Every major privacy law shares a common ancestor in consent-based processing. What makes DPDPA distinct is exactly where it departs from that shared lineage.
July 2026 · 5 min read
DPDPA didn't emerge in isolation — it arrives after more than two decades of global data protection law, and it borrows structurally from several of them. Placed alongside its predecessors, both what it shares with them and what it does differently become clearer.
GDPR, passed by the EU in 2016 and enforced from 2018, set the modern benchmark with penalties up to €20 million or 4% of global turnover. California's CCPA and its CPRA amendment followed a narrower, more consumer-rights-driven model, with penalties capped around $7,500 per incident. China's PIPL, enforced from late 2021, ties penalties to up to 5% of revenue. Brazil's LGPD mirrors much of GDPR's structure with penalties capped near 2% of revenue. Singapore's PDPA, in force since 2014, was strengthened by 2021 amendments that took effect in February 2022 — for organisations with more than SGD 10 million in annual turnover, the maximum penalty became the higher of SGD 1 million or 10% of that turnover, a meaningfully higher ceiling than the flat SGD 1 million cap the law started with. Older frameworks — Canada's PIPEDA and Argentina's Law 25.326, both dating to around 2000–2001 — carry comparatively limited enforcement teeth.
DPDPA, passed in August 2023 with enforcement still moving through the rulemaking phase, sets its maximum penalty at ₹250 crore — placing it firmly among the more consequential regimes globally, even before full enforcement begins.
A handful of features don't have a direct equivalent elsewhere. DPDPA creates the Consent Manager as a formally regulated entity in its own right — an intermediary role that most other frameworks don't define at all. It builds in digital-by-design obligations rather than treating digital compliance as an implementation detail left to the fiduciary. It recognizes nomination rights, letting a person designate who manages their data in the event of incapacitation or death — a feature essentially absent from GDPR, CCPA, and most of their peers. Data minimization isn't stated as a standalone principle so much as implied through purpose-based processing itself. And its approach to cross-border data flow is permissive by default while still accommodating domestic localization mandates layered on top — a combination that sits differently from GDPR's more restrictive, adequacy-based model.
GDPR is enforced by independent national Data Protection Authorities in each EU member state, structurally separate from the government of the day. DPDPA instead creates a single, dedicated Data Protection Board of India, whose members are appointed by the Central Government. That's a genuinely different institutional model from GDPR's — a purpose-built adjudicatory body rather than a general privacy regulator with its own founding independence — and it's worth understanding on its own terms rather than assuming it behaves like the DPAs a GDPR-experienced team may already be used to dealing with.
DPDPA is among the more comprehensively structured privacy laws currently in force, particularly given its centralized enforcement model through the Data Protection Board and its broad applicability across sectors. It draws visibly on the precedents that came before it, but it's built for India's scale and its specific digital environment — not a transplant of GDPR with the names changed.
If you're already compliant elsewhere and need to know exactly what DPDPA still requires on top, our cross-regulatory privacy consultation covers precisely that gap.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation