GDPR vs. DPDP: Exploring Variances in Data Privacy Regulations

The security of personal data is currently critical in the digital era. Countries and organizations worldwide are passing laws to regulate how personal data is handled. India's long-awaited Data Protection Act finally made significant progress on 11 August 2023, when the Digital Personal Data Protection Act received Presidential approval.DPDP seeks to replace existing patchwork laws and regulations on data protection and privacy in India. The approach is to obtain final consent with limited consequences for non-compliance.

With the conflicting requirements for respecting individual privacy and the consent of commercial organizations to data processing, the Indian government felt the need to introduce a data protection regime. Comprehensive and specialized data equivalent to global standards. GDPR is one of the primary laws that sets the tone and emphasizes the need to respect the privacy of individuals in a globalized world. It is natural that India's DPDP resonates closely with GDPR and has some similarities.

Scope:
The primary focus of DPDP is handling digital personal data within India, which includes both online and offline data. It extends its authority to process personal data outside of India if processing includes providing Indians with products or services or profiling them. The GDPR covers people in the EU and organizations outside the EU that give items or administrations to or notice how EU residents behave. It likewise applies to the handling of individual Data inside the EU.
The GDPR has picked a graded approach for the consent to deal with children's data. The base age for lawful consent in such conditions goes from 13 to 16 years. Besides, the association should acquire parental consent to affirm that the parent gave consent sensibly. The DPDP, similar to its ancestors, depends on the outright age of 18 to give legitimate authorization and necessities to inspect the evaluated approach utilized broadly worldwide. One more qualification made by the DPDP is that assuming the business handling the data of a child has parental consent, such consent should be "verifiable parental consent" according to future guidelines.

Legal Basis for Processing

The GDPR unequivocally states in Article 5 that the essential guidelines administering standards governing the processing of personal data are Lawfulness, Fairness & Transparency, Purpose Limitation, Data Minimization, Accuracy, Storage Limitation, Integrity & Confidentiality, and Accountability. There is no explicit mention of any such ideas in the DPDP. However, the same standards are stressed in a separate note of clarification, and hence enforcement is questionable.
The GDPR and the DPDP certainly stress the need for genuine motivation to deal with individual data. To carry out legitimate processing, the DPDP requires a person's consent. However, in certain conditions, explicit reasons might constitute assent. As the GDPR indicates, handling can be legitimate on a few lawful grounds, including assent, contract satisfaction, legitimate necessities, indispensable interests, the public interest, and genuine financial matters sought by the Data regulator or an outsider.
The GDPR and DPDP offer a couple of other lawful defences for handling individual data in addition to permission. The GDPR and DPDP contrast in such a manner that the DPDP recognizes that a Data chief is "considered" to have been allowed for handling when the Data chief willfully offers individual Data to the Data fiduciary, and it is sensible to expect that the Data chief would give such private Data. By imparting their name and versatile number to a café to hold a table, a client is dared to concede consent to the eatery (for example, the Data guardian) gathering their name and portable number. DPDP supplies the guide to make sense of this part.

Individuals Rights

The two structures perceive the need to command individuals over their Data. The DPDP allows individuals to get to data, request its expulsion or alteration, pick their delegates, and record grievances. Similarly, individuals are granted rights to transfer, access, rectification, deletion, and protection from automated decision-making under the GDPR.
The GDPR gives severe and unambiguous securities to circumstances when a mechanized dynamic cycle might bring about human injury. While it is guaranteed that far-reaching assessment is expected for huge-scope profiling under the PDP, the law gives no privileges to people to protest robotized profiling except minors. The General Data Protection Regulation (GDPR), which mandates that data subjects have the right to object to automated profiling for direct marketing, covers this subject in much greater depth. The GDPR likewise expects that the data subject be educated and definitively informed about their entitlement to protest.

Data Storage

According to the GDPR, data must be stored in a recognizable format for a predetermined time. Any extension of the stockpiling time would follow explicit exemptions. Using data that is authentic in nature, mathematical, scholarly, or public interest objects is one of these exemptions. Data must be held away under the PDP for however long it is essential to accomplish its objective. It should be taken out in the wake of serving its job. As indicated by the PDP, the Data subject should be able to communicate arrangements when the Data is to be kept longer. This recommends that maintaining consistency with the PDP may be conceivable, assuming GDPR consistency rules for Data capacity are met.

Data Protection Authorities

The DPDP calls for the Data Protection Board of India, which would enforce guidelines, authorize punishments, and resolve grievances. The focal government will determine the Board's constitution and terms of the arrangement. Conversely, the GDPR makes administrative experts in every EU part state, and the European Data Security Board (EDPB) ensures that these specialists cooperate and that their execution is uniform.

Penalties

Under the GDPR, data principals and processors must collaborate with the DPO to resolve complaints. The Data subjects can contact the DPO straightforwardly to practice their GDPR-ensured freedoms. In certain conditions, Data subjects can quickly contact the Administrative Position to look for lawful change. The PDP obliges Data fiduciaries to keep up with powerful complaint redressal strategies. The named official can be reached assuming that the Data Subject has worries, in which case the issue should be settled in 30 days or less. An appeal panel can deal with complaints because of choices made by mediating authorities.
The DPDP specifies penalties of up to Rs 500 million for various offences. The Indian Data Assurance Board will settle on the particular fines. Conflictingly, the GDPR specifies that punishments design can be as much as 20 million Euros or, on account of an endeavour, up to 4% of the whole worldwide income of the earlier financial year, contingent upon what is higher, for intense infringement, as referenced in Article. 83(5) GDPR. Be Even the rundown of less serious offences in Article 83(4) GDPR specifies fines of as much as 10 million Euros or, on account of an endeavour, up to 2% of its absolute worldwide income for the earlier monetary year, whichever is bigger. Additionally, data principals are exempt from the compensation provisions.

The Similarities

The GDPR is one of the foremost laws that sets the tone for and outlines the need to respect individuals' privacy in a globalized world. It is natural that the Indian DPDP resonates closely with and exhibits certain similarities with the GDPR.

Anonymised data excluded: While the GDPR expressly excludes anonymised data from its applicability, the DPDP suggests that it would not apply to anonymized data that cannot be used to identify an individual.
Processing of data without consent permitted in certain circumstances: DPDP provides for certain ‘legitimate uses’ for processing personal data by data fiduciaries (data principals) for certain special use cases without the consent of the data principal. Such ‘legitimate uses’ (for which consent of the data principal is not required) include processing for purposes of employment, responding to medical emergencies, performing any function under law or the State providing any service or benefit to the data principal, etc. Similarly, the GDPR allows the data principal to process personal data without consent in specific situations while providing for certain obligations on the data principal.
Quality of consent: Consent of the data principal is one of the foundational principles, using which the data fiduciary / data principal may process personal data. Broadly speaking, the basic principles of consent are similar under DPDP and the GDPR i.e. consent should be free, specific and informed. Further, both GDPR and DPDP require a legitimate reason (purpose) to process personal data. Another common provision under both GDPR and DPDP requires the data fiduciary to demonstrate that consent has been obtained in compliance with the respective legislations
Significant Data Fiduciary: Consider factors involved in classifying a data fiduciary as a significant Data Fiduciary (i.e. based on factors such as volume and sensitivity) of processed data) in the DPDP, additional obligations, such as appointing data protection officers, appear consistent with GDPR.

The Differences Despite many similarities between DPDP and GDPR, DPDP is unique in its own way.
No separate/particular class of data: GDPR classifies personal data into various specific subsets. These types of personal data are subject to separate regulations, especially regarding the purpose of processing this personal data. However, compliance with the DPDP is independent of a particular type of personal data and equally applies to all types of personal data.
Applicability to Offline Data: While GDPR applies to all offline data that is part of the storage system, the DPDP law only applies to digital or scanned data.
Please let me know when you need to give notice. DPDP requires notification only when consent is the basis for data processing (and not for fair use). However, under the GDPR, notification requirements appear to apply whenever data is collected from a data subject, not only about consent.
Content of such notice: The DPDP specifies the elements a notice must contain for a data principal to consent. These elements include Data on the nature of the personal data collected, the purposes for which the data was collected, how consent is withdrawn, Data regarding recourse in the event of a complaint, and how to file a complaint, with law enforcement. Under GDPR, the Data that must be made available to data subjects is much broader in scope and does not appear to be exclusively relevant to cases where data subject consent is required. Such notice is necessary to provide Data regarding the controller, the contact details of the data protection officer, the purpose and legal basis of the processing, the legitimate interests, the recipient, details of cross-border remittance, storage period, specific data subject rights, etc.
Children Data: Unlike the DPDP, the GDPR does not explicitly prohibit behavioural monitoring or targeted advertising directed at children. The DPDP requires verifiable parental consent and has an explicit and broad prohibition on data processing that may hurt the child's health; this doesn't seem explicitly mentioned in the GDPR.
Grievance Redressal: Unlike the DPDP, GDPR does not require data subjects to correct their complaints before a regulator submits a complaint to a judicial review body or court.
Data transfer to other jurisdictions: DPDP allows the central government to restrict Data fiduciaries from transferring personal data to notified countries or territories outside India. Therefore, except for countries on the ban list published by the central government, personal data can be freely transferred. However, under the GDPR, the right to transfer personal data ranges from the possibility of a free transfer to a country or international organization with appropriate discretion and conditional transfer (such as the application of standard contractual clauses), to limited transfer authorization in certain circumstances. case. As a result, GDPR has broader and more specific restrictions on cross-border remittances than the DPDP.
Notification to the Data Principals during a Data Breach: The DPDP directs the Data Fiduciary to notify the Data Protection Board and each relevant data principal during a data breach. Unlike the DPDP, the obligation to inform a data subject of a breach is only activated under the GDPR when there is a high risk to the subject.
Consent Manager: This is a unique concept in DPDP. “Consent manager” means a person registered with the Data Protection Board who is accountable to the head of data and serves as the sole point of contact to allow the head of data to manage the data. Manage their consent through accessible platforms. Technical, operational, and financial obligations and conditions and other obligations and conditions applicable to the consent administrator will be set forth as part of the regulation.
Voluntary Undertaking: DPDP empowers the Data Protection Department to accept a voluntary commitment from the breached person, which may include a commitment to – (i) take action within a timeframe or (ii) fail to take a specific action, and (iii) make a public, voluntary commitment. Once the Data Protection Board accepts such a voluntary undertaking, it will constitute an obstacle to legal proceedings to the extent it relates to the content of the voluntary undertaking.
The concept seems similar to judgment alternatives such as deferred/non-prosecution agreements or combined offences, where the offending party can voluntarily admit the violation and be accepted, according to the conditions. This helps to remediate non-compliance voluntarily and promptly and generally seems to align with the government's strong desire to legitimise such acts. Violations encourage compliance and create more favourable conditions for business.
While it seems to be inspired by best practices around the globe, Indian law still has some unique characteristics. What is quite unique is the choice of the terminology used by the DPDP, the term of the data fiduciary - which hints at the element of trust—interpreted under Indian jurisprudence given this position of “trust” that a data fiduciary seems to enjoy. It will be interesting to see how an issue may be. Despite multiple intersection points, the DPDP has its unique Indian flavour.

Tabulated Comparison

Criteria	GDPR	DPDP
Scope	The GDPR covers all organizations that process the personal data of EU citizens, including every company that offers goods and services or employs people in the EU, even if an entity is based outside the EU.	The scope of the DPDP extends to the processing of digital personal data within India, where such data is (i) collected online or (ii) collected offline and digitised. It will also apply to the processing of personal data outside India if it is for offering goods or services, i
Consent of minors	Under the GDPR, the age of consent has been kept at 16, but it allows member states to lower it to as much as 13	Under the DPDP, people under 18 are considered minors, and processing of their data requires “verifiable parental consent”.
Classification of data	The GDPR classifies personal data into a further subset, namely special categories, including data about racial or ethnic origin, political opinions, religious or philosophical beliefs, etc. Special categories of personal data are subject to distinct compliance requirements.	The Act applies to the broader set of personal data without further categorizing it as sensitive or critical personal data, and there is no statutory requirement to implement separate compliance standards for different kinds of personal data.
Categorisation      of      data fiduciaries/ data principals	The GDPR does not distinguish between classes of data principals(equivalent to data fiduciaries under the DPDP).	The DPDP has further classified data fiduciaries as “significant data fiduciaries” based on various items, including the volume and nature of data collected. Under such governmental classification, additional obligations may be imposed on the notified significant data fiduciaries.
Processing of personal data	The GDPR mentions Under Article 5 that fairness, lawfulness and transparency, purpose limitation, accuracy data minimisation, storage limitation, confidentiality, integrity & accountability shall    be the core principles guiding the processing of personal data.	The DPDP has no express mention of any such principles in the Act itself.
Cross-border   transfers    of data	The GDPR has laid down an exhaustive procedure for cross-border data flow. This is implemented through adequacy               decisions, prescribed rules, standard contracts, and clauses relating to derogation	The DPDP allows the Central Government to restrict the transfer of personal data by a data fiduciary to notified countries or territories outside of India, which shall be notified later. Moreover, more excellent expected to be brought in the subsequent Rules regarding the procedure for cross-- border flow of data.
Consent managers	There is no concept in the GDPR regarding                 ‘consent managers’.	The DPDP lays down the idea of a ‘consent manager’, a person registered with the Data Protection Board who is accountable to the data principal and acts as a single point of contact to enable a data principal to manage their consent through accessible platforms.
Right of data portability	The Right of data portability under the GDPR enables individuals to obtain and reuse their data for their own purposes across different services.	The DPDP Act does not provide the right of data portability in favour of data principals.
Data breaches	The GDPR requires personal data breaches to authorities. However, personal data breaches must be intimated to affected subjects only when such breaches will likely result in high risk to their rights and freedom. According to the GDPR, regarding data breaches caused by data processors, the data processors' obligation is to notify only the concerned data principal of the same. The data principal is responsible for reporting such personal data breaches (if found to be meeting the necessary threshold set out under the GDPR) to the authority.	The DPDP Act mandates that data fiduciaries and processors report personal data breaches, which must be reported in all cases.
Processing of personal data without consent	The GDPR also enables the Data Controller to process personal data without consent in specific situations while providing for certain obligations on the data principal.	The DPDP Act stipulates that the requirement of consent can be overridden under particular scenarios, such as for the performance of a state function, medical emergency, compliance with decree or law, etc . This    is    referred    to    as ‘legitimate uses’
Data Protection Authorities	The GDPR mandates the establishment                     of supervisory authorities in each EU member state	The DPDP stipulates the
		establishment of the Data
		Protection Board of India,
		which       would       enforce
		regulations,               enforce
		penalties,       and       resolve
		complaints. Key functions of
		The board     include:     (i)
		monitoring compliance and
		imposing      penalties,      (ii)
		directing data fiduciaries to
		take necessary measures in
		the event of a data breach,
		and (iii) hearing grievances
		made by affected persons.
		The Board shall conduct such inquiry following the principles of natural justice and record reasons for its actions during such investigations.
Penalties	The GDPR prescribes fines under Article 83, and the same are administered according to the size of the	The    DPDP    prescribes an upper limit on the financial penalty for    non-compliance and the same
	organization, gravity impact on non-compliance, and other criteria. As per the GDPR, penalties structure can be up to 20 million Euros or, in the case of an undertaking, up to 4% of the entire global revenue of the prior fiscal year, depending on what is higher, for severe violations. Moreover, less serious violations can entail fines of up to 10 million Euros or, in the case of an undertaking, up to 2% of its total global revenue for the prior fiscal year, whichever is more significant.	has been limited to not more than INR 500 crores (Approx USD 6,04,97,530).