GDPR vs DPDP: What Indian AI Companies Must Do Differently

The 7 Key Differences Indian AI Teams Must Understand

1. Lawful basis vs explicit consent: GDPR allows 6 lawful bases including legitimate interest. DPDP allows only consent no exceptions for AI processing.

2. Data principal rights: GDPR grants 8 rights; DPDP grants 4 core rights but adds a unique right to nominate a representative for deceased individuals.

3. Children's data: GDPR sets 16 as default age threshold; DPDP sets 18 with stricter parental consent verification requirements.

4. Data localisation: GDPR has no default localisation requirement. DPDP has a government-controlled restricted transfer list pending Indian AI teams must prepare for partial localisation.

5. Breach notification: GDPR requires 72-hour DPA notification. DPDP requires notification to the Data Protection Board and affected data principals timeline TBD in rules.

6. DPO requirement: GDPR mandates Data Protection Officers for high-risk processors. DPDP has no mandatory DPO but requires a Consent Manager.

7. Processing of sensitive data: GDPR has explicit categories (health, biometric, etc.). DPDP treats all personal data equally but raises the consent bar for sensitive categories.

What to Build for Dual GDPR + DPDP Compliance

Unified consent management: Build one consent layer that satisfies both: explicit, granular, withdrawable, purpose-specific. Store consent records with timestamps and version IDs.

Dual audit trails: Log every data access event with: data principal ID, purpose, lawful basis (GDPR) / consent ID (DPDP), processor name, timestamp. BoundrixAI provides this out of the box.

Separate data pipelines: EU-origin data must stay within GDPR adequacy zones unless you have SCCs. Indian data must stay within India pending DPDP transfer rules.

Rights fulfilment API: Build a single endpoint that accepts data principal requests and routes them to the correct deletion/access/correction workflow across all downstream systems.

30-Day DPDP Action Plan for Indian AI Companies

Week 1: Data mapping. Catalogue every personal data field your AI processes, which model it flows into, and where it's stored.

Week 2: Consent audit. Map every user touchpoint. Are you relying on GDPR's legitimate interest for any processing? Eliminate it for DPDP.

Week 3: Build consent records. Implement a consent database that logs consent ID, version, purpose, timestamp, and withdrawal status.

Week 4: Breach response playbook. Document your 72-hour GDPR response procedure and adapt it for DPDP's Board notification requirement.