Dual-regime DPDPA and GDPR compliance for EU companies in India.
EU companies arrive at the DPDPA with a mature GDPR programme, which is a strong foundation but also a trap, because the two laws share vocabulary while differing in substance. The DPDPA is built around consent and a narrow set of legitimate uses rather than the GDPR six lawful bases, it has no concept of special-category data in the GDPR sense, its breach-notification trigger and cross-border approach differ, and it regulates children data with a verifiable-parental-consent rule that is stricter in some respects than the GDPR.
Treating DPDPA compliance as a copy of the GDPR produces both gaps and wasted effort. We run a GDPR-to-DPDPA gap analysis, map which GDPR controls transfer directly and which need India-specific redesign, and build a dual-regime framework so a single operational programme satisfies both laws where they align and handles the divergences deliberately where they do not.
Mapping the existing GDPR programme against the DPDPA to identify what transfers directly and what needs India-specific redesign.
Translating GDPR lawful bases into the DPDPA consent and legitimate-use framework, which is narrower and consent-centric.
Building notices, records, and policies that satisfy both regimes efficiently rather than maintaining two disconnected systems.
Reconciling the GDPR seventy-two-hour supervisory-authority trigger with the DPDPA notification to the Data Protection Board and Data Principals.
Handling the DPDPA children-data and cross-border rules where they diverge from the GDPR position.
Integrating DPDPA obligations into the existing GDPR governance so one programme runs both.
No. The GDPR is a strong foundation but the DPDPA differs in its lawful bases, its consent-centric design, its breach-notification trigger, its cross-border approach, and its children-data rule. A GDPR programme has to be gap-assessed and extended, not simply relabelled.
The lawful-basis framework. The GDPR offers six bases including legitimate interests, while the DPDPA relies on consent and a defined, narrower set of legitimate uses. Processing justified under GDPR legitimate interests may need a different basis under the DPDPA.
Yes, if it is designed to. Many controls transfer directly, and a dual-regime framework can run both laws from one operational programme while handling the specific divergences deliberately. That is more efficient and less error-prone than two parallel systems.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing. An initial discussion is confidential and is used only to understand the matter and assess fit.
Share the key facts for a confidential preliminary assessment of your India matter.