Not Quite GDPR: Analyzing India's DPDPA for Multinational Legal Teams

What happened

A recent presentation titled Not Quite GDPR: What EU Privacy Pros Need to Know about India's DPDPA analyzed the Digital Personal Data Protection Act, 2023. The session contrasted the Indian framework with the European model. The speaker examined lawful grounds for processing, consent design, cross-border data transfers, and corporate governance. Multinational organizations cannot assume their existing programs map perfectly to the new law. Practitioners evaluate where European assumptions fail to build scalable privacy operations. The session detailed specific procedural advice regarding corporate oversight. Privacy professionals and legal teams have a duty to report compliance progress directly to C-suite members. Regular briefings maintain organizational awareness as the regulatory requirements take effect.

Does the DPDP Act apply here?

General Counsels evaluate Section 3 of the Act to determine jurisdiction over their operations. The law applies to processing digital personal data within India. It also covers processing outside the country if the activity relates to offering goods or services to Data Principals within Indian territory. Multinational enterprises cannot rely on European applicability thresholds or revenue markers to determine their regulatory exposure. A company based in the European Union falls under the Act if it collects data from users inside India. Section 1 states that the Central Government appoints the enforcement dates. The law is gradually coming into force through official notifications.

Legal implications under DPDP

The comparative analysis isolates specific areas where European privacy assumptions fail under Indian law. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. The Digital Personal Data Protection Act lacks a direct equivalent to legitimate interest. Organizations process data differently in this jurisdiction. Cross-border transfers operate under a distinct model. Section 16 permits data transfers outside the country unless the Central Government restricts movement to specific notified territories. Multinational firms review their standard contracts to account for this negative list approach. The DPDP Rules, 2025 introduce exact mechanics for itemised notices. Data Fiduciaries issue clear requests outlining the personal data collected and its specific purpose. Companies also face strict timelines for incident management. Organizations report data breaches to the Data Protection Board of India within 72 hours.

Could this happen to you

Legal heads face immediate regulatory risk if they assume a legacy privacy program covers Indian obligations. A security incident at an Indian subsidiary triggers a mandatory 72-hour breach report to the Data Protection Board of India. Regulators demand verifiable consent records for the affected users. A General Counsel using standard European data processing agreements finds critical gaps in liability allocation. Outside counsel reviewing vendor contracts often discover missing itemised notice provisions. Enterprise deal cycles stall when privacy teams fail to localize the paperwork. Board members expect the legal team to quantify exact financial exposure. The Act sets penalty ceilings up to 250 crore rupees for severe data security failures. Fiduciary executives need concrete answers about the organization's compliance status.

What companies should do in the next 30 days

1. Legal heads instruct internal teams to map all data flows related to Data Principals in India against Section 3 applicability requirements.

2. Review standard data processing agreements to remove European terminology and insert correct liability clauses.

3. Evaluate consent collection mechanisms to confirm they meet the itemised notice requirements specified in the DPDP Rules, 2025.

4. Establish a formal reporting schedule for C-suite members detailing the gap between current privacy practices and Indian regulatory demands.

What to watch

221 days remain until the hard compliance deadline of 13 May 2027. Legal teams monitor the Data Protection Board of India for initial enforcement patterns and safe harbour interpretations. General Counsels track any upcoming notifications under Section 16 that restrict cross-border data flows to specific territories. Enterprises evaluate their current defensibility and liability gaps by completing a self-assessment at https://www.complydp.com/audit-preview to determine next steps. C-suite executives require ongoing updates as the Central Government activates different provisions of the law.