DPDP Act vs GDPR: 7 Key Differences Every Business Must Know

Can you reuse your GDPR cookie banner in India?

The short answer is no.

When multinational companies and Indian SaaS startups prepare for compliance, the most common assumption is: “We already spent months implementing GDPR banners and OneTrust workflows, so we can just reuse them for India’s Digital Personal Data Protection (DPDP) Act 2023.”

While both frameworks share a lineage rooted in personal autonomy and data protection, treating the DPDP Act as “India’s GDPR” is an expensive compliance error. The DPDP Act, together with the DPDP Rules 2025, establishes unique statutory requirements around language accessibility, intermediaries, verifiable audit records, and consent withdrawal that European tools were never engineered to handle.

Here are the seven critical differences between the DPDP Act and the EU GDPR, and what engineering and compliance teams must adjust before the statutory deadlines.

1. Grounds for Processing: No “Legitimate Interest” for Tracking

Under the EU GDPR (Article 6(1)), businesses can rely on six legal bases for processing personal data, including consent, contract performance, legal obligation, and legitimate interests (Article 6(1)(f)). Many global websites rely on “legitimate interest” arguments to justify essential analytics, fraud detection, and even certain cross-site cookies without asking for prior consent.

Under the DPDP Act 2023, the architecture is far more restrictive:

• Section 4(1) establishes that personal data can only be processed for a lawful purpose for which the Data Principal has given consent, or for certain strictly defined legitimate uses under Section 7.
• Section 7 legitimate uses are narrow: voluntary data provision for specific purposes, state welfare subsidies, legal compliance, medical emergencies, disaster response, and employment-related processing.
• There is no broad commercial “legitimate interest” exception for marketing pixels, analytics, or behavioral cookies.

If your site runs Google Analytics, Meta Pixel, or LinkedIn Insight tags on visitors in India, you cannot justify them under legitimate interest. You must obtain free, specific, informed, unconditional, and unambiguous consent with a clear affirmative action under Section 6(1) before those scripts fire (see our operational guide on why websites running ads need prior consent before tracking).

2. Notice Architecture and the 22 Indian Language Mandate

Under GDPR (Articles 13 and 14), privacy notices must be transparent, intelligible, and easily accessible, typically provided in the primary official language of the EU member state where your service operates.

The DPDP Act takes linguistic accessibility much further:

• Sections 5(3) and 6(3) explicitly state that Data Principals must be given the option to access the notice and consent request in English or any language specified in the Eighth Schedule to the Constitution of India (22 regional languages, including Hindi, Tamil, Telugu, Marathi, Bengali, Gujarati, Kannada, Malayalam, Punjabi, and Odia).
• Under Section 5(1), the notice must be a standalone document or clear modal. It cannot be bundled or buried inside general website terms of service.
• The notice must name the specific personal data collected, the exact purpose for each item, how to exercise rights of withdrawal and correction, and the contact information of the Data Fiduciary’s Grievance Redressal Officer.

To see how to structure this legally, review our breakdown of DPDP Act consent notice architecture. Standard European cookie banners only provide European translations and completely lack Eighth Schedule Indian language engines.

3. Consent Managers: A Statutory Intermediary Unique to India

One of the most innovative structures in the DPDP Act has no equivalent in the GDPR:

• Section 2(g) defines a Consent Manager as a person registered with the Data Protection Board of India (DPBI) who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
• Under Section 6(7) to 6(9), Data Principals can manage consents across multiple businesses through these regulated intermediaries.

Many businesses confuse a Consent Manager with a Consent Management Platform (CMP). As detailed in our guide on Consent Manager vs Consent Management Platform, a Consent Manager is a regulated, Board-registered intermediary representing users (similar to an Account Aggregator in RBI fintech), whereas a CMP (like ConsentPlix) is software your business runs to capture, record, and respect consent on your own digital properties.

Consent Manager provisions commence on 13 November 2026. By structuring your consent records on a per-purpose basis now, your CMP can easily ingest external signals when Board-registered Consent Managers go live.

4. The Burden of Proof: Section 6(10) Requires Cryptographic Audit Trails

Under GDPR (Article 7(1)), the controller must be able to demonstrate that the data subject has consented. In Europe, standard practice has often relied on database logs, CRM audit histories, or simple cookie records in the user’s browser.

In India, Section 6(10) establishes an explicit statutory reverse burden of proof:

“Where consent is required to be given by a Data Principal under this Act or the rules made thereunder, in any proceeding, the Data Fiduciary shall be obliged to prove that a notice was given to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder.”

If a user files a complaint with the Data Protection Board, a basic database row with has_consented = true or a browser cookie is vulnerable to challenge because database administrators possess UPDATE and DELETE access.

To survive regulatory scrutiny, fiduciaries need tamper-evident proof. As explored in our technical brief on cryptographic consent ledgers and Merkle roots, ConsentPlix converts every consent interaction into an HMAC-SHA256 signed receipt anchored into an append-only Merkle tree stored in AWS Mumbai (ap-south-1). This gives engineering and legal teams mathematical inclusion proofs that cannot be falsified after the fact.

5. Children’s Data: Strict 18-Year Age Threshold and Tracking Prohibition

GDPR (Article 8) sets the default age of digital consent for children at 16, while giving EU member states the flexibility to lower this threshold to 13 (as France, Germany, and the UK have done).

The DPDP Act takes a far stricter, uniform approach:

• Definition of Child: Under Section 2(f), a child is defined as an individual who has not completed 18 years of age.
• Verifiable Parental Consent: Under Section 9(1), fiduciaries must obtain verifiable consent from the parent or lawful guardian before processing any personal data of a child.
• Absolute Tracking Ban: Under Section 9(3), fiduciaries are prohibited from tracking or behavioral monitoring of children, or targeted advertising directed at children.
• Detrimental Processing: Section 9(2) forbids any data processing likely to cause a detrimental effect on the well-being of a child.
• Penalties: Failing to adhere to Section 9 carries a statutory penalty under the Schedule of up to ₹200 crore.

Global websites that deploy behavioral tracking pixels or programmatic ad networks must implement strict age-gating mechanisms for visitors from India to prevent non-compliant child profiling.

6. Penalty Architecture: Fixed Statutory Caps vs Turnover Percentages

The penalty structures of GDPR and the DPDP Act reflect fundamentally different regulatory philosophies:

Notice an important legal distinction: under the DPDP Act, consent and notice mistakes fall under the general residual penalty cap of up to ₹50 crore, while the ₹250 crore maximum is strictly reserved for failing to take reasonable security safeguards to prevent a personal data breach under Section 8(5). Review the complete Schedule penalties analysis for statutory details.

7. Consent Withdrawal and Cross-Border Data Flows

Symmetrical Withdrawal (Section 6(4))

Under GDPR Article 7(3), withdrawal must be as easy as giving consent. The DPDP Act codifies this requirement with equal force in Section 6(4):

• The Data Principal has the right to withdraw consent at any time.
• The ease of such withdrawal must be comparable to the ease with which consent was given.
• If a user granted consent with a single click on a banner, they must be able to withdraw consent with a single click via a persistent footer link or preferences drawer, without phone calls, email requests, or complex multi-step forms.

Cross-Border Data Transfers (Section 16)

GDPR relies on a positive whitelist: data may only flow outside the EU/EEA if the destination country has an “adequacy decision” (Article 45) or through appropriate safeguards like Standard Contractual Clauses (SCCs, Article 46) and Binding Corporate Rules (BCRs).

The DPDP Act takes a negative list (blacklist) approach under Section 16:

• The Central Government may restrict transfers of personal data to specified countries or territories outside India via notification.
• Transfers are generally permitted to all other jurisdictions, subject to higher standards set by sectoral regulators (such as the Reserve Bank of India’s data localization mandates for payment data).
• For international operations, maintaining local cloud infrastructure in AWS Mumbai (ap-south-1) guarantees data sovereignty and simplifies audits.

Side-by-Side Comparison: DPDP Act vs GDPR

Why European Cookie Banners Fail Under DPDP

If you currently use a standard European cookie tool like Cookiebot, CookieYes, or an unconfigured OneTrust deployment on your Indian website, here is where it falls short:

1. Bundled “Accept All” without Granular Itemisation: Section 6(1) requires consent to be specific. Users must be able to consent to analytics separately from marketing cookies.
2. Missing Eighth Schedule Regional Languages: Default EU tools do not provide notices in Hindi, Tamil, Telugu, Marathi, or Gujarati.
3. No Sovereign Signed Receipts: Basic cookie tools store choices in a browser cookie or flat database without cryptographic non-repudiation.
4. Heavy Performance Overhead: Legacy enterprise banners weigh 80KB to 150KB, causing layout shifts and delaying Largest Contentful Paint (LCP) by up to 1.8s. ConsentPlix’s autonomous sub-12KB SDK delivers full compliance with zero runtime dependencies.
5. No Grievance Redressal Officer Integration: DPDP notices must identify your grievance officer and provide clear escalation pathways to the Board.

For a comprehensive evaluation of market tools, read our guide to the best DPDP Consent Management Platforms in India.

5-Step Migration Checklist: Upgrading from GDPR to DPDP

If your organization already complies with GDPR, here is how to upgrade your stack for India:

Step 1: Scan Your Live Site for Tracking Cookies

Identify every third-party tag, pixel, and tracker currently loading on your domain. Use our free DPDP website scanner to audit script fire sequences and detect trackers that run before user consent.

Step 2: Implement Pre-Consent Script Blocking with Google Consent Mode v2

Ensure that marketing tags, Meta Pixel, and analytics cookies are blocked until the visitor takes an affirmative action. Configure Google Consent Mode v2 to maintain conversion modeling while respecting user privacy choices.

Step 3: Upgrade to Multilingual Standalone Notices

Deploy a consent banner that provides instant language selection across English and Indian regional languages, displaying clear itemised purposes and your grievance contact. Follow our small website DPDP checklist for practical implementation steps.

Step 4: Anchor Consent Receipts in an Immutable Ledger

Replace mutable database updates with an append-only cryptographic ledger. Verify that each consent event produces an HMAC-signed audit receipt that can be exported during a regulatory audit.

Step 5: Test Symmetrical Withdrawal

Add a persistent “Cookie Settings” or “Privacy Preferences” trigger in your website footer. Ensure that clicking it reopens the preference modal and updates dataLayer signals in real time without friction.

Summary & Next Steps

The DPDP Act 2023 is not a carbon copy of GDPR. It is a distinct, sovereign privacy framework with specific statutory mechanisms designed for India’s digital economy.

While the full enforcement date of 13 May 2027 provides implementation runway, Consent Manager registration rules begin on 13 November 2026. Starting your technical implementation now ensures your team builds clean, auditable consent records before the enforcement rush.

• Check your current site: Run a test with our Free DPDP Website Scanner.
• Compare platforms: Explore our OneTrust vs ConsentPlix and CookieYes vs ConsentPlix comparisons.
• Get started free: Deploy our sub-12KB DPDP-ready SDK on your site in under 5 minutes with our Free Forever Plan or schedule a technical demo.