPDP ACT Mohamamduzef Diwan, National Forensic Sciences University Introduction Data has emerged as a vital asset for corporations, governments, and individuals in the generation of virtual transformation. But, the proliferation of records has also raised vast privacy and data protection issues. Various regulatory frameworks were made to deal with these concerns, especially the General Data Protection Regulation (GDPR) within the EU and the Data Protection and Digital Privacy (DPDP) Act in India. The GDPR, which came into effect in 2018, has set a worldwide benchmark for data protection and privacy regulations. It intends to protect people's personal data inside the E. U and regulate the processing and motion of personal data past the EU's borders1.

On the other hand, the DPDP Act, enacted in 2023, is India's complete legislation geared toward safeguarding the privacy and personal data of its citizens. The DPDPA will replace India’s current patchwork of data protection regulations2. GDPR has a huge effect on the development of the DPDPA, 2023. whilst each regulations share the common intention of protecting personal data, they diverge in several ways, consisting of scope, territorial applicability, and facts difficulty rights. This research paper aims to conduct a comparative evaluation of the GDPR and the DPDP Act, furthermore, this research pays precise attention to the challenges associated with the DPDP Act. As a new law, the DPDP Act may additionally lack the clarity and established enforcement mechanisms present in GDPR.

Figuring out those challenges can be crucial in considering the effectiveness of the DPDP Act in safeguarding individual privacy in India3. 1 Rights of the Individual, European Data Protection Supervisor, https://www. edps. europa. eu/dataprotection/our-work/subjects/rights-individual_en (last visited June 2, 2024). 2The information technology act § 43 and 87(2)(ob) and Information technology (reasonable security practices and procedures and sensitive personal data or information) rules, 2011.

3 Sabre India, Navigating Challenges and Embracing Transformation under India's DPDP Act, Sabre

India, https://www.sabre.com/locations/india/resources/news/navigating-challenges-and-embracingtransformation-under-indias-dpdp-act/. (last visited June 2, 2024).

Scope

and applicability GDPR - Article 3 of the GDPR, provides that the GDPR applies to all the European Union member states and it also applies to all those organizations that are processing the personal data of the residents of the European union regardless of their place of business4. DPDPA – Section -3 of the DPDPA, provides that, its provision shall apply for the processing of the data within the territory of the country, where such data is, (i) Online collected, or (ii) collected offline and subsequently converted to digital form. This act will also applicable for the processing of data outside the territory of India, if such processing of data is related to provide any kind of goods or services with in India5.

Significance and Key principles of GDPR The significance of the GDPR can be understood on the basis of the fact that it provides, individuals sole control of their personal data and also enhances the transparency and accountability on the part of organizations, and thus it creates an environment of trust in the digital medium and provides safety to the privacy of the citizens. Some points of significance are provided as under6 :- - Individual’s privacy is protected – The GDPR has provided an individual the whole control power of their personal data and it also includes the power to delete their data when required as per their will. The GDPR provides a guarantee to an individual that, their data is protected. - Accountability of organization – The organizations must comply with the requirements of GDPR, before taking the consent for processing the data.

Data breaches must be notified by the organization with in a period of 72 hours to the public. If the 4 Art. 3 GDPR – Territorial scope - General Data Protection Regulation (GDPR), General Data Protection Regulation (GDPR), https://gdpr-info. eu/art-3-gdpr/ (last visited June 2, 2024).

5 Ministry of Electronics and Information Technology, Government of India | Home

Page, https://www. meity. gov. in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%20202 3. pdf (last visited June 2, 2024). 6Why is GDPR important? What is it and how does it Impact Market, PRINCE2 Training, PRINCE2 Courses, ITIL Training and PMP Training - United Kingdom, https://www. theknowledgeacademy. com/blog/why-is-gdprimportant/#:~:text=Have%20you%20ever%20wondered%20why,organisations%20that%20process%20such%2 0data. (last visited June 2, 2024). organizations fails to comply with the requirements of GDPR, they might suffer from several penalties. - Creating trust in virtual economy - The GDPR has provided an individual the whole control power of their personal data, and at the same time it also makes organizations accountable.

It will increase the trust of the people and will encourage the people to use digital tools and that will result in the growth of virtual economy. - Incident response and data recovery – This is one of the most important elements of GDPR compliance. It will enable the organizations to efficiently respond to threarts that will affects its business. - Strictest regulation – GDPR is the most strictest legislation pertaining to data protection, it provides the most severe consequences in cases of non-compliance. The following are the key principles of GDPR– The principles under the GDPR provides a base for hard data security. The GDPR has provided the penalties if any organization fails to follow these principles7.

8 - Article 5(1)(a), provides the principle of Lawfulness, fairness, and transparency, it means, the personal data must be processed lawfully, for a fair purpose and in a transparent, manner in relation to data subject. - Article 5(1)(b), deals with the principle of purpose limitation, it provides that the personal data must be processed for specific and legitimate purposes only, and shall not further processes which prove to be incompatible with those purposes, further the processing of the data in the interest of public, scientific, historical or educational purposes, shall not be considered as incompatible in this regard. 7 Art. 5 GDPR – Principles relating to processing of personal data - General Data Protection Regulation (GDPR), General Data Protection Regulation (GDPR), https://gdpr-info. eu/art-5-gdpr/ (last visited June 2, 2024).

8 Data Protection Principles: Core Principles of the GDPR, Cloudian, https://cloudian. com/guides/dataprotection/data-protection-principles-7-core-principles-of-thegdpr/#:~:text=Generally,/%20these%20principles%20include:,Data%20minimization (last visited June 2, 2024).

Article 5(1)(c), deals with the principle of data minimising, it provides that adequate, limited, and relevant data should be retained for carrying out the purposes for which they are processed. - Article 5(1)(d), deals with the principle of accuracy, it provides that the personal data must be accurate and kept up to date, and steps must be taken to ensure that the incorrect data for the particular purpose should be rectified or deleted. - Article 5(1)(e), deals with the principle of storage limitation, it provides that if data is not required by the organization and the purpose for which it was collected has finished, then such data must be deleted by the organization. And if the data is kept for some appropriate reasons, such as in the public interest, educational or scientific purposes, then the organization will create a retention period.

- Article 5(1)(f), deals with the principle of integrity and confidentiality, the security of the data collected is necessary, an organization must ensure that proper precautions are taken in order to keep the data safe. Data can be lost because of internal threats, accidental loss, external threats, unauthorized access, etc. - Article 5(2), deals with the principle of accountability, it provides that the organization is responsible for the security of the data they have retained, and also they must comply with all the principles. Key highlights of DPDPA, 2023 The DPDP Act, is one the best legislations which provides the provisions relating to data privacy, some of its key features are discussed as below – - Consent9 – Consent is a must, if there is a need to obtain someone’s private data, such gathered data must be used for legitimate purposes only.

Before taking the consent, a notice containing the details such as why such personal data is required and for what means it shall be used must be sent10. Such consent is not required in the following

9 Section -6 DPDP Act, 2023

10 Section – 5(i),(ii),(iii) of DPDP Act, 2023

cases, such data is voluntarily given, in medical emergencies, is required for the benefit of the government. - Rights11 and duties of the data principal – If a person has given his data shall have the following rights such as, (a) he has the authority to know for what purposes the data has been collected, (b) the individual can demand to delete his data, (c) he has the authority to nominate any other person to exercise the rights on his behalf in case of incapacity or death, and (d) Complaint redressal mechanism. Such person shall have the following duties, (a) They must not file a bogus or false complaint, (b) provide any false or bogus information12.

- Duties of data fiduciary13 – The fiduciary have the following duties, (a) To ensure that data is accurate and complete, (b) Take necessary precautionary steps to stop events of data breach, (c) If any breach occurs then immediately approach Data Protection Board of India, (d) Delete the data after the completion of purpose. - Data transfer – The cross border transfer of data has been allowed by the act, but such data can be transferred in strict conditions, protecting the interest of the citizens. - Exemptions – In some scenarios the provisions of DPDPA shall not apply i. e. in cases of national security, research purposes including educational and scientific research, and legal proceedings. - Data Protection Officers – The DPOs (Data Protection Officers), must be appointed by the companies to ensure that they comply with the law.

- Data Protection Board14 – Such a board shall be appointed by the Government of India, whose functions shall be, to monitor the compliance of law by the organizations, carry out the function of grievance redressal, to guide the fiduciaries to regarding what measures can be taken in cases of data breach.

11 Chapter III of DPDPA, 2023

12 Section – 15 DPDP Act, 2023

13 Section – 4 DPDP Act, 2023

14 Chapter VI of DPDP Act, 2023

Despite the fact that the DPDP Act has many fine traits, there are some aspects that requires development. As an example, the Central government has the responsibility to make the regulations, Data Protection Board, currently doesn’t have enough power to make regulation in this regard. Stricter data control guidelines may also be tough for smaller Indian corporations to comply with, specially when they lack the infrastructure or training required. It is essential to remember that the Act only covers digital personal data and, non – personal data is not covered in it. The main focus of this act is ‘consent’, it requires a clear and unbiased consent of the user. Comparative analysis of GDPR and DPDPA15

1. Personal data definition –

GDPR – The GPR provides a broad definition of personal data, it provides that any information through which a person can directly or indirectly identified. It applies to non – digital data also. DPDP – On the other hand, DPDP provides that, any data about an individual, who is identifiable by, or in relation to, such data. It only applies to digital personal data, it also exempts those data which are publicly available.

2. Sensitive/ special data category –

GDPR – GDPR differentiates the personal data and sensitive data, it provides the instances where the data is to be considered as special/ sensitive category data and not personal data, e.g. any data revealing, ethnic origin, religious belief, political opinions, data concerning personal sex life, etc. DPDP – This act doesn’t provide any such differentiation of sensitive data and personal data.

3. Significant data fiduciary –

GDPR – Unlike DPDPA, there is no such concept of significant data fiduciary in GDPR. 15 Latham & Watkins LLP, https://www.lw.com/admin/upload/SiteAttachments/Indias-Digital-Personal-Data- Protection-Act-2023-vs-the-GDPR-A-Comparison.pdf (last visited June 3, 2024).

DPDP – The act identifies a class of fiduciaries as the SDFs (Significant Data Fiduciary) on the basis of the following parameters, (a) sensitivity and volume of data processed, (b) risks to the rights of data principal, (c) Impact on sovereignty and integrity of the state, public order and security of the state.

4. Consent manager –

GDPR – There is no provision of consent manger under the GDPR. DPDP – Consent manager are such entities that acts on behalf of the data principal to review, manage and withdraw the consent, such entities are registered with the Data Protection Boards.

5. Processing children’s data –

GDPR – The age majority is nowhere defined under the GDPR. Unlike DPDP it doesn’t have any prohibition of processing data which may cause detrimental effect on wellbeing of child. DPDP – The age majority as defined in the DPDP act is 18 years, the need to obtain prior consent of parent or guardian is included in the act, further DPDP act restricts data processing, if such processing of personal data may cause any harmful effect to the wellbeing of a child.

6. Legal basis of process and consent16 –

GDPR – The importance of procuring valid consent is emphasized by GDPR. It requires that the consent must be freely give, and without any ambiguity. Additionally, the legal grounds for processing the data are provided by the regulation, such as need to process the data for the performance of the contract or to comply with legal requirements. DPDP – In the DPDP Act also consent is the basic principle, by obtaining the same a data fiduciary can process personal data. In GDPR and DPDP the principles of consent are the same i.e. consent must be freely obtained, it is informed and specific. A legitimate purpose is required under both GDPR and DPDP to process the personal data.

16

COMPARATIVE

ANALYSIS

OF GDPR AND DIGITAL PERSONAL DATA PROTECTION ACT, 2023.

(2023b). [Comparative Analysis]. International Journal of Creative Research Thoughts (IJCRT), 11(12), a735– a736. https://www.ijcrt.org

7. Voluntary disclosure –

GDPR – under GDPR there is no specific legal basis for voluntary disclosure. DPDP – When an individual voluntarily discloses his data to the fiduciary for the data processing for a particular purpose, then in such a case the fiduciary doesn’t need to take the consent of data principal.

8. Adequacy decision –

GDPR – When an individual or an organization wants to transfer the data from EU to whitelisted countries on the basis of an adequacy decision by European commission, then in such a case, there is no requirement of complying with the other safeguard provisions mentioned under GDPR. DPDP – Currently, DPDP Act doesn’t have any provisions regarding the adequacy decision, it is subject to the government’s ability to give a list of where data transfer is prohibited.

9. Transfer mechanism –

GDPR – A specific transfer mechanism has been developed under GDPR, if data is to transferred from European union or U.K. to a non – whitelisted countries. DPDP – Under DPDP Act doesn’t have any transfer mechanism. Data can be transferred to any country subject to the list given by the government, where the data transfer is prohibited.

10. Right to grievance redressal –

GDPR – Under GDPR, there is no such right to grievance redressal, if a complaint is made by the data principal regarding the controller, then the controller is under an obligation to address such grievances. DPDP – DPDP provides that, a fiduciary must have an effective grievance redressal mechanism, to redress the grievances of data principals and respond to them within a specific period.

11. Right to object and restrict data processing –

GDPR – Under GDPR, the data principals have the rights under certain situations that they can object or request the controller to restrict the processing of the personal data. DPDP – The DPDP Act doesn’t have any such provisions that give the right to data principals to object or restrict the processing of personal data. Though data principals have the right to withdraw their consent.

12. Right to nominate –

GDPR – The right to nominate is not specifically mentioned under GDPR, but data principals can authorize any other person to make requests on their behalf. DPDP – Under the DPDP Act, the data principals have the right to appoint any person on their behalf in case of death or incapacity of the data principal to exercise rights regarding personal data. Challenges under DPDP act - The government has awarded a broad powers under this act, the government can by issuing notifications, exempt any of its agencies on the basis of national security, public order, etc. , also the government can demand personal data from the organization. Both situations clearly depict that the government can retain all such data for indefinite period. Moreover, exemption is available for the investigation of crime, etc. without any notice17.

- DPDP shall not apply to the personal data which is publicly available by the concerned individual. This provision is providing license to the organization to process the data are made available publicly and they didn’t have to take the individual’s consent or need to obey the provisions of DPDP. - The government has the power to block the content on the basis of the advice from Data protection board. The power of the government to block content goes beyond section 69A of IT act. And also the phrase “interest of general public”, is not particularly

17 Section 17 of DPDP Act, 2023

defined and is broad18. - Under the DPDP Act, there is a provision of fine where a board can impose fine on the organizations for personal breaches, but there is no provision for compensation to victims19. - Section – 2020 of the act provides that the board members shall be appointed for 2 years and shall be eligible for re-appointment. The shorter term of the appointment of members can have an impact on the independence of its functioning. - The exemption is granted to use the personal data for the purpose of data recovery. It means an individual who has taken the loan from a bank or any other financial institution, then in such a case bank and such institution can access the personal data of that individual for the purpose of loan recovery. This could be problematic without any safeguard, as nowadays there are many fake loans agencies engaging in unethical ways of recovering loans21.

- No obligation to disclose to whom the data has been disclosed for the purpose of process after obtaining the consent. The provision must be made for the companies to inform that to whom they further disclosing the information for the process. - The act provides that the personal data can be transferred to any countries subject to the list of the countries provided by the government where data can’t be transferred. It means that data can be transferred to any country subject to the list. But the question is Can such countries provide adequate protection to such data? 22 - The act doesn’t regulate the caused during the processing of the data. Harm may include, material loss, financial loss, identity theft, loss of reputation, etc.

18 Fifteen major concerns with India's Data Protection Bill,

2023, MEDIANAMA, https://www.medianama.com/2023/08/223-major-concerns-india-data-protection-bill- 2023-2/#:~:text=No%20clarity%20on%20what%20safeguards,up%20to%20Rs%20250%20crores. (last visited June 3, 2024).

19 Section – 33 of DPDP Act, 2023

20 Section – 20 of DPDP Act, 2023

21 Section – 17(f) of DPDP Act, 2023

22 Section – 16 of DPDP Act, 2023

The DPDP doesn’t applies to anonymous data, there is a possibility that such anonymous data can be de anonymised and can be also be layered on anyone’s personal data. Conclusion This comparative evaluation of the GDPR and DPDP Act highlights vast similarities and dissimilarities between the regulations which are geared towards safeguarding private data. both legislation shares a common objective of securing individual’s privateness and ensuring data protection, however they diverge in their scope, utility, and particular provisions. In evaluating the two legislation, it is obvious that the GDPR gives a greater settled and complete framework, the DPDP Act is a commendable effort to address data protection in the Indian context. The DPDP Act's modern factors, including the consent manager and the SDF (Significant Data Fiduciary) class, replicate an edition to local challenges and needs.

In summary, the GDPR and the DPDP Act represent significant strides towards improving data protection and privacy. As the DPDP Act evolves, addressing its present challenges and building on its strengths can be essential in making strong data protection for Indian residents. This comparative evaluation underscores the importance of continuously refining data protection regulations to keep pace with the dynamic landscape of virtual transformation and the developing significance of personal data safety.