Published on 14th April 2025
Authored By: Anjali Sharma
Techno India University
ABSTRACT
Comparative Analysis of General Data Protection Regulation (GDPR) and Digital Personal Data Protection Act (DPDPA), is the most aske4d an in demand topic among cybersecurity and data privacy communities.
If we are a GDPR complainant, do we still need to comply to DPDPA?
With 1.5 billion residents, India is a key player in the Global Digital Arena. However, the country has also stopped serious data injuries.
In 2023, the Indian government took a major step towards the Digital Personal Data Protection Act (DPDP Act). The purpose of this regulation is to create a robust legal framework that matches global standards, while also taking into account the unique features of India’s digital environment.
India’s booming digital economy and data injury have made it clear that strong data protection laws are essentially important. The puttaswamy ruling 2017, which recognized the right to privacy as a fundamental right, further highlighted this need. This work led to the DPDP Act of 2023.
In contrast to GDPR, DPDPA creates another category of critical data reductions. The Indian government can describe all data reductions or data designs as SDFs based on specific factors, such as the amount and sensitivity of personal data to process, risk of data rights and impact on National India Safety. SDF is subject to higher obligations within the DPDPA framework, including the appointment of data protection officers and independent auditors. They also need to perform data protection assessments regularly and implement other measures that the government can prescribe through the regulations.
KEYWORDS: DPDPA, GDPR, European Union, European Economic Area,
INTRODUCTION
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is a regulation of EU laws regarding data protection and privacy in the European Union (EU) and the European Economic Area (EEA). It also handles the transfer of personal data outside of the EU and EEA regions. The GDPR primarily aims to simplify the regulatory environment for international companies by managing personal data for citizens and residents and integrating regulations within EU. This is done by replacing the 1995 Data Protection Guidelines. The regulations have been in effect since May 25, 2018.
Digital Personal Data Protection Act (DPDPA)
The Digital Personal Data Protection Act (DPDPA) is an Indian data protection law was adopted by both parliament houses in August 2023 and came into effect in early 2024. DPDPA is India’s first comprehensive data protection law, developed to protect personal data of Indian citizens.
The Data Protection Act is the underlying bill for the DPDPA. The Data Protection Act was introduced by Congress in 2019 and several revisions were made before it was adopted in 2023. Data protection calculations are relevant to this discussion as they are insight into the Indian government’s indicators regarding the most important provisions contained in data protection and DPDPA.
The DPDP Act has led to an increasing number of countries with comprehensive data protection laws in India. The law focuses on protecting the guardians of data protection users and restricting provisions for cross border personal data transfer and data localization (i.e., most data is stored in India. This is a way for multinational technology companies working in India to find user data. However, the law also allows for the transfer of copies of this data outside of India for specific purposes.
DEFINITIONS
Personal Data
In the GDPR framework, personal data is meticulously categorized, with ‘special categories pf personal data’ be3ing an important subset. This includes sensitive information such as racial and ethnic origins, political opinions and religious beliefs. These categories require different compliance measures, particularly with regard to legal processing.
The DPDP Act covers all personal data within the digital realm. This means that the DPDP method does not impose different compliance standards on different data types, leading to consistent standards across all personal data classes.
Consent
The definition of consent requires free, specific and clarification of clear, positive conduct. The DPDP method clearly adds words to a definition. This makes consent a little more robust.
Consent Managers
DPDP optimized focus on consent reflects the Indian government’s goal of focusing on user selection and enhancement from users. Consent under the DPDP Act is the most important and general process for processing, and therefore provides a clear concept of consent managers.
Breach Notice
According to the GDPR, any violations that could be a risk to the rights and freedoms of the data subject must be reported to the liability authority. Parties may only be notified if the violation is likely at a high risk of their rights.
DPDP has stricter termination requirements for prescribing a data sweater to report injuries to all personal data, regardless of risk assessment, data protection board or stakeholders.
Cross-Border Data Transfer
Transfer of personal data outside the EU is subject to strict regulations within the framework of the GDPR. This allows data to be transferred to countries with appropriate data protection measures, or via mechanisms such as contractual standard clauses and binding corporate rules.
Data Protection Officers
Data Protection Officers play an important role in compliance advice, monitoring and assurance. Specific requirements for DPDP for Data Protection Officers.
Children’s Data
The GDPR presents strict conditions for processing children’s data, particularly in relation to commercial services and profile creation. The GDPR follows a more flexible approach and the age of consent at 16. This can be reduced to 13 by Member States.
The Digital Act on Personal Data Protection Act 2023 defines people under the age of 18 as children and requires verifiable consent from parents to process data. In particular, we prohibit processing that is likely to hurt children, including advertising targets.
RESEARCH METHODOLOGY
Compliance Challenges for GDPR and Indian PDPDA
For businesses operating in the EU
Companies working in the EU must comply with both the GDPR and DPDPA when processing personal data of people in the EU or Indian. This can be a challenge as the two laws have several different requirements.
For businesses operating in India
Companies working in India must comply with the DPDPA when processing personal data of people in India. This could be a challenge for business that are not yet familiar with India’s data protection laws.
Final Thoughts
Both GDPR and DPDPA are comprehensive data protection laws with many similarities, including the right to grant individuals and the obligations they place on organizations. However, there are also some important differences between the two laws.
Organizations that process personal data from people in the EU or India should carefully check their GDPR and DPDPA to ensure compliance. This way, you can protect the privacy of your personal data from individuals and build trust with your customers and partners.
In addition to compliance, organization should also consider the benefits of implementing legally necessary regulatory data protection measures. In this way, we can demonstrate our commitment to privacy and create a competitive advantage in the market.
As data protection laws are developing around the world, businesses need to keep up to date with the latest developments and ensure their data protection practices match the latest requirements. Plan a phone call with secure privacy today to see how your company can help you protect your privacy and comply with data protection laws.
REVIEW OF LITERATURE
In history the concept of privacy has been a fundamental element of human existence. Preservation of specific privacy has been a major feature of human society since the times of Adam and Eva. This shows that even in ancient times, people fundamentally understood the need for privacy. The exponential growth and increased data damage in India’s digital economy highlight the urgent need for robust data protection.
What data does the law apply:
In contrast to GDPR (which applies to all personal data, DPDPA applies only to personal data that has been digitized or digitized after collection.
India has made considerable progress in protecting individual privacy, but more work is needed to fully assure citizens’ rights. Increased cooperation between public and private agencies could lead to stricter guidelines for data processing.
A comparison overview of GDPR and INDIA PDPDA: objectives and scope
Objectives of General Data Protection Regulation (GDPR)
The GDPR’s objectives are to:
- Returning your personal data to citizens and residents.
- Simplify the regulatory environment for international companies by combining the regulations within the European Unions
- Protect the personal data from unauthorized access, use, disclosure or destruction.
Objectives of Digital Personal Data Protection Act (DPDPA)
The DPDPA’s objectives are to:
- Protecting the privacy of Indian citizens’ personal data.
- Empire to control your personal data.
- Promote innovation and economic growth
SCOPE
GDPR and DPDP laws share a wide territorial area and affect them beyond geographical boundaries. Both apply to organizations that process personal data in their local area or target residents from outside.
They differ from the range of materials, but not so much. The GDPR sends a wider network through ‘personal data’ that contains information about identifiable or identifiable natural persons. This definition is broad and includes online and offline data, digital and manual records, when part of a registration system.
In contrast, the Digital Personal Data Act focuses on digital personal data. It covers offline digitized data, but the scope does not extend to any form of offline personal data.
KEY FEATURES OF DIGITAL PERSONAL DATA PROTECTION ACT (DPDPA)
The key features of the Act include:
- Data carrier: This concept assigns a particular entity to data processing responsibility.
- Right to Access: Individuals have the right to access their personal data.
- The scope of Indian law regarding the protection of digital personal data protection applies to the processing of personal data within India, but also expands responsibility for data processing work outside of India when it comes to providing goods and services in the Indian market.
KEY FEATURES OF GENERAL DATA PROTECTION REGULATION (GDPR)
- Right to Participation: Data subjects have many rights under the GDPR, including the right to access personal data, the right to delete personal data, and the right to collect for the processing of personal data.
- Data Responsibility and Processor Responsibility: Data representatives and Processor report appropriate security measures to protect personal data and appropriate security measures to protect data violations to the supervisory authority. We have many responsibilities within the GDPR framework, including responsibility.
- Penalties for non-compliance: Organizations that do not follow the GDPR can meet with up to 4% of global annual sales or up to 20 million fines, depending on what is increasing.
SIMILARITIES
The GDPR and the DPDPA are both comprehensive data protection laws that share a number of similarities, including:
- Both grant individuals many rights such as right to access personal data.
- Both set up organizations that process personal data.
- Both have provisions regarding enforcement and penalties for non-integration.
DIFFERENCES
Despite their similarities, there are also some key differences between the GDPR and the DPDPA, including:
- The GDPR applies to all organizations that process personal data of people in the EU, regardless of whether the organization is in the EU or not. DPDPA applies to all organizations that process personal data of people in India, whether or not the organization is in India.
- The GDPR contains special categories of personal data that can only be processed for certain reasons. DPDPA applies uniformly to all types of digital personal data. There is no additional control over the processing of confidential or important personal data.
- The GDPR has more stringent requirements for the transfer of personal data outside the EU.
DPDPA has low strict requirements for the transfer of personal data outside of India
Penalties of the DPDP Act
According to Section 33, the law summarises the various punishments and consequences related to violations of this DPDP Act. If an organization determines that an organization is ignoring the protection of an individual in order to notify the relevant agency of violation, it may be punished with a fine of up to 250 crores. After violating this Act or different regulations related to it, an organisation may violate up to 50 crores, The fine is imposed by the data protection authority after the person is given the opportunity to listen. Penalty areas will depend on critical factors such as the severity of the violation, the impact on personal data, the violation, profit or loss from the violation, efforts to reduce it, and proportionality.
METHOD
ANALYSIS OF GDPR and DPDPA
A single investigation into Indian law shows that it is primarily defined by data protection. In contrast, the GDPR includes a comprehensive clause that addresses most of the concerns of being “affected” Nevertheless, the main difference is important in the absence of Indian compliance in ensuring “influenced people” before the outcome of excessive delays. As opposed to the focus of the GDPR.
Furthermore, the right to delete within the General Data Protection Regulation (GDPR) framework (RTE) is comprehensively sufficient to include illegal processing of data, i.e., data processing that occurs without approval. “In contrast, India’s RTE applies only to digital personal data that the parties have agreed to process.
However, the scope of India’s right to delete (RTE) is limited compared to European Union rights (EU) rights, particularly due to fundamental differences in the definition of personal data. Within India, the phrase “data” refers only to digitized personal data or data that is physically recorded and later converted to digital format. In contrast, the term “personal data” in the European Union refers to information that is either fully or partially automated. Additionally, it currently contains personal information or is included in the file system.
The New Digital India
The Digital Personal and Data Protection Act places the legal basis for regulating digital activities in India. It also paves the way for comprehensive data protection formation at all levels, from basic-to-basic formation to tertiary formation. This likely includes e-learning initiatives and educational reforms, including data protection curricula.
These efforts are driven by a global trend towards an increasing digitalisation of our knowledge-based economy and our world. The DPDP Act could create a social framework that preserves human dignity and rights in the digital age. This could be a transformative development that enables future generations and unleashes creative possibilities.
This law is an important step towards promoting digital autonomy and ensuring individual rights in the digital world. As India implements DPDP Act to protect personal data, what challenges and opportunities can we predict regarding the digital economy and data protection situation?
ARTICLE 17 OF GDPR
Article 17 of the General Data Protection Regulation (GDPR) describes certain circumstances that should be forgotten. One has the claim to apply for deletion of the data, if the organization considers personal data in relation to the original purpose of the collection or processing. The legal basis for data processing within an organization is based on the permission of the person who later revoked the topic. The justification for processing a single data is based on legitimate interests.
Nevertheless, individuals are raising concerns about this processing, and there is no undeniable justification for organizations to continue processing. The person refuses the organization’s processing of personal data for direct marketing. The company abused personal data. Organization Personal data must be deleted to meet legal regulations or requirements.
The organization processed children’s data to provide information society service. The right of an organization to manage people’s data may have the right to delete data from storage. The General Data Protection Regulation (GDPR) describes several circumstances that overrides the right to be deleted. Data is used to fulfil a legal duties or obligation.
Efficient data processing is essential to achieving public health gaols and is consistent with the general wells of the public. Data processing is a critical component of implementing prevention or professional healthcare. It is important to note that this obligation is only relevant if the data is manged by a health professional who is obliged to maintain legally professional confidentiality. Data records contain important materials related to public interest, scientific research, historical research, and statistical analysis. The data collected will be used to set up defences or to support themselves for other legal claims
